AI Coding Agents and Their Response to Semantic Versioning
Semantic versioning (SemVer) provides developers with a framework to assess the risk associated with software upgrades. A patch indicates bug fixes, a minor release adds features without breaking changes, and a major release signifies potential breaking changes. Initial assumptions suggested that AI agents would disregard version numbers, making SemVer unnecessary.
However, two AI models demonstrated that version numbers influence their behavior. In experiments involving nearly 1,000 runs, the version label alone affected how agents interacted with identical code. Claude Sonnet 5.5 executed tests or read the new code in only 2 out of 10 instances when the upgrade was labeled as a patch, but in all 10 instances when labeled as a major release. Other models consistently checked every upgrade, indicating that some agents still consider SemVer.
Understanding the Influence of Version Numbers
Semantic versioning reflects the maintainer’s intentions for a release. While agents can verify compatibility by analyzing the code and running tests, they may also learn from repositories and documentation where SemVer is prevalent. Consequently, they might adopt similar behaviors to developers, treating major releases with caution and viewing patches as safer options.
To investigate the impact of version labels on agent behavior, experiments were conducted using Microsoft’s evaluation tool for AI agents, Vally, with GitHub Copilot CLI as the agent. A small Node.js application was created, dependent on a fictional npm library called fluxkit. The new version of fluxkit included a breaking change, renaming a function that the application calls.
The agents received minimal instructions for two scenarios:
# patch
Bump fluxkit to 1.4.3.
# major
Bump fluxkit to 2.0.0.
Both scenarios involved byte-identical library code, with only the version number differing. If the agents ignored the labels, their behavior would remain consistent. Conversely, if they perceived a major release as riskier, they would check the upgrade more frequently.
| Model | Checked: patch | Checked: major | Verdict |
|---|---|---|---|
| Claude Sonnet 5.5 | 2/10 | 10/10 | Effect |
| Claude Opus 5.5 | 70/70 | 70/70 | No meaningful effect |
| GPT-6.1 Sol | 70/70 | 70/70 | No meaningful effect |
| GPT-6.1 Terra | 70/70 | 70/70 | No meaningful effect |
Claude Sonnet 5.5 exhibited a notable response to version labels, often changing the dependency version when instructed for a patch, leaving the application broken. In contrast, when asked for a major release, it checked every time. The other three models consistently checked every upgrade, regardless of the label.
Reviewing Dependency Updates
Agents must determine whether an update is safe to merge, especially when reviewing branches without release notes. Six scenarios were created, three with breaking changes and three without, each assigned a patch, minor, or major label, with identical code across all scenarios. Six models underwent 30 runs per label, totaling 540 runs.
| Model | Unchecked merges: patch | Unchecked merges: major | Verdict |
|---|---|---|---|
| Claude Haiku 5.5 | 11/30 (37%) | 2/30 (7%) | Effect |
| Claude Sonnet 5.5 | 4/30 (13%) | 0/30 | Inconclusive, leaning toward an effect |
| GPT-6 Luna | 9/30 (30%) | 5/30 (17%) | Inconclusive |
| Claude Opus 5.5 | 0/30 | 0/30 | No meaningful effect |
| GPT-6.1 Sol | 0/30 | 0/30 | No meaningful effect |
| GPT-6.1 Terra | 0/30 | 0/30 | No meaningful effect |
The results mirrored the first experiment, with Claude Haiku 5.5 merging patch-labeled updates without checks in 37% of runs, compared to only 7% for major-labeled updates. The remaining models checked every update, irrespective of the label.
Consequences of Skipping Checks
Agents that bypass checks can succeed as long as the updates function correctly. Generally, agents assessed the code effectively, merging non-breaking updates in 268 out of 270 runs, while breaking updates were merged in 13 out of 270. Four of these merges resulted in a broken main branch, attributed to Claude Haiku 5.5 and GPT-6 Luna.
Limitations of the Study
The experiments intentionally broke SemVer by introducing a breaking change under a patch label. The observed differences for Claude Sonnet 5.5 and GPT-6 Luna may be valid, but with only 30 runs per label, the results are too uncertain to draw definitive conclusions.
Recommendations for Versioning
For library maintainers, it is advisable to continue using SemVer and ensure its accuracy. Agents recognize SemVer, and some respond to it. Implement verification processes within the workflow to ensure that a patch receives the same level of checks as a major release.
Final Thoughts on AI Coding Agents and SemVer
Some AI coding agents do consider semantic versioning. While Claude Opus 5.5, GPT-6.1 Sol, and GPT-6.1 Terra ignored the labels, others utilized them to determine their level of scrutiny. A version number alone cannot guarantee an upgrade’s safety for either agents or developers. Only thorough testing can determine whether an upgrade is indeed safe.
Related link: aka.ms
Source: Microsoft Developer Blogs