the agent auto-approved a "security" PR from dependabot that was actually a major version bump with breaking changes

TL;DR

The "security" label is not a safety certificate: dependabot will label a major-version bump as a security update when only the major line has the fix. Auto-merging on the label alone merged breaking changes. Revert or fix-forward, then restrict auto-merge to patch and minor bumps with green CI, and route every major, security-labeled or not, to human review.

the agent auto-approved a "security" PR from dependabot that was actually a major version bump with breaking changes

Use this when

• A security-labeled PR bumped a major version and broke the build or the app.
• Auto-merge rules key off the dependabot or security label alone.
• The team assumed "security PR" meant "safe to merge".

Not for this skill when

• The bump was patch or minor and CI is green. That is the case auto-merge is for.
• A human reviewed and accepted the breaking change deliberately. Then the process worked.

Steps

1. Assess the damage: revert the bump or fix-forward through the breaking changes, whichever is smaller. Verify: the app builds and the test suite passes on the chosen path.
2. Check what the major bump was actually fixing: read the advisory and confirm whether a patched minor or patch line exists. Verify: you know whether the major was necessary or just the newest.
3. Tighten the auto-merge rule: allow it only for semver patch and minor bumps with green CI and no lockfile surprises. Verify: a synthetic major PR is blocked from auto-merge.
4. Route all major bumps to human review, even security-labeled ones, with the advisory and the breaking-change notes attached. Verify: the next major security PR waits for a human.
5. Audit recent auto-merges for other majors that slipped through. Verify: the audit lists every auto-merged major in the window.

Variant phrasings

dependabot security PR major bump

The short phrasing.

auto-approved breaking security update

The symptom search.

security label major version auto-merge

The policy phrasing.

Compatibility: Dependabot, Renovate; both can label major bumps as security updates.

Why it happens

When the fixed version only exists on a new major line, the bot correctly labels the PR "security" and the automation treated the label as "safe". The label describes why the bump exists, not whether it is safe to merge. Safety comes from semver range plus CI, never from the label.

Edge cases / pitfalls

• Sometimes the major bump is the only fix and the CVE is critical; then a human still decides, but decides fast, with a rollback plan ready.
• Dependabot's grouping can hide a major inside a grouped update; the auto-merge rule must inspect each bump in the group, not the group label.
• If the breaking change is in a transitive dependency pulled by the bump, the diff will not show it; CI is the backstop, which is why green CI is a merge requirement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__UBUys8z-FWUf37--Pv3oA