Check elsewhere in your log for messages about dependency cycles. As
I recall, when you have a dependency cycle Puppet will break it in
some unspecified manner instead of failing the catalog altogether. In
many cases that allows Puppet to still reach the target configuration,
albeit in more than one run.
You haven't shown much manifest code, but my bet would be that
Exec['apt-update'] has a relationship on the apt package. The chain
you showed would set up the complementary relationship, thus closing a
cycle.
John