agent treated 0.x minor bumps as safe; the package dropped python 3.9 support in 0.14.0 and CI died

TL;DR: Treat every 0.x minor bump as a major: under semver, anything may change before 1.0, including dropping runtime support. Require release-notes review and a full CI pass before merging any 0.x bump, and check the package's supported-runtimes metadata against your own. The "minor" label on a 0.x version promises nothing.

agent treated 0.x minor bumps as safe; the package dropped python 3.9 support in 0.14.0 and CI died

1. Confirm what broke: read the CI failure and check the package's changelog or metadata for the dropped support (python_requires, engines field, or supported-versions doc). Expected: the 0.14.0 release notes or metadata show python 3.9 removed.

2. Decide: either pin the package below 0.14.0 until you can move off python 3.9, or upgrade your runtime and take the bump. Expected: a deliberate choice, not a surprise; CI green on the chosen path.

3. Change the agent's automerge rule: never automerge 0.x bumps; require notes review and a passing CI run first. Expected: future 0.x bumps wait for a human or at minimum a full CI pass.

4. Add a runtime-support check to the agent's pre-merge verification: compare the package's declared supported runtimes against the runtimes you actually run. Expected: dropped-support bumps get flagged before merge, not after CI dies.

5. Verify on the next 0.x bump: the agent posts the notes, runs CI, and does not merge on its own. Expected: no more silent 0.x merges.

Use this when

• a 0.x minor bump broke CI or dropped platform support
• the agent automerges 0.x bumps as if they were safe
• the package is pre-1.0 and moves fast
• you run older runtimes the package may stop supporting

Not for this skill when

• the package is post-1.0 semver and broke the contract (report upstream)
• the break was a real bug in the new version, not a support drop (pin and report)
• you have already migrated off the dropped runtime (then just take the bump)

Variant phrasings

• "0.x minor bump dropped python support"
• "pre-1.0 minor treated as safe broke CI"
• "how to handle 0.x dependency upgrades"
• "package dropped node version in 0.x minor"
• "semver 0.x anything may change"

Why it happens

Semver is explicit: major version zero is for initial development, and anything may change at any time. But agents pattern-match "minor bump = safe" from the far more common post-1.0 case and never special-case the leading zero. Dropping a runtime is exactly the kind of change a maturing 0.x package makes in a minor, and it kills CI on every project still on the old runtime.

Edge cases

• Some 0.x packages are de facto stable (years of 0.x with a strict changelog); you can allowlist those individually, but keep the default strict.
• The python_requires or engines field usually declares the drop before CI discovers it; read metadata first, it is cheaper than a red build.
• A 0.x package can also ADD a required runtime (needs python 3.11+ for a new feature); the support check must catch new minimums, not just drops.
• If you must stay on the old runtime, pin the 0.x package and set a calendar reminder to revisit; pins rot silently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ujZhsbI6AtmvxuK2iT1nWg