OpenAI SDK v3.33.0 Released: Image Safety Identifiers and Cache Parameter Updates

OpenAI SDK v3.33.0 adds safety identifier fields to image endpoints and shares the Decisions cache breakpoint parameter type.
The official OpenAI SDK released v3.33.0 (commit hash b7c5e5d), containing two API-level changes. First, PR #4093 introduces safety identifier fields for image requests and responses, enabling content safety policies to be more tightly embedded in the API call chain and facilitating traceability of generated content and integration with external safety systems. Second, PR #4092 extracts the Decisions cache breakpoint parameter type into a shared type, unifying type definitions across modules. Although it does not change runtime behavior, it may affect import paths and compile checks in strongly typed languages. The version number rose from 3.32.x to 3.33.0, consistent with SemVer's definition of adding backward-compatible functionality. When upgrading, focus on verifying compatibility of image endpoint serialization behavior and type import paths.
OpenAI SDK v3.33.0 Update Overview
The official OpenAI SDK repository openai-sdks has released version v3.33.0, with commit hash b7c5e5d and a release date of October 16, 2026 (commit created on the 17th). This iteration is modest in scope but includes two API-level changes worth developers' attention: safety identifier support for image requests and responses, and the sharing of the Decisions cache breakpoint parameter type.
For teams integrating OpenAI's image generation or content moderation capabilities, both changes may affect existing call logic and type definitions.
Image API: Safety Identifiers Enter Requests and Responses
The most substantive change in this update is PR #4093, which adds safety identifiers to image requests and responses.
Previously, when developers called image-related endpoints, they had no way to carry safety-review-related identifier information at the request or response layer. This meant that when a platform needed to trace, tag, or connect generated content with external safety systems, there was no standardized field for passing such metadata.
The newly added safety identifiers give image requests and responses a clearer ability to convey safety context. For enterprise-grade applications, the value of this change lies in the fact that content safety policy enforcement can be more tightly embedded into the API call chain, rather than relying on an additional side-channel system.
If you are building products involving image generation, editing, or moderation, it is recommended to check your request construction and response parsing logic after upgrading to confirm the default behavior and serialization of the safety identifier field.
Semantic Versioning (SemVer) is the basis for judging this version number change. It uses a three-part MAJOR.MINOR.PATCH structure: the major version (MAJOR) increments on incompatible API changes; the minor version (MINOR) increments when backward-compatible functionality is added; and the patch version (PATCH) increments when backward-compatible bug fixes are made. Therefore, the jump from 3.32.x to 3.33.0 clearly indicates "backward-compatible functionality has been added," rather than a breaking change. This convention is critical for upgrade decisions: as long as the major version is not crossed, in theory existing calling code should run without modification. However, "backward compatible" mainly guarantees runtime behavior, and type definition adjustments can still trigger compile-time errors, especially for projects using strongly typed languages and custom extensions to SDK types.
Decisions Cache Breakpoint Parameter Type Sharing
Another change is PR #4092, which shares the Decisions cache breakpoint parameter type.
Decisions is the module in the OpenAI SDK used to handle decision-related logic, and the cache breakpoint parameter relates to where a request can be cached and reused. Previously, this parameter type may have been scattered across multiple locations or not uniformly exposed externally. This change extracts it into a shared type, keeping type definitions consistent across different modules.
From an engineering perspective, although this kind of refactor does not change runtime behavior, it has a direct impact on developers using TypeScript or other strongly typed languages: type import paths may change, and compile-time checks will be stricter. If you have customized related types or made type assertions in your project, watch for type mismatch errors when upgrading.
TypeScript's structural type system determines the actual scope of impact of the "shared type" change. TypeScript uses a checking mechanism that is nominally compatible but actually structural (duck typing): two types are considered compatible as long as their member shapes match. When a parameter type is extracted from scattered definitions into a unified export, if there are subtle differences between the original definitions and the new shared type's field shapes (for example, optionality or narrowing of literal unions), the compiler will report errors at assignments or assertions, while runtime remains unchanged. This is exactly the characteristic of such refactors: "no behavior change, only contract change." When troubleshooting upgrade issues, developers should first check the type export entry file to confirm whether the shared type is re-exported from the original path; if it is not re-exported, imports depending on the old path will fail directly. If necessary, a type alias or explicit type assertion can be used as a transition, but the more reliable approach is to switch directly to the new unified import path.
Version Number and Release Cadence Observations
The version number v3.33.0 follows semantic versioning. The move from 3.32.x to 3.33.0 is a minor version bump, which by convention means backward-compatible functionality was added—consistent with the nature of the two Features in this release.
The release date is listed as October 16, 2026, while the commit was created on the 17th. This one-day discrepancy is usually related to time zones or the processing order of the release pipeline and is normal.
From the update content, the OpenAI SDK team's current iteration focus remains on fine-grained refinement of API capabilities rather than large-scale architectural adjustments. For production systems depending on this SDK, the risk of such minor version upgrades is relatively manageable, but it is still recommended to verify image endpoints and safety-related logic in a test environment before pushing to production.
Upgrade Recommendations
For most users, v3.33.0 can be upgraded directly via the package manager. Focus on two areas: first, whether the newly added safety identifier fields in image requests and responses are compatible with your data model; second, whether the import path for the Decisions cache breakpoint parameter type has changed.
If your project has deep customization or wrapping of SDK types, it is recommended to review the full diff before deciding when to upgrade.
Related articles

Free Unlimited Claude Code Solution: Agnes AI + CC Switch Setup Guide
No paid subscription needed — pair the free AI platform Agnes AI with the open-source tool CC Switch to provide a backend for Claude Code, enabling unlimited free calls to text, image, and video models. This guide covers the full setup, test results, and usage boundaries.

A Complete Zero-Cost Guide to Getting Started with Claude Code for Beginners in China
A beginner's guide to Claude Code for users in China: two installation methods (command line and IDE plugin), full configuration steps for replacing the official API with the free domestic LongCat model, and a hands-on demo of building a small tool with natural language, plus tips.

When the NSA Gets Involved: The AI Supply Chain Crisis Behind Open-Source CVEs and API Key Hijacking
Multiple open-source projects disclosed severe CVEs in one day, PHP flaws alarmed the FBI, and Railway and OpenCode were breached with API keys stolen. This article breaks down the vulnerability window, AI-accelerated exploitation, and the AI supply chain crisis behind the API key black market, with a developer defense checklist.