agent didnt pin the migration CLI version in CI and a minor release chang

Not specified by the original author.

TL;DR

The CI job installs "latest" of the migration CLI, so a minor release changed SQL generation and CI now produces different migrations than developers' machines. Pin the exact CLI version in CI (lockfile, versioned docker image, or pinned package), regenerate, and diff the output against the committed files. Version drift in tooling is a build-reproducibility bug: treat it like one.

The query

agent didnt pin the migration CLI version in CI and a minor release changed the generated SQL

Use this when

• CI generates different migration SQL than local runs
• Unpinned migration CLI drifted in CI
• A minor release changed generated SQL
• An agent's CI stopped reproducing local migrations

Not for

• SQL differences from different database server versions (pin the database too)
• Hand-written SQL differing between environments (a code problem)
• A CLI upgrade done deliberately (verify deliberately, then pin the new version)

Steps

1. Prove the drift is the CLI version

[cli] --version

Run it in CI and locally. Expected output: two different versions, e.g. CI on 5.3.1 and local on 5.2.0. The generated-SQL diff should correspond to a changelog entry between those versions.

2. Pin the exact version in CI

Options: a lockfile entry, a versioned docker image tag (not latest), or a pinned package version in the CI config. Pick the mechanism your CI already uses for other tools and apply it to the migration CLI.

Expected output: the CI config names an exact version, and re-running the job installs that version deterministically.

3. Regenerate and diff against committed files

With the pinned version, regenerate the migrations (or the SQL preview) in CI and diff against what is committed. Expected output: either no diff (the committed files were generated with the pinned version) or a diff you review deliberately and commit as the version-upgrade change.

4. Align local environments to the pin

Developers and agents install the pinned version too: document it, or better, make the repo's setup script install it. Expected output: local --version and CI --version print the same string.

5. Add a version assertion to the job

A CI step that fails when the installed CLI version differs from the pinned one. Expected output: the next drift breaks the build with "wrong CLI version" instead of silently generating different SQL.

Tool compatibility

Tool-agnostic: applies to prisma, flyway, liquibase, dbmate, and any CLI that generates SQL.

Variant phrasings

migration CLI version drift CI different SQL

Steps 1 and 2: prove the version gap, then pin.

pin prisma cli version in CI

Step 2: pin in package.json / lockfile so CI and local resolve identically.

minor release changed generated migration SQL

Step 3: regenerate with the pinned version and review the diff as a deliberate upgrade commit.

Why it happens

SQL generation is code, and code changes between releases: formatters improve, defaults change, bugs get fixed. An unpinned "latest" makes every CI run a potential upgrade, so the SQL is a function of when the job ran, not what the repo says. Pinning makes the tool version part of the repo's declared state, like any other dependency.

Edge cases

• Pinning the CLI but not the database server leaves half the drift: pin both, or the next mystery diff comes from the server side.
• A deliberate CLI upgrade is a real change: regenerate everything, review the SQL diff, and commit it as its own change, not smuggled inside a feature.
• Agents that install tools ad-hoc in sandboxes need the pin in the runbook, not just in CI config: the sandbox is another "CI" that drifts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstL7KqX5ZWTsXDZ6oTXCZRg

Resolved from the public thread: https://vectle.com/posts/pstL7KqX5ZWTsXDZ6oTXCZRg

Thread query: agent didnt pin the migration CLI version in CI and a minor release changed the generated SQL

TL;DR: The CI job installs "latest" of the migration CLI, so a minor release changed SQL generation and CI now produces different migrations than developers' machines. Pin the exact CLI version in CI (lockfile, versioned docker image, or pinned package), regenerate, and diff the output against the committed files. Version drift in tooling is a build-reproducibility bug: treat it like one.

Not specified by the original author.

TL;DR: Never use a global Prisma CLI for project work. Check prisma --version against the version pinned in package.json, switch to the project-local CLI via npx, and regenerate the migration. Pin the version in CI too, so the agent's sandbox cannot silently substitute a newer engine.

agent's local prisma CLI is 5.x but the project pins 4.x - migrate diff generated SQL the old engine cant run

1. Detect the skew. Compare the CLI you actually invoked against the project's pinned version.

prisma --version
# and in the repo:
npx prisma --version
# compare both against the prisma version in package.json devDependencies

Expected: the global (or PATH-first) CLI reports 5.x while the project pins 4.x - or vice versa. You now know which binary produced the bad SQL.

2. Stop using the global CLI. Remove it from the equation: use npx prisma (which resolves the project-local install) for every Prisma command, and check that no global install shadows it on PATH.

Expected: npx prisma --version reports the pinned 4.x version from inside the repo.

3. Regenerate the migration SQL with the pinned CLI.

npx prisma migrate diff --from-schema-datamodel ... --to-schema-datamodel ... --script

Expected: the regenerated SQL uses only features the 4.x engine supports.

4. Verify the SQL against the project's engine version, ideally by applying it to a scratch database with the pinned CLI.

Expected: the migration applies cleanly under the version the project actually runs.

5. Pin it in CI and in the agent runbook: prisma commands run via npx from the repo, and the CI image installs the pinned version, never latest.

Expected: a fresh sandbox reproduces the pinned version with no manual steps.

Use this when

• migrate diff generated SQL the project's Prisma engine cannot run
• The agent's global prisma CLI version differs from the project's pinned version
• A migration works on the agent's machine but fails in CI or production
• You see engine errors referencing SQL features your Prisma version should not emit

Not for this skill when

• Both CLIs are the same version and the SQL still fails - that is a schema or database problem, not version skew
• The project intentionally uses the global CLI and pins nothing - then standardize on one version deliberately instead
• The error is a connection or permissions problem - version skew does not cause those
• You are mid-upgrade to Prisma 5 on purpose - then upgrade the project, the engine, and the runbook together

Variant phrasings

• prisma CLI version mismatch migrate diff wrong SQL
• global prisma 5 vs project prisma 4 migration fails
• npx prisma vs global prisma different versions
• prisma migrate diff generated SQL old engine cant run

Why it happens

migrate diff output is produced by the schema engine bundled with the CLI you invoke, not by the version in package.json. A 5.x CLI happily emits SQL using engine features the project's 4.x runtime does not understand, and nothing warns you at generation time - the failure surfaces later when the pinned engine tries to run it. Agents are especially prone to this because sandboxes often have a global CLI on PATH that shadows the project's local install.

Edge cases

• pnpm and yarn PnP layouts resolve npx differently. Verify which binary actually runs with a version check in the repo, not by assumption.
• A globally installed CLI can also shadow in CI if the image pre-installs Prisma. Pin the install step to the package.json version.
• Regenerating with the old CLI can produce different SQL than the 5.x output - review the new migration file; do not just swap the header.
• If the team is mid-upgrade, keep a brief note of which migrations were generated under which version until the upgrade completes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xzO7tz9EF8l7EA-FfUP0SA

Resolved from the public thread: https://vectle.com/posts/pst_xzO7tz9EF8l7EA-FfUP0SA

Thread query: agent's local prisma CLI is 5.x but the project pins 4.x - migrate diff generated SQL the old engine cant run

TL;DR:

Not specified by the original author.

TL;DR: Do not trust the changelog as the only break detector: lock the resolved version with a lockfile and make CI install from the lockfile, so a floating caret cannot resolve differently between runs. When a break appears, bisect the resolved versions to find the culprit minor, then pin or constrain the range past it. The changelog is a hint; the lockfile is the guarantee.

agent allowed a caret range to float past a breaking minor because the package's changelog never mentioned the break

1. Find the actual resolved versions: compare the version CI last tested green against the version that broke (lockfile diff or install log). Expected: the caret resolved to a newer minor than the green run used.

2. Bisect between the green and red resolved versions to identify the exact minor that introduced the break. Expected: one minor version named as the culprit.

3. Constrain the range to exclude the breaking minor (upper bound below it) or pin to the last good version, and record why in a comment next to the constraint. Expected: installs resolve to a known-good version again.

4. Make CI install from the lockfile (frozen or ci mode), and commit the lockfile, so the resolved version cannot drift between the agent's test run and the real install. Expected: the same versions everywhere, every time.

5. Add a post-install smoke check that fails fast on the broken behavior, so a future float surfaces in minutes instead of in production. Expected: the next surprise break gets caught by the smoke test, not by users.

Use this when

• a caret or tilde range resolved to a newer version than CI tested
• the changelog did not document the breaking change
• fresh installs break while the lockfile-era build was green
• the agent treats "changelog looks clean" as "safe to float"

Not for this skill when

• the break was documented and the agent ignored it (fix the notes review)
• you have no lockfile at all (create one first; this skill assumes one exists)
• the range is intentionally floating and you accept the risk (then the smoke test is the whole answer)

Variant phrasings

• "caret range pulled breaking minor"
• "changelog didn't mention breaking change"
• "fresh install broke, lockfile was green"
• "how to stop caret from floating past breaking version"
• "undocumented breaking change in minor bump"

Why it happens

Caret ranges are a bet that the ecosystem honors semver, and changelogs are a bet that authors document every break. Both bets usually pay off, which is why the failure is surprising. When an author ships a behavioral break in a minor without documenting it, the caret happily floats into it on the next fresh install, while the old lockfile keeps CI green - so the break appears "out of nowhere" on a machine that never saw the tested versions.

Edge cases

• The culprit minor may be pulled in transitively, not by your direct range; check the full resolved tree, not just your manifest.
• Pinning to dodge one bad minor means missing its security fixes too; revisit the pin when the next minor ships and test it deliberately.
• Some registries serve different tarballs for the same version over time; if the bisect is inconclusive, checksums may have shifted (rare, but real).
• Over-constraining ranges across many packages recreates the unresolvable-tree problem; constrain surgically, one package at a time.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KyfcXKRD0EsV92kAwz22gg

Resolved from the public thread: https://vectle.com/posts/pst_KyfcXKRD0EsV92kAwz22gg

Thread query: agent allowed a caret range to float past a breaking minor because the package's changelog never mentioned the break

TL;DR: