[BUG] `npm update` only edits package-lock.json, not package.json about cli

[shadowspawn]

This is the documented behaviour. Try adding --save.

https://docs.npmjs.com/cli/v10/commands/npm-update

Note that by default npm update will not update the semver values of direct dependencies in your project package.json. If you want to also update values in package.json you can run: npm update --save (or add the save=true option to a configuration file to make that the default behavior).

[adamlui]

Hey @shadowspawn thanks for the info, npm update --save also isn't updating package.json

The bug appears to be affecting dependabot's behavior too: dependabot/dependabot-core#9071

Sometimes dependabot updates both files:
Bump @adamlui/scss-to-css from 1.1.1 to 1.2.0
Bump @adamlui/minify.js from 1.0.1 to 1.0.2

...and sometimes it doesn't:
Bump @adamlui/scss-to-css from 1.0.1 to 1.2.0
Bump sass from 1.70.0 to 1.71.0 in /scss-to-css

[adamlui]

Wait nvm those were sub-dependencies and my main ones were already up-to-date, I tested down-bumping then --save worked to edit both files. But do you know if Dependabot's glitched behavior is due to a npm cli bug?

[adamlui]

Also if a user is using --save and sub-dependencies are being bumped, shouldn't it be expected they want the sub-dependency's package.json' to save this new tree?