deps(genkit-agent): override openai to 7.8.0 for Socket alert

[davidmytton]

Socket’s blocking alert on #201 is a medium potential vulnerability on openai@4.104.0, pulled in by @genkit-ai/compat-oai@1.41.0.

Cannot update the parent packages. genkit and @genkit-ai/compat-oai are already at latest (1.41.0). Upstream still declares openai@^4.95.0, and even compat-oai@1.42.0-rc.1 on genkit main keeps that pin. There is no published 4.x newer than 4.104.0, and no GHSA — this is Socket’s own “potential vulnerability” class.

Workaround: npm overrides force openai@7.8.0 (current latest). The lockfile no longer resolves 4.104.0.

Compatibility: this example uses non-streaming ai.generate(), which maps to client.chat.completions.create — still present on 7.x. APIError remains a named export. client.beta.chat.completions.stream is gone in 7.x, so Genkit streaming through compat-oai would break; this demo does not stream.

Docs: OVERRIDES.md records why the pin exists and when to remove it. Linked from CONTRIBUTING.md and the genkit-agent README.

Other Socket Block rows on #201 are AI “code anomaly” signals on Genkit’s telemetry stack (@genkit-ai/core, firebase, otel, zod, …). Those come with genkit itself and are not cleared by this override.

This PR is meant to land on #201 (david/cursor/genkit-agent-example).

  

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Approved

Rationale: Small, well-scoped change to an example project's package.json: adds an npm overrides entry to force openai@7.8.0 in order to clear a Socket 'potential vulnerability' alert on the 4.x pulled in by @genkit-ai/compat-oai. The change is confined to examples/genkit-agent, not production/library code. The description reasonably justifies why the parent packages can't be bumped and calls out the compatibility surface used by this example (non-streaming ai.generate() → chat.completions.create, APIError export), acknowledging that streaming via compat-oai would break under 7.x. Dependency-change trigger fires but the risk is limited to an example. Approving as a Medium judgment call with an inline comment about package-manager compatibility of the overrides field.

Summary of Changes

Adds an overrides block to examples/genkit-agent/package.json pinning openai to 7.8.0 to override the transitive openai@4.104.0 (via @genkit-ai/compat-oai@1.41.0) flagged by Socket. No source code changes.

Escalation Triggers

• Dependency Changes: Modifies examples/genkit-agent/package.json, adding an overrides entry forcing a major version jump (openai 4.x → 7.8.0) on a transitive dependency.

Notes

No lockfile appears in the Files Changed list; the description states 'The lockfile no longer resolves 4.104.0', so a lockfile update was likely made and either filtered out of the diff view or should have been committed. Reviewers should verify the lockfile in the branch actually reflects openai@7.8.0.

Path filtering: 1 file excluded by ignore paths. 1 of 2 files included in review.

_{Review: 7f3c50fc | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review}

[arcjet-review]

Which package manager does this example use? The top-level overrides field is npm's convention; pnpm reads pnpm.overrides and Yarn Classic uses resolutions. If this example is installed with pnpm/yarn, this override may silently be ignored and openai@4.104.0 will still be resolved transitively. Worth confirming with a fresh install + npm ls openai (or the equivalent) that only 7.8.0 is present, and either mirroring the override under pnpm.overrides/resolutions or documenting that npm is required here.

[arcjet-review]

The PR description notes streaming via compat-oai breaks on openai 7.x because client.beta.chat.completions.stream is gone. Could you add a short comment in the README (or near the example's generate call) noting that this example is intentionally non-streaming and that enabling streaming would require reverting/relaxing this override? That will save the next contributor from a confusing runtime error.