No differentiation between indirect:production and indirect:development types

[JacobEvelyn]

The README says we should get dependency-type info like direct:production, which conveys information along two axes: direct/indirect and production/development. But in our PRs, I'm just seeing e.g. indirect as the only type information, which makes it hard for us to do things like "auto-merge any development dependency update."

Would it be possible to change this so it always has both pieces of information?

[JacobEvelyn]

Ah, @feelepxyz @brrygrdn I see in output.ts that indirect dependencies don't get labeled as production or development. Is there a reason for this? I know an indirect dependency can be used by both production and development dependencies, but I assume the logic would be to treat that case as indirect:production.

We're trying to automate merging of all development dependency updates, including indirect ones, but to do that we need this additional information.

[feelepxyz]

@JacobEvelyn this is currently a limitation in dependabot. The current dependency data model in dependabot-core doesn't support tracking the group for indirect dependencies so not a trivial fix unfortunately. I'm keen to rejig the data-model for a bunch of reasons but will be quite a while before we can get to it.

[JacobEvelyn]

@feelepxyz gotcha, thanks for the context.

[brrygrdn]

We've updated our documentation to reflect this limitation in core, so I'm going to close this out for now.