Summary
- exclude installed and generated dependency trees such as
pantry,ts-pantry,vendor, andnode_modulesfrom both package discovery paths - reject
updatefile changes when the target does not exist on the base branch - escape compound version ranges in Markdown tables and URL-encode version path segments
- normalize compare ranges and keep release selection within the requested target
Root cause
Buddy scanned ignored Pantry cache manifests as project-owned package files. The package lookup then selected one of those generated manifests, and the Git provider silently treated a missing update target as a new file. Compound peer ranges also introduced raw table delimiters and invalid compare URLs into the PR body.
Impact
Dependency PRs can no longer create generated Pantry paths that do not exist on the base branch. PR bodies remain valid when current versions are compound semver ranges.
Validation
bun test(708 passing)bun run typecheckbun run build- targeted Pickier lint on all changed files
The repository-wide Pickier run still reports the pre-existing CHANGELOG.md heading-level error plus three existing documentation warnings.