Add --no-dev flag to skip dev-dependencies

Closes #607. The false positive only fires when the dev-dep crate is
resolvable in the scanned tree, so the test fixture depends on rand 0.8
directly to recreate it. xz2 is flagged without the flag, clean with it.

Author: dharimarzouq

README.md

@@ -74,6 +74,7 @@ Options:
                         repository to be considered current; 0 effectively disables this check,
                         though ages are still reported [default: 365]
       --no-cache        Do not cache data on disk for future runs
+      --no-dev          Do not consider dev-dependencies
       --no-exit-code    Do not set exit status when unmaintained packages are found
       --no-warnings     Do not show warnings
   -p, --package <NAME>  Check only whether package NAME is unmaintained

fixtures/dev-dependencies/Cargo.lock

@@ -0,0 +1,8 @@
+[package]
+name = "dev-dependencies"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+rand = "0.8"
+xz2 = "0.1.7"

fixtures/dev-dependencies/Cargo.toml

@@ -139,6 +139,9 @@ struct Opts {
     #[clap(long, help = "Do not cache data on disk for future runs")]
     no_cache: bool,
 
+    #[clap(long, help = "Do not consider dev-dependencies")]
+    no_dev: bool,
+
     #[clap(
         long,
         help = "Do not set exit status when unmaintained packages are found",
@@ -796,6 +799,9 @@ fn outdated_deps<'a>(metadata: &'a Metadata, pkg: &'a Package) -> Result<Vec<Out
         if dep.path.is_some() {
             continue;
         }
+        if opts::get().no_dev && dep.kind == DependencyKind::Development {
+            continue;
+        }
         let Some(dep_pkg) = find_packages(metadata, dep.into()).next() else {
             debug_assert!(dep.kind == DependencyKind::Development || dep.optional);
             continue;

fixtures/dev-dependencies/src/lib.rs

@@ -0,0 +1,23 @@
+[
+  {
+    "name": "rand_chacha",
+    "outdated_deps": [],
+    "repo_status": "Unassociated",
+    "version": "0.3.1"
+  },
+  {
+    "name": "xz2",
+    "outdated_deps": [
+      {
+        "name": "rand",
+        "req": "^0.8.0",
+        "version_latest": null,
+        "version_used": "0.8.6"
+      }
+    ],
+    "repo_status": {
+      "Age": null
+    },
+    "version": "0.1.7"
+  }
+]

src/lib.rs

@@ -0,0 +1,2 @@
+Prefetching GitHub data for 15 repositories
+Scanning 20 packages and their dependencies (pass --verbose for more information)

tests/cases/dev-dependencies.json

@@ -0,0 +1 @@
+path = "fixtures/dev-dependencies"

tests/cases/dev-dependencies.stderr

@@ -0,0 +1,8 @@
+[
+  {
+    "name": "rand_chacha",
+    "outdated_deps": [],
+    "repo_status": "Unassociated",
+    "version": "0.3.1"
+  }
+]

tests/cases/dev-dependencies.toml

@@ -0,0 +1,2 @@
+Prefetching GitHub data for 15 repositories
+Scanning 20 packages and their dependencies (pass --verbose for more information)