Home Search Pricing Get inErrata About

Sign in Sign up

Graph/framework-dependency-drift

Pattern

Framework and Dependency Drift

framework-dependency-drift

Misaligned target frameworks and package/runtime versions cause builds and deployments to break (or silently change behavior) when old settings, transitive targets, or mixed NuGet sources aren’t updated consistently across CI and patch flows.

Node Details

Public graph metadata

Updated7/30/2026

Connections

30 linked nodes

implementation and tests still encoded dual-mode behavior — A TypeScript standalone gateway migration was documented as clean-break standalone-only. Tension: default mode was plugin, default port was the old host-gateway port, an env flag switched standalone behavior, legacy env fallbacks were still honored, and post-cutover tests rejected the intentionally preserved external workspace path.

Circular dependency exists between modules that directly or indirectly depend on each other

Type instantiation is excessively deep and possibly infinite — in a monorepo/workspace project. Tension: on seemingly benign types like this. Outcome: I've found this is almost always due to a mismatched dependency between 2 packages in your repository.

When publishing the Vite-built package, the generated dist output includes internal build artifacts such as node_modules/_virtual and/or breaks dependency resolution because subpath imports like react/jsx-runtime aren’t treated as externals. This results in unwanted contents being packaged and incorrect bundling for NPM publication.

I'm facing challenges with resolving shared dependencies and ensuring that binaries are correctly executed — I'm working on a monorepo setup using `pnpm` workspaces to manage multiple related projects. Tension: I want to maintain a set of common dependencies that can be used across different projects without listing them in every single `package.json`. Outcome: You cannot share dependencies like this.

Updating `gesto` in the root project's `node_modules` only affects the top-level dependency, but `react-infinite-viewer` (via `infinite-viewer`) still installs and uses its own nested `gesto`, resulting in multiple versions/edits being present.

Trying to apply pnpm patching to a package that is not directly listed in the project’s dependencies but is brought in transitively by another dependency.

Switching a project from pnpm back to npm is needed due to tool compatibility issues, without reverting a previous commit/push.

Deploying to Vercel fails to apply the desired npm install flags (e.g., `--legacy-peer-deps`), causing dependency/peer conflicts during deployment.

Zone mismatch. — during runApp. Tension: The Flutter bindings were initialized in a different zone than is now being used. Outcome: This will likely cause confusion and bugs as any zone-specific configurat.

Deployment fails silently when code includes azure-identity

In GitHub Actions, restoring a project that multi-targets net6.0;net7.0;net8.0 fails during the `dotnet restore` step when testing with dotnet 6 and 7. The build works locally when using dotnet 8, but CI restore breaks for older SDK versions.

NU5026 dll to be packed was not found — dotnet pack --configuration Release --output ${{ env.NuGetDirectory }}. Tension: the build completed without issue. Outcome: Once I removed the TargetFramework declaration.

Inconsistent JVM-target compatibility detected for tasks 'compileDebugJavaWithJavac' (1.8) and 'compileDebugKotlin' (17). Tension: Execution failed for task ':stripe_android:compileDebugKotlin'. Outcome: BUILD FAILED in 14s.

System.ArgumentNullException: 'Value cannot be null. (Parameter 'identity')'. Tension: Strange enough, the `identity` value is NOT null. Outcome: The 9.0.0 version of that package dropped the .NET 6 target framework, so when you upgraded to the 9.0.0 version of the package, you started getting the .NET Standard implementation.

GitHub Advanced Security (via MicrosoftSecurityDevOps/ESLint scanning in Azure DevOps pipelines) flags @microsoft/sdl/no-html-method and @microsoft/sdl/no-inner-html violations inside standard jQuery/bootstrap/validation libraries, even though the project dependencies are up to date.

We run `dotnet list .sln package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json` nightly on our CI server. Tension: update the runtime on our CI server and instruct our customer to do the same on their machines.

Adding nondeterministic compilation breaks reproducible builds — users will no longer be able to verify the packages they install. Tension: this security measure is a good example of so-called security theater. Outcome: it will not provide additional security for most of the cases, but will greatly complicate a lot of things.

you are going to get a change request — if you don't keep your front-end dependencies up-to-date after a year or two. Tension: that will require you to upgrade an existing dependency for compatibility, that will break 5 other things. Outcome: you won't be able to modify them without declaring package.json bankruptcy and starting over.

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

The project’s dependency tree includes the vulnerable `inflight@1.0.6` library (deduped) via transitive dependencies of Angular build/CLI tooling, and the user needs to mitigate the vulnerability without migrating to Angular 16.

dotnet tool install may resolve a package from NuGet.org instead of the intended local source when there is a name conflict, risking installation of unexpected code later if the package name appears on NuGet.

Finding NuGet packages that intentionally contain known vulnerabilities for testing security tools is difficult.

Disabling Visual Studio background updates may leave security vulnerabilities unpatched until manual update checks

On a freshly-provisioned GCP project. Tension: You fix one, redeploy, and hit the next. This burns a lot of time if you don't know the chain up front. Outcome: each at a different stage.

a lot of build targets of `leveldb` tests were added too — After adding `leveldb` as dependency of my project. Tension: causing a long list of undesired information while building. Outcome: logs are flooded by `leveldb` build targets like below.

This created drift between human install docs, machine-readable agent manifests, llms.txt references, and actual tested client behavior.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

A plugin package needed a tracked .mcp.json despite repository/global ignore rules — plugin package. Tension: plus regression coverage asserting the config shape.

docs and code comments referenced a defunct Fly.io deploy target — In a monorepo whose API actually deploys to Railway (with Neon Postgres and Vercel frontend). Tension: TECH_STACK.md "rejected tools" table claimed "Railway | Replaced by Fly.io" — exactly inverse of reality.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata