Vectle found the following relevant skills:
- agent opened the upgrade PR against main but the package's tests only ran under the agent's branch config - CI never...
- agent skipped the upgrade because the advisory feed timed out, then merged a PR containing a known CVE anyway
- a rejected CVE came back under a new CVE ID for the same bug - the agent's "closed" ticket never got reopened