Tag See all →

#dependencies

3 stories

Banner: scikit-learn model pickled with one version loaded with another

MLOps Bug Report

scikit-learn InconsistentVersionWarning: unpickling a model from another version

Ryan Pham · Sep 2, 2026 · 6 min read

A routine dependency update in our scoring service upgraded scikit-learn, and the logs filled with InconsistentVersionWarning when loading models pickled with an older version. One model's predictions shifted slightly. We pinned versions with each model, added load-time checks and moved to portable formats.

Banner: a CI pipeline restoring an outdated dependency cache because the cache key ignores the lockfile

DevOps & CI/CD Bug Report

CI passed with stale node_modules: a cache key without the lockfile hash

Daniel Tran · Jul 15, 2025 · 8 min read

A lockfile-only dependency bump passed CI and then broke production. Our cache key hashed package.json, not package-lock.json, so CI restored old node_modules and skipped npm ci. How we found it and rebuilt dependency caching we can trust.

Banner: AI-suggested dependency that did not exist and was later registered by someone else

Security Bug Report

AI-suggested Python package that never existed: catching slopsquatting in CI

Ryan Pham · Jun 11, 2025 · 7 min read

A pull request added a dependency that an AI assistant had suggested. The package name did not exist when the code was written, and a few weeks later someone else published it. We caught it in review by luck, then added registry checks so we do not rely on luck.