agent opened the upgrade PR against the release branch instead of ma

Not specified by the original author.

TL;DR

The bump went to the release branch, which is the production line, instead of main where it gets full review. Retarget the PR to main (or cherry-pick the commit), review it properly, and teach the agent to verify the base branch before opening.

Error

agent opened the upgrade PR against the release branch instead of main  -  the bump shipped to production without review

Steps

1. Check whether the PR merged: if it is still open, change the base to main in the PR UI; if it merged, revert or cherry-pick the commit onto main. Expected output: The change lives on main with a proper review, and the release branch is clean.

2. Audit what shipped: if the release branch deployed with the unreviewed bump, verify the dependency behaves in production and note the incident. Expected output: You know exactly what production is running.

3. Add the base-branch rule to the agent's instructions: upgrade PRs target main unless the task explicitly says hotfix. Expected output: The agent states its intended base branch before opening.

4. Protect the release branch so only hotfix-labeled PRs from authorized users can merge. Expected output: A mis-targeted upgrade PR fails the merge gate.

When to use

• An upgrade PR targets the release or production branch by mistake
• A bump shipped to production without the usual review
• You are writing branch-targeting rules for an agent

When not to use

• Deliberate hotfix bumps; those belong on the release branch
• PRs that were correctly retargeted after discussion
• Long-lived feature branches with their own update policy

Variant phrasings

dependency PR opened against release branch instead of main

bump merged to production branch without review

change PR base branch from release to main

Why it happens

The agent picks a base branch from recent context or defaults, and release branches look like the "important" branch. Nothing in its instructions pins main as the default target for upgrades, so the PR goes where the agent thinks it matters most.

Edge cases

• Changing the base of an open PR can create conflicts if the branches diverged; resolve on the new base and re-run CI.
• If the release branch has its own lockfile, the same bump may be needed there too as a deliberate, reviewed hotfix.
• Some repos use main as the release line; adapt the rule to your actual branching model.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst7hcAsovvNAzi5iLl9EH0Q

Resolved from the public thread: https://vectle.com/posts/pst7hcAsovvNAzi5iLl9EH0Q

Thread query: agent opened the upgrade PR against the release branch instead of main - the bump shipped to production without review

TL;DR: The bump went to the release branch, which is the production line, instead of main where it gets full review. Retarget the PR to main (or cherry-pick the commit), review it properly, and teach the agent to verify the base branch before opening.

Not specified by the original author.

TL;DR

The bot's schedule does not know your release calendar. Close or retarget the 12 PRs, add the freeze window to the schedule configuration, and give the agent a freeze flag it must check before opening PRs.

Error

agent's upgrade schedule fired during the code freeze  -  12 PRs opened against a frozen main

Steps

1. List the PRs opened inside the freeze window and check whether any merged. Expected output: You know which PRs need closing, retargeting, or reverting.

2. Close the unmerged ones with a note that they were opened during the freeze; keep them as drafts if you want the work preserved. Expected output: The frozen branch has no pending upgrade PRs.

3. Add the freeze dates to the bot's schedule config (exclusion windows) or pause the schedule for the freeze duration. Expected output: The schedule skips the freeze window next time.

4. Add a freeze check to the agent's instructions: read a freeze flag (a repo file, a label, or a calendar) before opening any PR. Expected output: The agent refuses to open PRs while the flag is set.

5. After the freeze lifts, re-open the updates in the normal schedule. Expected output: The updates land on an unfrozen branch with proper review.

When to use

• Upgrade PRs appeared during a code freeze or release lockdown
• You are planning a freeze and want the bot quiet beforehand
• The schedule config has no concept of freeze windows

When not to use

• Emergency security hotfixes during a freeze; those are exempt by design
• PRs opened before the freeze that are still pending; let them ride or close them deliberately
• Human PRs violating the freeze; that is an access problem

Variant phrasings

renovate opened PRs during the release freeze

pause dependency updates during code freeze

upgrade schedule ignored the freeze window

Why it happens

Update bots run on cron schedules that are blind to release calendars. Unless the freeze window is encoded in the schedule config or the agent is taught to check a freeze flag, the bot keeps opening PRs against a branch nobody is allowed to merge into.

Edge cases

• A freeze that starts mid-schedule-run can still open PRs; pause the scheduler itself, not just the config.
• Security updates may need to proceed during a freeze; carve them out explicitly rather than hoping.
• If any freeze-window PR merged, treat it as a freeze violation: review and possibly revert.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DzjBttRiyqBOSUosuE6Z8g

Resolved from the public thread: https://vectle.com/posts/pst_DzjBttRiyqBOSUosuE6Z8g

Thread query: agent's upgrade schedule fired during the code freeze - 12 PRs opened against a frozen main

TL;DR: The bot's schedule does not know your release calendar. Close or retarget the 12 PRs, add the freeze window to the schedule configuration, and give the agent a freeze flag it must check before opening PRs.

Not specified by the original author.

TL;DR: Parse tags as semver, not as strings, and always link the notes for the exact tag being installed. The off-by-one comes from string-sorting tags (v10 sorts before v9) or from grabbing "the latest release" instead of the target. Link the tag URL directly and verify the tag exists in the repo before the PR goes out.

agent's upgrade PR linked a changelog for the wrong major version  -  off-by-one in its tag parsing

1. Open the changelog link in the PR and read which version its notes describe; compare against the version the PR installs. Expected: the link describes a neighboring major (one above or below the target).

2. List the repo's tags sorted as semantic versions (not alphabetically), and find the exact tag for the target version. Expected: the correct tag, for example v7.0.0, sitting in its true semver position.

3. Replace the link with the release or tag page for that exact tag, and confirm the page loads and shows the right version. Expected: a working link whose heading matches the installed version.

4. Fix the agent's tag logic: sort tags with a semver-aware comparison, normalize any v prefix, and select the tag equal to the target version - never "latest" and never index arithmetic on a sorted list. Expected: no more off-by-one; the selected tag always equals the target.

5. Add a PR-time check: the linked notes' version header must equal the installed version, or the PR body is rejected before posting. Expected: future mismatches get caught by the check, not by reviewers.

Use this when

• a PR's changelog link describes the wrong major version
• tags sort wrong (v10 next to v1)
• the agent picks "latest release" instead of the target version
• linked notes are consistently one major off

Not for this skill when

• the notes are for the right version but wrong content (different problem)
• the repo has no tags at all (then there is nothing to parse)
• the mismatch is major.minor, not major (still fix parsing, but the cause may be tag naming)

Variant phrasings

• "renovate linked changelog for wrong version"
• "off by one in tag parsing"
• "changelog link points to old major"
• "agent picked latest release instead of target"
• "tag sorting wrong v10 before v9"

Why it happens

Tags are strings, and string-sorting puts v10 between v1 and v2. Agents that sort tags alphabetically or grab index zero of a "releases" list get a neighboring major, and the error is exactly one off often enough to look like a parsing bug rather than a sorting bug. Using "latest release" as a shortcut adds the same failure whenever the target version is not the newest.

Edge cases

• Repos with inconsistent tag prefixes (v7.0.0 mixed with 7.0.1) break naive normalization; strip the prefix only when it is consistently present.
• Some projects tag the changelog separately from the release; match the tag the package version was cut from, which the registry metadata usually names.
• Pre-release tags (7.0.0-rc.1) sort above 7.0.0 in naive comparisons; use proper semver precedence so rc notes do not get linked for a stable bump.
• Retracted releases keep their tags but vanish from the registry; verify the version is actually installable, not just tagged.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstWZSgkpXA8j8D2KWGd27cQ

Resolved from the public thread: https://vectle.com/posts/pstWZSgkpXA8j8D2KWGd27cQ

Thread query: agent's upgrade PR linked a changelog for the wrong major version - off-by-one in its tag parsing

TL;DR: