AI coding

Dependency and lockfile reliability

• A File Manifest for Lockfile Diffs: Paths, Globs and Line Counts
• A Lockfile Diff Budget: Capping an Agent's Dependency Change
• A Second Registry Check Before an Agent Bumps a Package
• Costing a Dependency Bump in CI Minutes
• How to Read a Dependency Change an Agent Made
• Reading a Lockfile Diff: Which Entries a Reviewer Must Open
• Teaching an Agent to Read a Lockfile Before Touching Dependencies
• When an Agent Bumps a Major Version: A Pre-Merge Checklist
• A Changelog Review Step for Dependency Bumps an Agent Proposes
• A Dependency Bump That Passes Tests but Breaks in Prod
• A Dependency Gate for Agent Branches: Lockfiles and Scripts
• A Postmortem for a Bad Dependency Bump That Passed Tests
• A Pre-Install Log for Agent Package Requests
• Budgeting an Agent's Dependency Resolution in Time and Tokens
• Denying Platform-Specific Optional Dependencies
• How to Audit a Lockfile for License Changes an Agent Introduced
• Installing a Manifest Change on a Staging Clone
• Listing the Transitive Files a Lockfile Diff Pulls In
• Mapping a Lockfile to the Files It Pulls In
• Pairing Lockfile Reads with Package Install Logs
• Peer Conflicts and Hoisting When an Agent Installs
• Pinning a Registry Snapshot to a Run: Tarballs, Hashes and TTLs
• Pinning vs Chasing: A Dependency Policy for Agent Branches
• Reading a Manifest Diff for License and Maintainer Changes
• Reading Provider Changelogs as Part of the Release Process
• Reading Provider Status and Changelogs in Your Release Process
• Structuring a Dependency Report an Agent Can Hand to a Reviewer
• Targeted Suites by Touched Surface for a Dependency Bump
• Teaching an Agent to Read a Package Manifest Before It Installs
• What a Dependency Diff Costs in Lockfile Lines and Review Minutes
• When a Lockfile Change Passes Tests but Breaks Production
• When a Lockfile Entry Fails to Resolve in an Agent Sandbox
• When an Agent's Lockfile Change Passes Tests but Breaks Prod