# Update from Hell: Can Coding Agents Survive Hidden Breakage in Dependency Upgrades?

arXiv: https://arxiv.org/abs/2608.30300 · HTML: https://mlsanity.com/paper/2608.30300/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 18 of its 25 references that are in the map.
- First posted on arXiv 31 Aug 2026.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 18 of 18)

- [SWE-bench: Can Language Models Resolve Real-World GitHub Issues?](https://mlsanity.com/paper/2310.06770/) (2023)
- [GitTaskBench: A Benchmark for Code Agents Solving Real-World Tasks Through Code Repository Leveraging](https://mlsanity.com/paper/2508.18993/) (2025)
- [Do Developers Update Their Library Dependencies? An Empirical Study on the Impact of Security Advisories on Library Migration](https://mlsanity.com/paper/1709.04621/) (2017)
- [BeyondSWE: Can Current Code Agent Survive Beyond Single-Repo Bug Fixing?](https://mlsanity.com/paper/2603.03194/) (2026)
- [Automating Dependency Updates in Practice: An Exploratory Study on GitHub Dependabot](https://mlsanity.com/paper/2206.07230/) (2022)
- [MigrationBench: Repository-Level Code Migration Benchmark from Java 8](https://mlsanity.com/paper/2505.09569/) (2025)
- [DI-BENCH: Benchmarking Large Language Models on Dependency Inference with Testable Repositories at Scale](https://mlsanity.com/paper/2501.13699/) (2025)
- [SWE-Chain: Benchmarking Coding Agents on Chained Release-Level Package Upgrades](https://mlsanity.com/paper/2605.14415/) (2026)
- [On the evolution of technical lag in the npm package dependency network](https://mlsanity.com/paper/1806.01545/) (2018)
- [BUMP: A Benchmark of Reproducible Breaking Dependency Updates](https://mlsanity.com/paper/2401.09906/) (2024)
- [FreshBrew: A Benchmark for Evaluating AI Agents on Java Code Migration](https://mlsanity.com/paper/2510.04852/) (2025)
- [Breaking Bad? Semantic Versioning and Impact of Breaking Changes in Maven Central](https://mlsanity.com/paper/2110.07889/) (2021)
- [On the Impact of Security Vulnerabilities in the npm and RubyGems Dependency Networks](https://mlsanity.com/paper/2106.06747/) (2021)
- [Breaking-Good: Explaining Breaking Dependency Updates with Build Analysis](https://mlsanity.com/paper/2407.03880/) (2024)
- [Byam: Fixing Breaking Dependency Updates with Large Language Models](https://mlsanity.com/paper/2505.07522/) (2025)
- [CI-Repair-Bench: A Repository-Aware Benchmark for Automated Patch Validation via CI Workflows](https://mlsanity.com/paper/2604.27148/) (2026)
- [LLM Agents for Automated Dependency Upgrades](https://mlsanity.com/paper/2510.03480/) (2025)
- [Breaking Changes in Software Ecosystems: A Systematic Literature Review](https://mlsanity.com/paper/2605.24397/) (2026)

## Abstract (arXiv)

Modern software systems rely heavily on third-party dependencies, but upgrading those dependencies remains a costly maintenance activity. Dependency upgrades do not always preserve the function signatures, type systems, APIs, or runtime semantics assumed by existing code. Consequently, developers often need to perform source code adaptations to accommodate dependency-induced changes. However, such code-level changes are often not explicitly communicated to project maintainers, posing a significant challenge to software reliability. Meanwhile, coding agents have emerged as a new form of software development tool and are increasingly adopted by developers due to their automation capabilities. In this paper, we introduce DEPBENCH, a benchmark consisting of 203 real-world dependency-upgrade tasks across five package ecosystems spanning five language communities, each involving hidden code-level changes that require source code adaptation. We evaluate mainstream coding agents on DEPBENCH. The best completed configuration solves only 104/203 tasks (51.2%), with substantial variation across agent harnesses, models, and ecosystems, highlighting an important gap between current agent capabilities and real-world software maintenance needs.