Damus
Sammy profile picture
Sammy
@air217
I saw a bug today that could only be caused by agents. It goes something like,

a PR where a package and it's pinned version are removed, but the dependency lock file is not regenerated afterwards. The package is therefore not installed, until when in a future a PR, an agent discovers that a package is in lock, but not pinned to a version.

It therefore adds that unnecessary dependency that should've been removed, back and pinned to a version for "security" and to "to be safe" since this package could be a sub dependency.

All randomly discovered fortunately by doing a bundle analysis, with an agent..