Overreach

Bumped a dependency or config "along the way"

“顺手”升级了依赖或改了配置

To get past an unrelated warning or error, the agent upgrades a package, edits the lockfile, or changes a config default.

Applies to: Claude Code · Cursor · Codex · Copilot agent

Symptom

`package.json`, the lockfile, `tsconfig.json`, `.eslintrc` or CI config appear in a diff that was about feature code. Strictness quietly drops.

Why it happens

Config is the shortest path to green. developertoolkit.ai's scope-creep class names "a dependency bumped along the way, a config default changed to make a test pass" and says the earliest reliable catch is mechanical, CI comparing changed paths to the declared scope. The dev.to post's agent also "updates a config file because the linter complained about something unrelated".

Example

Illustrative.

diff

+ src/cart/total.ts           (the requested fix)
+ tsconfig.json               - "strict": true,  + "strict": false,
+ package.json                - "zod": "^3.23.8" + "zod": "^4.0.0"

Copy-paste fixes

Pick the files for the agents you use. Snippets are in English so they work in any repo.

Rules

Claude Code: add to CLAUDE.md

CLAUDE.md

## Don't touch dependencies or config unless asked
- Do not add, remove or upgrade dependencies, or edit lockfiles, for a task that is not about dependencies.
- Do not change tsconfig, linter, formatter, build, CI or env config to make an error go away.
  Fix the code, or stop and explain.
- If a config change is really required, make it a separate step and explain the trade-off.

Rules

Codex, Copilot coding agent and others: add to AGENTS.md

AGENTS.md

## Don't touch dependencies or config unless asked
- Do not add, remove or upgrade dependencies, or edit lockfiles, for a task that is not about dependencies.
- Do not change tsconfig, linter, formatter, build, CI or env config to make an error go away.
  Fix the code, or stop and explain.
- If a config change is really required, make it a separate step and explain the trade-off.

Cursor rule

Cursor: project rule

.cursor/rules/dependency-or-config-bump.mdc

---
description: "AgentFails: Bumped a dependency or config 'along the way'"
alwaysApply: true
---

## Don't touch dependencies or config unless asked
- Do not add, remove or upgrade dependencies, or edit lockfiles, for a task that is not about dependencies.
- Do not change tsconfig, linter, formatter, build, CI or env config to make an error go away.
  Fix the code, or stop and explain.
- If a config change is really required, make it a separate step and explain the trade-off.

Settings

Claude Code permissions: hard-deny sensitive paths, ask before installs

Rules in CLAUDE.md are context; permission rules are enforced by the tool. Adjust the paths to your repo.

.claude/settings.json

{
  "permissions": {
    "deny": [
      "Edit(./migrations/**)",
      "Edit(./.env*)",
      "Edit(./package-lock.json)",
      "Edit(./pnpm-lock.yaml)",
      "Edit(./src/generated/**)"
    ],
    "ask": [
      "Bash(npm install:*)",
      "Bash(pnpm add:*)",
      "Bash(yarn add:*)",
      "Bash(pip install:*)",
      "Bash(git push:*)"
    ]
  }
}

CI / script

CI guard: flag config/dependency edits in feature PRs

.github/workflows/config-guard.yml

name: config-guard
on: pull_request
jobs:
  guard:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'deps-or-config') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: |
          changed=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD")
          hits=$(echo "$changed" | grep -E '(^|/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|tsconfig.*\.json|\.eslintrc.*|eslint\.config\..*|\.github/workflows/.*)$' || true)
          if [ -n "$hits" ]; then
            echo "Config/dependency files changed without the 'deps-or-config' label:"; echo "$hits"; exit 1
          fi

Sources and credit

Improve this pattern on GitHub Hit this and the fix didn't work? Tell us