A large share of "it broke for no reason" isn't your code. A vendored library moved. crux watches for exactly this.

Flip commit or suspects touching vendor/, third_party/, deps/, extern/ or node_modules/, and crux reads the dependency's manifest at the parent & at the flip commit and reports the transition:

dependency: libc [vendored-crate] 0.1.0 -> 0.2.0
  upstream: https://github.com/example/libc

Lockfiles get the same treatment. A Cargo.lock diff is parsed for package version transitions, handling the way name lines appear as shared context between changed blocks.

--upstream-deep takes the repository URL from the dependency manifest, resolves the old & new version tags on that remote, fetches a blobless clone, and lists the upstream commits between the 2 tags. Tags don't resolve or the network is down, and it says attribution was unavailable. It never guesses an upstream cause from a version number alone.