Which change to an existing JSON API response is generally safe to ship without a new version?

"Adding a new optional field giftMessage" is safe. It is an additive change. Clients that ignore unknown fields keep working.

Renames, type changes and new required inputs all break existing clients. The tempting wrong answer is "Renaming total_price to totalPrice". It looks like a cosmetic change, but it breaks every client that reads the old key.