Distinguish between normal and dev dependencies.

[michaelkedar]

There is no current way to identify whether a vulnerable dependency only affects the development environment e.g. whether it comes from devDependencies or dependencies in package.json.

We should add a field to the output to present this information, if we can extract it.

[aniruth37]

I tried adding a column called DevDependency to the output table. Would the below output resolve this issue?

[another-rex]

We are thinking of placing the devDependencies in a separate table under the normal dependencies.

So if we identify any dep dependencies, we will print two tables, with the first table containing only main deps, and a second table containing dev deps.

[G-Rath]

@another-rex probably better to have support for marking "groups" that packages belong to, to support arbitrary groupings and have the default of no group take priority (since that is typically what are considered production dependencies); then in your output you just print-by-group and naturally sort "no group" to the top

[oliverchang]

@cuixq This might be an interesting starter project to tackle.