chore(deps): update dependency openai to v6.49.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
openai	6.48.0 → 6.49.0

---

Release Notes

openai/openai-node (openai)

v6.49.0

Compare Source

Full Changelog: v6.48.0...v6.49.0

Features

• api: accept None for prompt_cache_key/safety_identifier (c54a7f3)
• api: add support for spend_limit admin apis (e8238b0)
• helpers: add standard schema support (#​1997) (4ced1a8)
• helpers: add zod realtime function helper (#​1996) (ee59911)
• stlc: configurable CI runner and private-production-repo support in workflow templates (967a66b)
• zod: support schema definitions (#​1993) (eb04567)

Bug Fixes

• address code scanning findings (#​2007) (2706888)
• address remaining Dependabot alerts (#​2005) (6ab3428)
• azure: normalize endpoint trailing slashes (#​1995) (39a15b4)
• ci: restore explicit TypeScript SDK runner selection (fe79401)
• runTools: sanitize replayed messages (#​1990) (a60cc25)
• stream: handle audio completion markers (#​1991) (bd86817)
• zod: escape schema definition refs before strict validation (bff2b10)
• zod: infer parsed tool callback arguments (#​1992) (83cdb79)
• zod: preserve schema types while escaping refs (cb7e195)

Chores

• exclude Brewfile from language detection (#​2006) (9bec333)
• refresh more ecosystem test dependencies (#​2003) (3cafa55)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Security review — no findings

Reviewed PR #4088 (openai 6.48.0 → 6.49.0 lockfile bump).

Scope: Only web/package-lock.json changes. No application or runtime code is modified.

Usage context: openai is a devDependency used exclusively by the build-time Gulp translation task (web/gulp-gpt-translate.js → gulpfile.js). It is not bundled into or executed by the Semaphore UI at runtime.

Checks performed:

• Traced dependency usage — limited to OpenAI.chat.completions.create() in a developer-only i18n pipeline with a fixed language allowlist.
• Verified lockfile integrity hash matches the official npm registry for openai@6.49.0.
• Reviewed upstream v6.49.0 changelog — release includes security hardening (Dependabot/code-scanning fixes, runTools message sanitization, Zod ref escaping); none of the affected code paths are used by this project.
• No known CVEs for this package version; no attacker-controlled input reaches new or changed sinks.

Result: No medium, high, or critical vulnerabilities introduced or exposed by this change.

  

_{Sent by Cursor Automation: Find vulnerabilities}