v0.18.2

Patch Changes

• #267 907dffb Thanks @lucasbraum! - The agent can no longer change dependencies outside the upgrade. An agent edit that changes or removes an existing dependency in any package.json, or touches overrides, resolutions or the pnpm field, is refused and reverted. Uptide sends the refusal back to the agent in the next feedback round, naming the package, and records it in report.json (outOfScopeDependencyEdits). That includes the upgraded package and its planned companions, whose versions the engine wrote: only a rewrite to the same value is allowed. The agent may still add a new dependency: it is kept, recorded (agentAddedDependencies) and listed under "Added by the agent" in the PR body. Lockfiles, .npmrc, .yarnrc(.yml), .pnpmfile.cjs, pnpm-workspace.yaml and new package.json files are read-only for the agent.

• #267 907dffb Thanks @lucasbraum! - A companion that would move a new major is planned only when the upgraded package asks for it: its own manifest at the target pins the companion, the companion's manifest declares the upgraded package, or the upgraded package's pack names it. When a third package asks for it (@guardian/libs 33 pinning @guardian/ophan-tracker-js 3.1.0 during a typescript upgrade), Uptide no longer moves it. The PR lists it under "Blocked" with the declaring package, the manifest field and the range. Release pairs still move with their lead: react-dom with react, @ai-sdk/* with ai, @sentry/profiling-node with @sentry/node.

• #267 907dffb Thanks @lucasbraum! - A package that does not move no longer drags another one through its pins: fix typescript on guardian/support-dotcom-components moved @guardian/ophan-tracker-js 2.8.3 → 3.1.0 because @guardian/libs 33.0.0, which stayed, pins it. A pin the same manifest also declares as a peer the install satisfies moves nothing either, and a pin reason now names the manifest field and the installed version.

• #266 a5e3f57 Thanks @lucasbraum! - uptide fix no longer upgrades a peer blocker across a major that no migration pack covers. Before, redis 5 → 6 next to typeorm 0.3 (which peers on redis ^5) moved typeorm to 1.1.0 and ended in an agent-led draft. Now the blocker keeps its version, with a peer override scoped to it in package.json: npm overrides.<blocker>.<peer>, pnpm pnpm.peerDependencyRules.allowedVersions, Yarn resolutions["<blocker>/<peer>"]. The lockfile scope check still covers the install. The PR body names the override, which release was not taken and why. In report.json, each peerConflicts entry now has strategy (override, blocked or none), declined and override. If verification fails with the override, the blocker is reported as a blocker and is still not upgraded. A blocker you name on the command line, or one whose major a pack covers, is upgraded as before.

• #264 2089d0a Thanks @lucasbraum! - uptide fix no longer stops when the package manager resolves a different version than the target. Yarn classic ignored the pin for a direct dependency and resolved a range such as ^7.0.105 to its newest match (7.0.146). Now the lockfile resolves exactly the target with npm, pnpm, Yarn classic and Yarn Berry, and the manifest keeps its range. If the package manager still resolves another version, the run continues only when that version is in the same major, inside the manifest range and covered by the pack. The PR body, the terminal summary and report.json (resolvedVersion, lockfile.resolved) then name both versions. Otherwise the run stops with an error that names the target, the resolved version and the reason.

• #268 4cee03a Thanks @lucasbraum! - fix computes the agent's cost itself, per model and token class, from Uptide's price table: report.json and --json list each model's uncached input, cache read, 5-minute and 1-hour cache write and output tokens, the rate applied to each and the cost, so the total can be redone by hand. The Agent SDK's own figure is kept apart as sdkReportedCostUsd; --max-cost counts the higher of the two, a gap above 5% is printed as a warning, and a model missing from the table uses the SDK's figure, marked unverified. llm.inputTokens now counts uncached input only.

• #268 4cee03a Thanks @lucasbraum! - Sonnet 5.5 cache reads are priced at the published $0.10 per million tokens (0.05x input), not $0.20. Every Anthropic rate in the price table was checked against Anthropic's pricing page on 2026-10-20, and a test now pins each one.