The agent fixed a small bug and the lockfile carried 300 unrelated dependency bumps
A one-line bug fix arrived as a PR whose lockfile changed four hundred lines. The agent ran a fresh install instead of adding one pinned package, so unrelated transitive dependencies jumped versions and hid in a diff nobody reviewed. A fix PR should not also be an unplanned supply-chain upgrade.