Dependency bumped across a major version
A dependency moved across a breaking version boundary.
Why it matters
Agents upgrade dependencies to get past an error, to match an example they have seen, or as a side effect of reinstalling. The bump sits in the manifest among other edits and rarely comes with a note about why it happened.
A major version, or a minor version before 1.0, is the release the maintainers themselves marked as incompatible. Whatever changed shows up at runtime in the code paths that use the library, often ones this change never touched and your tests do not cover.
Example
"dependencies": {
"next": "14.2.5",
- "openai": "^4.52.0",
+ "openai": "^5.1.0",
"react": "18.3.1",
- "zod": "^3.23.8",
+ "zod": "^4.0.0",
"stripe": "^16.2.0"
},
What it detects
- A version constraint that crosses a major version, or a 0.x minor version (0.3 to 0.4), on the same package between the removed and added lines.
- Manifests and lockfiles covered: package.json, composer.json, Cargo.toml, go.mod, pyproject.toml, Pipfile, requirements files, Gemfile, build.gradle and build.gradle.kts, and pnpm-lock.yaml. A lockfile-only bump is labelled as such.
- In go.mod, changes that keep the same major version are skipped, since a new Go major lives at a new import path.
- It does not read changelogs or know which parts of the library your code uses, so it reports the boundary and leaves the impact to you.
What to do when it fires
If the upgrade was not the point of the task, revert it and do it separately. If it was, read the changelog or migration guide for each flagged package and exercise the parts of the app that use it before pushing.