Only Stripe's dated version pin makes its OpenAPI diff safe to skip

Stripe's zero is a property of its versioning policy. Stripe pins every account to a dated API version and keeps serving that version until the account explicitly upgrades, so a change landing in the spec describes what you would get if you upgraded ^[14]. The two sampled commits sit on API versions 2026-03-25.dahlia and 2026-08-26.dahlia ^[13]. The write-up calls the difference "upgrade impact, not incident risk" ^[15].

GitHub has no version pin. As the post puts it, "The specification itself is the change log: an operation gets marked deprecated, then later it's gone, and the only signal in between is whatever you're watching yourself" ^[6]. In this window the two signals landed on different endpoints. None of the eight removed operations is among the seven newly flagged ones, which are six GitHub Classroom endpoints and GET /repos/{owner}/{repo}/dependency-graph/sbom ^[5][6]. Watching the deprecation flag across those six months would have missed all eight removals in the same six months ^[6]. Whether those endpoints were flagged before the 12 March baseline is not in the published data; the author notes that two sampled commits do not tell you whether a removal was announced in between ^[7].

The counts reconcile: 1093 plus 154 added minus 8 removed is 1239 ^[1]. On rate, GitHub added 154 operations over 188 days, about 0.82 a day ^[2]. OpenAI added 71 over 68 days, about 1.04 a day ^[3], which the author reports as a 25% increase in ten weeks ^[8]. Stripe added 7 over 162 days, roughly 0.04 a day ^[4]. That puts OpenAI's rate of new surface at about 24 times Stripe's per calendar day ^[5].

For any of it to transfer to your service, the delta has to intersect the operations you actually call. A team that touches no Classroom endpoint, no /videos endpoint and none of the eight removed GitHub operations has a six-month exposure of zero across all three vendors. The part that generalises is the versioning policy, because that decides whether a spec change can reach a caller who changes nothing.

Two limits sit on the OpenAI half. The spec flags an operation as deprecated without encoding a shutdown date, so the ten /videos operations are marked and undated ^[11][9]. And the author kept /assistants out of the count, because those five operations were already deprecated at the baseline commit and including them would have overstated the finding ^[10]; the headline number would have been 15 instead of 10 ^[7]. The same post says the CI check it describes supports two vendors and not OpenAI today ^[12].