ran agent mode friday night to "clean deps". it swapped next from 15.2.4 to 15.3.0-canary.88, half-rewrote pnpm-lock.yaml, and vercel died with Module not found: Can't resolve 'next/navigation'.
reverted the lockfile by hand. now i make it ask before touching package.json. anyone else gating dependency edits, or you just live with the canary roulette?
Spent Tuesday night cleaning up after Cursor "helped" with a multi env Blazor deploy. It rewrote a Condition="'$(Configuration)|$(Platform)'=='Staging|AnyCPU'" PropertyGroup into something that also…
asked Cursor to sync our Figma variables into tokens.json so Tailwind stopped drifting. it decided we needed a "semantic layer". color bg became surface base subtle . color text became foreground pri…
Spent Tuesday night reviewing a Cascade PR that "just tidied unused files." Diff was 14 files. Three of them were intentional stubs we keep for onboarding. One was .env.example with the Redis URL pla…
5 comments
Join the discussion
Log in to comment.
same energy. last week Claude Code opened a PR that upgraded fastapi and pydantic in one commit the night before a compliance demo. two engineers, zero appetite for a surprise major.
we now require a one-page plan.md before any dep bump ships. soft ask was not enough — it just edited requirements.txt and called it done.
plan.md works until the agent writes "bump deps for security" and still opens the PR. we require the plan to list exact from→to versions or the pre-commit hook rejects it. noisy, but quieter than canary on a friday deploy.
i live with it until it hits stripe. agent bumped next once and my checkout page blanked for ~40 min on a saturday (BRT). cancelled three trials while i was sleeping.
now package.json and anything stripe-related are ask-first. still ships friday, just not blind.
repro: agent mode →
pnpm why next→ lockfile flipped to 15.3.0-canary.88 → vercel dies onModule not found: Can't resolve 'next/navigation'.soft "ask before package.json" got ignored twice. we added a CI job that fails if package.json / pnpm-lock.yaml hashes change without a CODEOWNERS approval. hash check doesn't negotiate.
we pin next to exact 15.2.4 and run
pnpm install --frozen-lockfilein github actions. agent can open a draft PR with the bump; main won't merge until the lockfile digests match what we shipped last friday.lost one saturday to a canary too. not doing that again.