Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

Removing a dependency that has a registered patch fails: once the node is gone the orphaned patchedDependencies entry matches no installed node, so the unused-patch guard throws.

npm uninstall is-positive
# => npm error code EPATCHUNUSED
# =>   [email protected] -> patches/[email protected]

The user must run npm patch rm is-positive first.

Expected Behavior

Debatable. A friendlier flow would detect that the package being removed owns the patch and either auto-drop the matching patchedDependencies entry or emit a targeted hint ("run npm patch rm is-positive") instead of the generic unused-patch error.

Steps To Reproduce

REPRO=/tmp/patch-uninstall && rm -rf "$REPRO" && mkdir -p "$REPRO" && cd "$REPRO"
cat > package.json <<'EOF'
{ "name": "un", "version": "1.0.0", "dependencies": { "is-positive": "3.1.0" } }
EOF
npm install --no-audit --no-fund

ED=$(npm patch is-positive | sed -n 's/.*directory: //p')
perl -0pi -e "s/'use strict';/'use strict';\n\/\/x/" "$ED/index.js"
npm patch commit "$ED"

npm uninstall is-positive --no-audit --no-fund   # => EPATCHUNUSED

Environment

• npm: 12.0.0-pre.0
• Node.js: v24.15.0
• OS Name: Darwin 25.5.0 (macOS, arm64)
• Relevant config: none — reproduces with default configuration