WIP: capture the parent dep type

lib/protect/update.js

@@ -16,10 +16,17 @@ function update(packages, live) {
     // the uninstall doesn't need versions in the strings
     // but install *does* so we build up arrays of both
     var upgradeWithoutVersions = [];
+
     var upgrade = packages.map(function (vuln) {
       // FIXME the line below is wrong, should be .filter(Boolean)[0]
       var remediation = vuln.upgradePath.filter(Boolean)[0];
       upgradeWithoutVersions.push(remediation.split('@').shift());
+
+      // TODO fix this string
+      if (vuln.parentDep === 'dev') {
+        console.log('>>>>>>>>>>>>>>>>');
+      }
+
       return remediation;
     });
 
@@ -31,6 +38,8 @@ function update(packages, live) {
 
     var toUninstall = _.unique(upgradeWithoutVersions);
     var promise = npm('uninstall', toUninstall, live).then(function () {
+      // FIXME this only adds to prod deps
+      // it should respect the dep type here
       return npm('install', findUpgrades(upgrade), live).catch(function (e) {
         error = e;
         return false;

lib/test.js

@@ -121,6 +121,12 @@ function test(root, options, callback) {
             vuln.__filename = plucked.__filename;
             vuln.shrinkwrap = plucked.shrinkwrap;
             vuln.bundled = plucked.bundled;
+
+            vuln.depType = plucked.depType;
+
+            var parentPkg = moduleToOjbect(vuln.from[1]);
+            var parent = modules.pluck(vuln.from.slice(0, 2), parentPkg.name, parentPkg.version);
+            vuln.parentDep = parent.depType;
           });
         }
       }