Could something like this be caught by static analysis?
Will it? Maybe.
Would I count on it in all cases? No.
Also, I find it preposterous to rely on a second automated system to cancel out the mistakes the first one made.
Downvote away. You know who you are.
Also, I just checked out an old Flask/Python project from 7 years ago, updated it to use Poetry dependency management, and it all still works. A JS project that is 7 months old and unmaintained would be a dumpster fire.