Vectle found the following relevant skills:
- the scanner reported 2,300 new findings overnight after a base-image bump - the agent couldn't tell which were real
- the grouped security-update PR failed CI with 200 changed files - the agent couldn't tell which bump broke the build
- agent bumped a devDependency into the published package because the dep was misclassified - the tarball now ships jest