A generated dependency bump can look finished and still be unfinished. In the composite case used for this note, a small HTTP service received a patch that edited package. json , left package-lock.
Source: [Dev.to](https://dev.to/devpro_9167/forty-eight-hours-before-the-remote-apply-205p)