Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

npm patch update <pkg> --to <v> rebases the patch and rewrites package.json + package-lock.json without checking that <v> is part of the installed tree. It finalizes with allowUnusedPatches: true, so it prints only a success line. If <v> is not installed, the very next plain npm install (or npm ci) fails with EPATCHUNUSED.

Expected Behavior

npm patch update --to should warn when the rebased-to version is not present in the current tree (e.g. "[email protected] is not installed; bump the dependency and reinstall"), so the failure does not surprise the user on the next install.

Steps To Reproduce

REPRO=/tmp/patch-update-to && rm -rf "$REPRO" && mkdir -p "$REPRO" && cd "$REPRO"
cat > package.json <<'EOF'
{ "name": "pu", "version": "1.0.0", "dependencies": { "is-odd": "3.0.0" } }
EOF
npm install --no-audit --no-fund

ED=$(npm patch is-odd | sed -n 's/.*directory: //p')
perl -0pi -e "s/'use strict';/'use strict';\n\/\/ marker/" "$ED/index.js"
npm patch commit "$ED"

# dependency is still pinned to 3.0.0, but rebase the patch onto 3.0.1:
npm patch update is-odd --to 3.0.1     # prints "Updated ..."; no warning
rm -rf node_modules
npm install --no-audit --no-fund       # => npm error code EPATCHUNUSED

Environment

• npm: 12.0.0-pre.0
• Node.js: v24.15.0
• OS Name: Darwin 25.5.0 (macOS, arm64)
• Relevant config: none — reproduces with default configuration