Omit dev-dependencies

[jayvdb]

cargo-unmaintained is emitting:

xz2 (https://github.com/alexcrichton/xz2-rs updated 897 days ago)
    rand (requirement: ^0.8.0, version used: 0.8.5, latest: 0.9.1)

However rand is only in dev-dependencies.
now: https://github.com/alexcrichton/xz2-rs/blob/main/Cargo.toml#L27
at relevant release: https://github.com/alexcrichton/xz2-rs/blob/0.1.7/Cargo.toml#L27

Having old dependencies in dev-dependencies is common to allow testing support for old versions.

And a projects dev-dependency versions have no effect on my project.

[jayvdb]

Another one https://github.com/dalek-cryptography/subtle/blob/main/Cargo.toml#L29

And another https://github.com/srijs/rust-crc32fast/blob/master/Cargo.toml#L21

Note this problem is 3 of 7 problems raised by cargo-unmaintained in my project.

[dharimarzouq]

happy to take this on if youre open to a pr. outdated_deps in lib.rs already skips platform-mismatched, private-registry, and path deps, so id add a skip for DependencyKind::Development in the same chain (leaving build-dependencies counted, since those do affect consumers). should it be unconditional, or would you want it behind a flag?

i can also run the rustsec_advisories example before/after to check the impact on the advisory detection rate, in case skipping dev-deps costs some true positives.

[smoelius]

happy to take this on if youre open to a pr. outdated_deps in lib.rs already skips platform-mismatched, private-registry, and path deps, so id add a skip for DependencyKind::Development in the same chain (leaving build-dependencies counted, since those do affect consumers). should it be unconditional, or would you want it behind a flag?

Please do! Let's please follow cargo-supply-chain's convention and have a --no-dev flag.

i can also run the rustsec_advisories example before/after to check the impact on the advisory detection rate, in case skipping dev-deps costs some true positives.

That's a good idea, and I will run that myself to see the results. But rustsec_advisories is expensive, so I would prefer to not run it additional times in CI or with cargo test.