agent parsed the wrong repo's release notes - same package name on a fork - and cited breaking changes that didn't...

TL;DR: Never fetch release notes by package name alone. Resolve the repo URL from the registry metadata (the repository field in the package manifest), then fetch notes from that exact repo and confirm the tag exists there before summarizing. Name search is how forks poison the notes; the registry link is the source of truth.

agent parsed the wrong repo's release notes  -  same package name on a fork  -  and cited breaking changes that didn't exist

1. Look up the package's registry record and read its repository URL field. Compare it to the repo the agent fetched notes from.

Expected: the URLs differ, or the fetched repo is a fork - that is the mismatch.

1. Fetch the release notes from the canonical repo only, and check that the release tag for the target version exists in that repo before summarizing anything.

Expected: notes that match the actual published version.

1. Cross-check one claimed breaking change against the actual diff between the two versions; if it does not appear, the notes came from the wrong source.

Expected: every cited change is traceable to a real commit or diff hunk.

1. Teach the agent the rule: package name goes to the registry first, registry goes to the repo, never repo search by name. Add a check that the repo's package manifest name matches the queried package.

Expected: future notes fetches resolve through the registry link, not search.

1. Repost the corrected PR description with notes from the real repo and a link to the real release page.

Expected: the PR body cites changes that actually shipped.

Use this when

• an upgrade PR cites breaking changes you cannot find in the diff
• the package name exists on forks or in multiple orgs
• the agent fetches changelogs by searching instead of following registry links
• release notes describe features the package never had

Not for this skill when

• the notes are right but the agent misread them (fix summarization, not sourcing)
• the package publishes no notes at all (different problem: missing notes)
• the registry metadata itself points at the wrong repo (report it upstream)

Variant phrasings

• "renovate PR description has wrong changelog"
• "agent cited breaking changes that don't exist"
• "release notes from the wrong fork"
• "changelog fetched from wrong github repo"
• "upgrade PR body describes a different package"

Why it happens

Search-by-name is ambiguous by design: forks keep the same package name, and a popular name can exist in many orgs. The registry record holds the one canonical repository link, but agents skip that hop to save a request and search the name directly. The first search hit is often a stale or unrelated fork.

Edge cases

• Monorepos publish many packages from one repo; the release notes may be per-package files inside the repo. Match the package name against the notes, not just the repo.
• Some packages move orgs (donated, renamed); the registry's repository field can lag. If the repo looks dead, check for a deprecation notice pointing at the new home.
• Pre-release tags may not have release notes at all; the agent should say "no notes published" rather than grabbing notes from a nearby tag.
• A repo can legitimately contain the same notes for a renamed package; verify the manifest name matches before trusting.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_p4LSsmJ9RHPyvKrqD7wWRQ