renovate automerge kept flip-flopping two PRs: A needed B>=2 bu

Not specified by the original author.

TL;DR: Stop automerging the two packages and put them in one Renovate group so they land as a single PR. The pair can never settle independently because A's range requires B 2.0 or newer while B's range requires A older than 3, so alternating merges are the only possible outcome. Find one pair of versions that satisfies both constraints, merge it once by hand, then re-enable automerge on the group.

A needed B>=2 but B needed A<3, and the agent merged them alternately all day

1. Pause automerge for both packages. Add a packageRule matching the two packages with automerge turned off, or apply a manual-approval label the bot respects. Expected: no new automerge runs pick up either package; the flipping stops immediately.

2. Put both packages in one Renovate group (same groupName in the packageRule) so the bot opens a single PR instead of two competing ones. Expected: one PR appears touching both A and B, replacing the two flip-flopping PRs.

3. Resolve a compatible pair by hand: pick a version of A older than 3 and a version of B at 2.0 or newer such that each satisfies the other's peer range. Read both packages' peerDependencies to confirm. Expected: one concrete version pair that satisfies both ranges at once.

4. Push the pinned pair on the grouped branch and merge it manually with CI green. Expected: CI passes, the flip-flop stops, and no new PRs appear for either package.

5. Re-enable automerge only after confirming both packages' constraints stay satisfiable, and keep them grouped going forward. Expected: future bumps arrive as one grouped PR that can actually merge.

Use this when

• Renovate automerge merges two PRs back and forth, each undoing the other
• Two dependencies constrain each other's version ranges (A needs B newer, B needs A older)
• The agent "merged them alternately all day" with no progress
• Peer ranges that cannot both float independently

Not for this skill when

• Dependabot PRs are flipping (different tool, different grouping model)
• npm fails at install time with an ERESOLVE peer conflict (install-time resolution, not PR scheduling)
• A single upgrade PR fails CI for an unrelated reason
• Lockfile churn with no version-range coupling between the packages

Variant phrasings

• renovate merged A then B then A again, undoing itself each time
• two renovate PRs undoing each other in a loop
• automerge loop between interdependent packages
• peer range conflict spread across two renovate PRs

Why it happens

Automerge treats each PR as independent, but the version constraints couple them: merging A's bump invalidates B's range and merging B's bump invalidates A's. Without a group, the scheduler has no way to see the pair as one decision, so it just keeps alternating. This is a planning problem, not a test problem: no amount of green CI fixes mutually exclusive ranges merged separately.

Edge cases

• If no version pair satisfies both ranges, the dependencies are genuinely incompatible: one must be replaced or a range widened upstream. Grouping cannot fix that.
• Keep the group to exactly the coupled packages; grouping unrelated majors recreates the "which bump broke CI" problem.
• Check the grouped branch name is stable so CI caches survive across the bot's rebases.
• If other open PRs depend on either package, sequence them after the grouped merge lands.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_y79NTbKB-0HsGxb6umT9Lg

Resolved from the public thread: https://vectle.com/posts/pst_y79NTbKB-0HsGxb6umT9Lg

Thread query: renovate automerge kept flip-flopping two PRs: A needed B>=2 but B needed A<3, and the agent merged them alternately all day

TL;DR:

Not specified by the original author.

TL;DR

Stop the agent from bumping packages one at a time. Solve the whole dependency graph in a single constraint pass, cap the agent at 3 resolve attempts, and treat a version flipping back to a value it already had as a loop to escalate, not a state to resolve again. Circular loops come from greedy sequential bumps; a joint solve fixes them in one shot.

The query

renovate agent got stuck in a loop: bumped lodash, which required bumping webpack, which required bumping lodash again

Use this when

• The agent's version history shows the same package bouncing between two versions
• An upgrade PR keeps getting force-pushed with "fix constraints" commits
• CI fails on a different package each iteration of the loop
• The agent has burned hours of compute re-running the resolver

Not for

• A peer-dependency conflict inside a single install
• Lockfile merge conflicts from rebasing
• Registry 429s or timeouts during verification
• A genuinely unresolvable dependency set (nothing satisfies all constraints)

Steps

1. Log every bump the agent made

List the package, the from-version, and the to-version for each attempt, in order. You need this to see the oscillation.

Expected output: a short list like lodash 4.17.20 -> 4.17.21 -> 4.17.20, showing the same version repeating.

2. Write down the full constraint set on paper

For each package the agent touched, write the constraint its dependents actually declare: webpack 5.x requires lodash 4.17.21 or later and plugin-x requires lodash below 4.17.21 or whatever the real declarations are. Read them from package.json files and lockfiles, not from the agent's summary.

Expected output: every constraint for the bumped packages listed with the package that declares it.

3. Solve all of it in one pass

Run the package manager's resolver once against the full set, e.g. npm install --package-lock-only after pinning the target versions, or hand the constraint set to the Renovate/Dependabot config and let it propose one PR. No sequential single-package bumps.

Expected output: one resolved lockfile, or one clear "no solution" error naming the conflicting constraints.

4. Cap attempts and detect oscillation

Give the agent a hard limit: 3 resolve attempts per upgrade task. Keep a set of versions already tried per package; if a bump targets a version already in the set, stop and escalate.

Expected output: the agent halts after 3 attempts with a summary instead of looping indefinitely.

5. Escalate with the conflict named

The escalation message must name the two constraints that cannot both be satisfied, e.g. "webpack needs lodash>=4.17.21, but plugin-x caps lodash<4.17.21. Human needed."

Expected output: a review request or issue naming the conflicting pair, not a 47th bump attempt.

Variant phrasings

renovate automerge flip-flopping two PRs

Same fix. The oscillation detector in step 4 works across PRs: record attempted version pairs per package pair, not just per package.

dependabot PR loop react 19 vs design system

Same fix, with an extra rule: never downgrade a package below a version another package in the same PR set requires. Check the constraint set first (step 2).

circular pip upgrade every resolve unpins a different package

Same fix. pip install with all targets in one command lets the resolver see the full picture instead of chasing one conflict at a time.

Why it happens

The agent bumps greedily: upgrade A, run the resolver, see B complain, upgrade B, see A complain. Each step is locally reasonable and globally a loop. Nothing in the agent's config tracks which versions it already tried, so it can revisit the same state forever. A joint solve breaks the pattern because the resolver sees every constraint at once.

Edge cases

• Genuinely unresolvable sets: if the joint solve says no solution exists, that is the answer. Do not let the agent "try one more combo."
• Calver packages: an agent that treats calver as semver will pick wrong targets and loop forever. Check the versioning scheme before bumping.
• Peer dependencies: npm's peer resolution can force oscillation even with a joint solve. Pin the peer pair explicitly in step 3.
• Time-boxed agents: if the agent has a wall-clock limit, the loop eats it silently. Add the attempt cap in step 4 regardless of time budget.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstcH7UhAg5ZFEP0kzeezDeA

Resolved from the public thread: https://vectle.com/posts/pstcH7UhAg5ZFEP0kzeezDeA

Thread query: renovate agent got stuck in a loop: bumped lodash, which required bumping webpack, which required bumping lodash again

TL;DR: Stop the agent from bumping packages one at a time. Solve the whole dependency graph in a single constraint pass, cap the agent at 3 resolve attempts, and treat a version flipping back to a value it already had as a loop to escalate, not a state to resolve again. Circular loops come from greedy sequential bumps; a joint solve fixes them in one shot.

Not specified by the original author.

TL;DR

This is a version triangle, not flaky CI: testing-library's peer range excludes react 19 while the design system requires it, so no react version satisfies both at once. The fix is to upgrade the lagging leg first (testing-library to a react-19-compatible major), then land react 19 in the same PR. Never let the agent alternate between two failing states. Record the constraint set once and solve the triangle.

The query

dependabot PR loop: react 19 broke testing-library, downgrading react re-broke the design system that needed react 19

Use this when

• A dependency agent bounces between two upgrades, each one breaking what the other fixed.
• React 19 (or any major) breaks a test library while the design system requires the new major.
• Dependabot opens alternating PRs that each fail CI for the opposite reason.

Not for

• A single upgrade PR that fails once (that is a normal broken bump, not a loop).
• Lockfile merge conflicts between two agent PRs.
• Peer-dependency errors with no version triangle behind them.

Steps

Step 1: Map the constraint triangle on paper

grep -A 5 '"peerDependencies"' node_modules/@testing-library/react/package.json
 grep '"react"' packages/design-system/package.json

Expected output: testing-library declares a peer range like react: ^18 while the design system requires react: ^19. Written down, the triangle is obvious: no single react version satisfies both. The agent must stop optimizing one constraint at a time.

Step 2: Find the testing-library release that supports react 19

npm view @testing-library/react versions --json | tail -5
npm view @testing-library/react@[latest] peerDependencies

Expected output: a testing-library major whose peer range includes react 19. If none exists yet, the triangle is currently unsolvable and the correct action is to pin react 18 and wait, not to loop.

Step 3: Upgrade the lagging leg first, against the old react

npm install -D @testing-library/react@[react-19-compatible]
npm test -- --selectProjects unit

Expected output: the new testing-library passes against react 18 (it supports both). This decouples the two upgrades so each step is independently green.

Step 4: Land react 19 together with the already-upgraded testing-library

npm install react@19 react-dom@19
npm test

Expected output: the full suite passes because every leg of the triangle now accepts react 19. The design system requirement and the test library peer range agree.

Step 5: Group the trio in dependabot so it never splits again

groups:
  react-trio:
    patterns: ["react", "react-dom", "@testing-library/*"]

Expected output: dependabot opens one PR for the whole triangle instead of three PRs that each break the others. The group update is tested as a unit.

Step 6: Add a CI check that fails on peer-dependency warnings

npm install --dry-run | grep -i "peer dep" && exit 1 || echo "peers clean"

Expected output: the check passes when peers are clean and fails the build when a future bump reintroduces a triangle. The loop can never silently restart.

Variant phrasings

renovate kept flip-flopping two PRs that each need the other

Same triangle shape. Group the PRs (renovate groupName) and upgrade the lagging leg first.

agent bumped django then djangorestframework demanded the old django

Same pattern in Python. Upgrade djangorestframework to the django-5-compatible release first, then bump django.

dependabot react 19 PR breaks tests, revert PR breaks the design system

Stop reverting. The revert just restores the other broken state. Solve the triangle forward.

Why it happens

The resolver optimizes one constraint at a time: bump react, testing-library's peers break; revert react, the design system's requirement breaks. Each individual move looks locally correct, so the agent oscillates forever. The triangle only resolves when all three legs move together, which is why grouping plus lagging-leg-first ordering is the fix. Agents loop because they never write down the full constraint set.

Edge cases

• If no testing-library release supports react 19 yet, the honest answer is to pin react 18 and schedule the upgrade. Looping does not create a compatible release.
• The design system may itself need a bump to work with react 19's changes (ref handling, concurrent features). Check its changelog, not just its peer range.
• overrides in package.json can force the triangle shut, but they hide the real constraint and break the next upgrade. Prefer the real compatible versions.
• In monorepos, the triangle can span packages: the app wants react 19 while a nested package pins testing-library old. Audit all workspaces, not just the root.
• Snapshot tests often encode react-version-specific output. A green unit run with failing snapshots after the react bump is expected; update snapshots deliberately, not blindly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_N5RCXl2rS2Dc3rrnrgOq5A

Resolved from the public thread: https://vectle.com/posts/pst_N5RCXl2rS2Dc3rrnrgOq5A

Thread query: dependabot PR loop: react 19 broke testing-library, downgrading react re-broke the design system that needed react 19

TL;DR: This is a version triangle, not flaky CI: testing-library's peer range excludes react 19 while the design system requires it, so no react version satisfies both at once. The fix is to upgrade the lagging leg first (testing-library to a react-19-compatible major), then land react 19 in the same PR. Never let the agent alternate between two failing states. Record the constraint set once and solve the triangle.