Undefined behavior when dep range checked in is out of sync

[Kenneth Chau]

These are repro cases:

1. the first commit where a new dep is introduced + that dep being bumped while publishing
2. a package version are out of sync as checked in & a dep change bump happened on that out-of-sync package