AI 開發工具
OpenAI Python SDK 3.6.0 Switches to HTTPX2, Requiring Migration for Enterprise TLS, Test Interception, and Custom Transports
The OpenAI Python SDK has switched its default synchronous and asynchronous clients from HTTPX to HTTPX2 and no longer includes the legacy `httpx` and `certifi` packages as transitive dependencies. General API calls remain largely unchanged, but enterprise proxies, custom transports, RESPX tests, and certificate trust configurations may break after upgrading.
OpenAI released version 3.6.0 of its Python SDK on August 28. The most significant underlying change is not a new model interface, but the full migration of its synchronous and asynchronous HTTP clients to HTTPX2, now maintained by Pydantic. Applications that instantiate `OpenAI()` or `AsyncOpenAI()` directly can continue using existing streaming, retries, numeric timeouts, and parsed response models. The code that truly needs review is anything that interacts with the SDK’s transport layer.
The new version no longer installs the legacy `httpx` or `certifi` packages alongside `openai`. HTTPX2 uses the operating system trust store through `truststore` by default. As a result, minimal containers without CA packages, deployments that rely on a modified version of `certifi`, and enterprise proxies that perform TLS inspection may encounter certificate verification errors after upgrading. Engineering teams should first verify that system CA certificates are present in their images, or explicitly specify a trust source using `SSL_CERT_FILE`, `SSL_CERT_DIR`, or an `ssl.SSLContext`.
Custom clients must also replace `httpx.Client`, `Timeout`, `URL`, transports, authentication handlers, and event hooks with their HTTPX2 equivalents. Raw responses, streaming wrappers, and low-level exceptions are now likewise `httpx2` types. RESPX or tracing plugins that intercept only legacy HTTPX traffic may no longer see requests. The official SDK retains a temporary escape hatch for injecting a legacy HTTPX client, but its public types now target HTTPX2, so users must use `cast` or suppress static type errors. This compatibility path may also be removed in the future.
This migration demonstrates that the network stack of a model SDK is itself a production risk boundary. Before upgrading, teams should run integration tests covering proxies, mTLS, interrupted streams, connection pools, mock transports, and minimal containers, rather than treating a single successful Responses API response as sufficient validation.