--ignores ignores too much bug/critical

mkdir temp
cd temp
npm init -y
npm i eslint@4 eslint-plugin-promise@3
david u --ignores rbn-css,eslint-plugin-promise,myotherpackage

*expected*
eslint-plugin-promise is not upgraded to 4
eslint is upgraded to 5

*actual*
neither package is updated, somehow eslint is getting ignored.

seems to be some issue with Hyphens also being split() on rather than just coma for the ignore patterns.