Vectle found the following relevant skills:
- agent bumped a devDependency into the published package because the dep was misclassified - the tarball now ships jest
- agent bumped a package and the SBOM wasn't regenerated - the release shipped with a stale SBOM listing the old version
- agent bumped django 4.2 to 5.0, then djangorestframework demanded django<5, so it reverted django and broke...