{"id":59702,"date":"2026-11-10T13:02:10","date_gmt":"2026-11-10T03:02:10","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/10\/do-ai-coding-agents-respect-semver-in-azure-upgrade-policies\/"},"modified":"2026-11-10T13:03:58","modified_gmt":"2026-11-10T03:03:58","slug":"do-ai-coding-agents-respect-semver-in-azure-upgrade-policies","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/10\/do-ai-coding-agents-respect-semver-in-azure-upgrade-policies\/","title":{"rendered":"Do AI Coding Agents Respect SemVer in Azure Upgrade Policies"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Do AI Coding Agents Respect SemVer in Azure Upgrade Policies we will explain why an AI-generated dependency update can look safe, pass its initial tests and still cause expensive problems in production.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">AI coding agents can inspect a repository, edit application code, update software packages and submit a pull request for review. They can save developers hours, but they do not automatically understand your business risk, compliance obligations or tolerance for downtime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The short answer is that AI coding agents can follow Semantic Versioning, or SemVer, when instructed to do so. However, they do not inherently enforce it, and SemVer itself is not a guarantee that an upgrade will be harmless.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What SemVer actually tells you<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Semantic Versioning is a common way of numbering software releases. A version such as <strong>3.4.2<\/strong> contains three parts:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>3 is the major version.<\/strong> A change here may break compatibility and require application changes.<\/li>\n<li><strong>4 is the minor version.<\/strong> This normally adds features without intentionally breaking existing behaviour.<\/li>\n<li><strong>2 is the patch version.<\/strong> This normally contains compatible bug or security fixes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The important word is <em>normally<\/em>. SemVer describes what a package publisher intends to communicate. It cannot prevent a publisher from misclassifying a release, overlooking a side effect or introducing a problem through another package that their software depends on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your package configuration also affects what happens. In a JavaScript application, for example, these settings produce different upgrade behaviour:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n &amp;quot;dependencies&amp;quot;: {\n &amp;quot;fixed-example&amp;quot;: &amp;quot;3.4.2&amp;quot;,\n &amp;quot;patch-example&amp;quot;: &amp;quot;~3.4.2&amp;quot;,\n &amp;quot;minor-example&amp;quot;: &amp;quot;^3.4.2&amp;quot;\n }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The fixed version stays on one release. The tilde usually permits patch updates, while the caret usually permits minor and patch updates within the same major version. NuGet for .NET and Python packaging tools have their own version-range rules, so one policy cannot simply assume every software ecosystem behaves identically.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why an AI agent may cross the line<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An AI coding agent is working towards the goal it was given. If the instruction says \u201cupdate all dependencies to the latest versions\u201d, the agent may reasonably conclude that major-version upgrades are allowed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It might also change a version range, replace a package, regenerate a lock file or rewrite application code so the new dependency compiles. That can be useful, but it is more than routine maintenance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The agent may respect the visible SemVer numbers while missing the operational impact. An authentication library, database driver or payment component can pass unit tests but behave differently under production load, with real customer data or when connecting to another system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is why the principles in our guide to using AI coding agents without losing code quality also apply to dependency management. The agent should propose and test changes, but your controls should decide what reaches production.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The business risks hidden inside a simple upgrade<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Unexpected downtime<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A package update can change how an application starts, stores data or communicates with Azure services. If the problem is discovered after deployment, the cost includes lost staff time, interrupted customer service and an emergency rollback.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security fixes that move too slowly<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Being overly cautious creates a different problem. If every small security patch waits for a quarterly project, known vulnerabilities can remain exposed for weeks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This matters in Australia because patching applications is part of the Essential Eight, the Australian Government\u2019s cybersecurity framework that many organisations use for risk and compliance planning. A good upgrade policy must support fast action when a vulnerability is critical while still preserving evidence, testing and approval.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Unclear accountability<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When an agent changes 30 packages in one pull request, reviewers may approve it because the build is green rather than because they understand the risk. A passing build is useful evidence, but it is not proof that every business workflow still works.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Loss of a repeatable build<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Lock files record the exact package versions used to build an application. If an agent deletes, ignores or incorrectly regenerates them, the software tested today may not contain the same components when rebuilt next month.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That makes incident investigation, audit reporting and rollback much harder.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical Azure dependency and upgrade policy<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An Azure upgrade policy is not a single Microsoft setting. It is a set of rules covering your repositories, Azure DevOps pipelines, testing environments, approvals and production releases.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Classify dependencies by business impact.<\/strong> Treat user-interface libraries differently from identity, security, database, payment and infrastructure components. High-impact dependencies should receive deeper review.<\/li>\n<li><strong>Use approved version ranges and lock files.<\/strong> Decide when exact, patch-only or minor-version movement is permitted. Commit lock files so builds remain repeatable.<\/li>\n<li><strong>Separate upgrades by risk.<\/strong> Security patches, routine minor updates and major upgrades should not be bundled into one large change. Smaller pull requests are easier to test, review and reverse.<\/li>\n<li><strong>Require the agent to explain its work.<\/strong> Every pull request should list changed packages, major-version movements, known breaking changes, tests performed and the proposed rollback method.<\/li>\n<li><strong>Enforce controls in Azure DevOps.<\/strong> Protect the main branch with mandatory pull requests, independent reviewers and build validation. Do not rely on a prompt asking the agent to behave safely.<\/li>\n<li><strong>Release gradually.<\/strong> Deploy to a test environment first, then a limited production group where possible. Monitor errors, performance and important business transactions before completing the rollout.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">A simplified Azure DevOps pipeline might contain gates such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>steps:\n- script: npm ci\n displayName: Install locked dependencies\n- script: npm test\n displayName: Run automated tests\n- script: npm audit\n displayName: Check dependency vulnerabilities\n- script: npm run build\n displayName: Confirm production build<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact commands will vary, but the business principle is consistent: the same dependency versions must be restored, scanned, tested and built before a change can be approved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For critical repositories, dependency scanning can also identify known problems in both direct packages and transitive dependencies, which are the packages used indirectly by other packages. Maintaining a software bill of materials, or an inventory of the components inside your applications, makes security incidents easier to assess.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A realistic 200-person business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person professional services company running a customer portal on Azure. An AI agent receives a task to \u201cbring all packages up to date\u201d and returns a pull request containing 38 upgrades, including three major-version changes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The application builds successfully, but one updated identity package changes how login sessions are refreshed. The issue only appears after several hours, creating intermittent customer sign-outs after the release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Under a better policy, the three major upgrades would be separated from routine patches. The identity change would require a named security or platform reviewer, targeted login testing and a staged Azure release with a documented rollback.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The agent still saves development time. The difference is that speed no longer comes at the expense of uptime and customer trust.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Your policy should control the agent<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The same lesson applies to production AI systems more broadly. As we explain in designing durable Azure AI agents that stay under control, dependable systems separate what an agent can propose from what it can approve and execute.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your policy should also define how often dependencies are reviewed. Our discussion of release cadence and version governance explains why frequent releases require a repeatable decision process rather than constant reactive upgrading.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The goal is not to prevent AI agents from updating software. It is to let them handle repetitive work while your organisation retains control over risk, timing and production access.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Start with one important application<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Choose one business-critical Azure application and review its version ranges, lock files, dependency inventory, branch protections, test coverage and rollback process. This usually reveals whether your current approach is genuinely controlled or simply dependent on developer caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc combines more than 20 years of enterprise IT experience with practical Azure, Microsoft 365, OpenAI, Claude and cybersecurity expertise. As a Microsoft Partner and Wiz Security Integrator, we help organisations create controls that developers can follow without slowing every release to a crawl.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure whether AI-generated upgrades are reducing development costs or quietly increasing production risk, we are happy to review your current Azure dependency process with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>AI coding agents speed up dependency updates, but SemVer alone will not protect production. Learn how to create a safer Azure upgrade policy with testing, approvals and rollback.<\/p>\n","protected":false},"author":1,"featured_media":59704,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[114,42,13,122],"tags":[],"class_list":["post-59702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-coding-agents","category-azure-devops","category-blog","category-software-supply-chain-security"],"jetpack-related-posts":[{"id":57068,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/the-real-security-risk-in-ai-coding-agents-for-claude-code-users\/","url_meta":{"origin":59702,"position":0},"title":"The Real Security Risk in AI Coding Agents for Claude Code Users","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"AI coding agents can quietly turn untrusted text into real actions. Here\u2019s what February\u2019s prompt-injection fallout teaches Claude Code users about reducing risk without killing productivity.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/02\/post-33.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/02\/post-33.png 1x, \/wp-content\/uploads\/2026\/02\/post-33.png 1.5x, \/wp-content\/uploads\/2026\/02\/post-33.png 2x, \/wp-content\/uploads\/2026\/02\/post-33.png 3x, \/wp-content\/uploads\/2026\/02\/post-33.png 4x"},"classes":[]},{"id":57224,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-ai-coding-agents-help-businesses-build-software-faster-safely\/","url_meta":{"origin":59702,"position":1},"title":"How AI Coding Agents Help Businesses Build Software Faster Safely","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"AI coding agents cut repetitive work, speed up delivery, and help software teams do more with the same headcount when security, review, and privacy controls are set up properly.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/03\/post-13.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/03\/post-13.png 1x, \/wp-content\/uploads\/2026\/03\/post-13.png 1.5x, \/wp-content\/uploads\/2026\/03\/post-13.png 2x, \/wp-content\/uploads\/2026\/03\/post-13.png 3x, \/wp-content\/uploads\/2026\/03\/post-13.png 4x"},"classes":[]},{"id":57242,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-smbs-can-use-ai-coding-agents-without-losing-code-quality\/","url_meta":{"origin":59702,"position":2},"title":"How SMBs Can Use AI Coding Agents Without Losing Code Quality","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"AI coding agents can speed up delivery, but only with the right guardrails. Here\u2019s how to get the upside without creating quality, security, or compliance problems.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/03\/post-20.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/03\/post-20.png 1x, \/wp-content\/uploads\/2026\/03\/post-20.png 1.5x, \/wp-content\/uploads\/2026\/03\/post-20.png 2x, \/wp-content\/uploads\/2026\/03\/post-20.png 3x, \/wp-content\/uploads\/2026\/03\/post-20.png 4x"},"classes":[]},{"id":57937,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now\/","url_meta":{"origin":59702,"position":3},"title":"Should Australian CIOs Shortlist Grok 4.5 for Coding Agents Now","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Grok 4.5 promises capable coding agents at competitive pricing. Here is how Australian CIOs can decide whether it deserves a controlled trial or a place outside the shortlist.","rel":"","context":"In &quot;AI Coding Agents&quot;","block_context":{"text":"AI Coding Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-coding-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now.png 1x, \/wp-content\/uploads\/2026\/07\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now.png 1.5x, \/wp-content\/uploads\/2026\/07\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now.png 2x, \/wp-content\/uploads\/2026\/07\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now.png 3x, \/wp-content\/uploads\/2026\/07\/should-australian-cios-shortlist-grok-4-5-for-coding-agents-now.png 4x"},"classes":[]},{"id":57733,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/github-copilot-claude-code-or-gemini-agents-for-tech-teams\/","url_meta":{"origin":59702,"position":4},"title":"GitHub Copilot Claude Code or Gemini Agents for Tech Teams","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"A practical guide for CIOs and CTOs choosing the right AI coding stack for productivity, governance, security and cost control.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/github-copilot-claude-code-or-gemini-agents-for-tech-teams.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/github-copilot-claude-code-or-gemini-agents-for-tech-teams.png 1x, \/wp-content\/uploads\/2026\/07\/github-copilot-claude-code-or-gemini-agents-for-tech-teams.png 1.5x, \/wp-content\/uploads\/2026\/07\/github-copilot-claude-code-or-gemini-agents-for-tech-teams.png 2x, \/wp-content\/uploads\/2026\/07\/github-copilot-claude-code-or-gemini-agents-for-tech-teams.png 3x, \/wp-content\/uploads\/2026\/07\/github-copilot-claude-code-or-gemini-agents-for-tech-teams.png 4x"},"classes":[]},{"id":56961,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/benefits-of-using-github-copilot-coding-agents\/","url_meta":{"origin":59702,"position":5},"title":"Benefits of Using GitHub Copilot Coding Agents","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"GitHub Copilot coding agents can take on routine engineering tasks in the background and deliver draft pull requests for review. Learn how they work, where they fit, and how to use them safely.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/02\/post-8.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/02\/post-8.png 1x, \/wp-content\/uploads\/2026\/02\/post-8.png 1.5x, \/wp-content\/uploads\/2026\/02\/post-8.png 2x, \/wp-content\/uploads\/2026\/02\/post-8.png 3x, \/wp-content\/uploads\/2026\/02\/post-8.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/do-ai-coding-agents-respect-semver-in-azure-upgrade-policies.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59702"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59702\/revisions"}],"predecessor-version":[{"id":59705,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59702\/revisions\/59705"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59704"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}