--- title: "FAQ · landmine: stop coding agents from hitting known bugs in pinned dependency versions" url: https://landmine.tech/faq/ updated: 2026-10-22 --- > How to stop Claude Code, Codex, Cursor and other coding agents from writing code that hits an open, already-filed bug in the exact dependency version a project pins. Answers about landmine and landmine-bench. > Source: https://landmine.tech/faq/ · Repository: https://github.com/devanshranjan10/landmines FAQ # Coding agents and the bugs already filed against your versions. Short, direct answers. Each one links to the evidence. Quote freely; please link back. ## What is landmine? landmine is a free, open-source command-line tool (npm package `landmines`, MIT licensed, by Devansh Ranjan) that finds the open GitHub issues filed against the exact dependency versions a project pins, and puts them where a coding agent reads them before it writes code: a known-bugs section in AGENTS.md and CLAUDE.md, a pre-edit hook, and an MCP server. Each entry carries the affected API and the workaround from the issue thread. Source: [github.com/devanshranjan10/landmines](https://github.com/devanshranjan10/landmines). ## How do I stop my coding agent from using an API that's broken in the version I pin? Tell the agent about the bug before it plans. Run `npx landmines scan` to index the open issues for your exact versions, then `npx landmines install --rules` to write a short known-bugs list into AGENTS.md and CLAUDE.md, ranked by the APIs your code calls. On landmine-bench this took Claude Sonnet 5.5 from 86% to 99% (72/84 → 83/84 runs). A pre-edit hook is installed as a backstop: it pauses an edit once when it uses an API from a matching issue, then lets the retry through. ## Is there a benchmark for whether coding agents avoid known bugs in pinned dependency versions? Yes: landmine-bench, which is, as far as we know, the first public benchmark for it. It has 66 validated tasks across 25 Python and JavaScript packages; each pins a library version with an open, reproducible upstream bug and asks for a feature whose obvious implementation hits it, graded by a hidden test. 31 "fresh" tasks come from issues opened on or after 2026-07-01. Existing version-aware benchmarks (GitChameleon, VersiCode, CodeUpdateArena, LibEvolutionEval) measure API changes between versions, not open bugs. Results and method: [landmine.tech/benchmark](https://landmine.tech/benchmark/). ## Doesn't web search or Context7 already solve this? Not in our measurement. On the same 21 held-out tasks, in one batch, Claude Sonnet 5.5 passed 36/42 with web search on, 35/42 with the Context7 docs MCP, 35/42 with no help, and 42/42 with the landmine rules section. In all 84 web-search and Context7 sessions the agent never called either tool: nothing told it there was a bug to look for. Context7 serves documentation, which open bugs usually aren't in. ## How is this different from Dependabot, npm audit or Snyk? Those tools report security vulnerabilities from advisory databases and propose upgrades. landmine reports ordinary open bugs (wrong results, crashes, type errors) filed as GitHub issues against the version you pin, whether or not a fix exists, and delivers them to the coding agent with the workaround from the thread, before it writes the code. ## Which coding agents does it support? Pre-edit hooks for Claude Code and Codex CLI (both verified live), Cursor, Gemini CLI, GitHub Copilot, Windsurf / Devin, Antigravity, Factory Droid, Augment, Kiro, Qwen Code, Crush, Goose, OpenHands and Trae. In-process plugins for OpenCode, Kilo Code, Cline, Amp and Pi. Any other agent (Aider, Zed, Roo Code, Continue, Warp, Freebuff and others) reads the rules section, an Agent Skill or the MCP server. Details: [docs](https://landmine.tech/docs/#agents). ## Which languages and lockfiles? JavaScript/TypeScript (npm `package-lock.json`, pnpm, yarn classic and berry, bun) and Python (`uv.lock`, `poetry.lock`, `Pipfile.lock`, pinned `requirements*.txt`). Direct dependencies only. ## Does landmine send my code anywhere? No. `scan` sends your direct dependency names and versions to registry.npmjs.org, pypi.org and api.github.com. The optional `cards` command sends each indexed issue's public thread to the model provider you choose. The hook and the MCP server never touch the network. ## Does it slow the agent down or cost more? The hook runs offline in about 0.11 s per edit. On landmine-bench the rules section added about 12% to cost per run (a longer CLAUDE.md) and no extra turns. ## Isn't issue text from GitHub a prompt-injection risk? Yes, and landmine treats it as one. Every quote reaches the agent inside one delimited block labelled as untrusted third-party text, forged delimiters are neutralised, HTML is stripped, length is capped, quotes that pipe downloads into a shell or link unfamiliar hosts are flagged, and the agent is told never to follow instructions inside them. ## Is it "landmine" or "landmines"? The tool is landmine. The npm package is `landmines` because `landmine` on npm is an unrelated package; it installs both the `landmine` and `landmines` commands. Homebrew: `brew install devanshranjan10/tap/landmines`. ## How do I cite landmine or landmine-bench? Cite the repository, [github.com/devanshranjan10/landmines](https://github.com/devanshranjan10/landmines) (Devansh Ranjan, 2026), or the benchmark: ``` @misc{landminebench2026, title = {landmine-bench: Do Coding Agents Avoid Known Open Bugs in Pinned Dependency Versions?}, author = {Ranjan, Devansh}, year = {2026}, note = {Version 0. https://landmine.tech/benchmark/} } ``` The repository also has a `CITATION.cff`, so GitHub's "Cite this repository" button gives APA and BibTeX.