Outdated-package sweep applies major-version bumps in bulk 'chore(deps)' commits, no build verification — broke 24 fleet projects (typescript 6→7)

[alamb-hex]

Summary

The last "outdated packages" sweep bumped typescript from ^6.0.3 to ^7.0.2 — a major version jump — across 24 fleet repos, bundled into routine chore(deps): update N packages commits alongside genuine patch/minor updates. Next.js 16.2.10 doesn't recognize TypeScript 7 as installed and aborts the build:

It looks like you're trying to use TypeScript but do not have the required package(s) installed.
Please install typescript by running:
    npm install --save-dev typescript
Next.js build worker exited with code: 1
Error: Command "npm run build" exited with 1

Two production sites were confirmed down on Vercel as a result: alyfe-v3 and cordero-group (chore(deps): update 35 packages / chore(deps): update 4 packages). 22 more repos carry the same broken pin and will fail on their next deploy: hextant-v2, hexaxia.tech-dev, hexaxia.tech-prod, pitch-next, promo-tracker, hextant.ai-4v, sailbot.ai, hexbook, hexcms, hexmetrics, spiritkewahres.com, hexaxia.consulting, hexaxia.consulting-prod, paxnocturna.com, crisaljohn.com, hamradiotoday.org, ttddts.com, hexaxia.com, kv9l.com, hexaxia.media, indyhcs.net, indyholisticmassage.com.

Root cause

src/lib/patch-scanner.ts (around line 900-928, "Process outdated packages"):

const updateType = getUpdateType(pkg.current, pkg.latest);
...
queue.push({
  ...
  targetVersion: pkg.latest,   // <-- unconditionally uses `latest`, not `wanted`
  updateType,
  ...
});

if (updateType === 'major') summary.outdatedMajor++;

updateType is correctly computed and used to bucket the dashboard summary (outdatedMajor/outdatedMinor/outdatedPatch) and to weight display priority, but nothing downstream gates the apply path on updateType === 'major'. npm outdated --json returns both wanted (highest version satisfying the package.json semver range) and latest (absolute latest on the registry, ignoring the range) — the scanner always queues pkg.latest, so a ^6.0.3 range that should cap upgrades below 7.0.0 gets silently bumped to 7.0.2 anyway, and the resulting version string written back to package.json widens the caret to match (^7.0.2), permanently discarding the original range intent.

No build/typecheck verification gate exists between "apply update" and "commit," so the breakage wasn't caught before these commits landed across the fleet.

Suggested fix

• Default the outdated-package auto-apply path to pkg.wanted (range-respecting) rather than pkg.latest, OR
• Require explicit opt-in / separate review queue for updateType === 'major' entries — don't bundle them into the same auto-committed batch as patch/minor updates.
• Add a post-apply build/typecheck smoke check before committing (or at least before the commit is treated as "safe to push"), matching the existing "manual review over automation, validate before applying" workflow expectation.

Fix applied so far

Manually reverted typescript to ^6.0.3 in alyfe-v3 and cordero-group, verified npm run build passes clean, and pushed. Remaining 22 repos to follow.