@Seldaek While reviewing this PR, I found this small line which does not really make sense. Whitelisting a package has no reason to whitelist its dev requirements as dev requirements should be considered only for the root package. It may be a reason for the extra updates happning