[Feature Request] Add ability to update groups of gems AND their dependencies conservatively

Describe the problem as clearly as you can

There needs to be a simple way to update development & test gems including their dependencies without updating a shared dependency used by a production (default) gem.

bundle update --group test development --conservative Will update the dev & test gems declared in the Gemfile but not ANY dependencies (shared or not). The perceived intent as captured in numerous blog posts is to update all gems in the dev & test group without updating production gems. This does technically accomplish this by not updating any downstream dependencies but is much more conservative than is expected.

bundle update --group test development Will update the dev & test gems including their dependencies, even if it is a shared dependency used by a production (default) gem.

What's missing is a tool assisted way to update the dev & test gems AND their dependencies that are ONLY used by other dev & test gems and potentially other downstream dependencies. Ideally --conservative would only update dependencies that were exclusively reachable through the groups & gems specified in the update command.

Given the change in behavior on such a highly used tool; I would suggest adding a new option like --conservative-dependencies.

Example Blog posts which indicate this command updates non-production gems when really it only updates the dev & test gems declared directly in the Gemfile.

• https://medium.com/cedarcode/updating-gems-cheat-sheet-346d5666a181
• https://medium.com/cedarcode/reduce-fear-of-bundle-update-with-this-4-step-process-e021e8808c48

Did you try upgrading rubygems & bundler?

Yes
RubyGems: 3.4.21
Bundler: 2.4.21

Post steps to reproduce the problem

There is no command that will update the dev & test gem and their dependencies without affecting production gems.

bundle update --group test development --conservative Does not update anything even though it is safe to update date which is only used by net-imap.

bundle update --group test development Updates date (which is fine) but also updates net-protocol which is a shared dependency used by the net-smtp production gem.

Gemfile

source 'https://rubygems.org'

group :test do
  gem 'net-imap'
end

gem 'net-smtp'

Gemfile.lock

GEM
  remote: https://rubygems.org/
  specs:
    date (3.3.0)
    net-imap (0.4.2)
      date
      net-protocol
    net-protocol (0.2.0)
      timeout
    net-smtp (0.4.0)
      net-protocol
    timeout (0.4.0)

PLATFORMS
  arm64-darwin-22

DEPENDENCIES
  net-imap
  net-smtp

BUNDLED WITH
   2.4.21

What were you expecting to happen?

I expected running bundle update --group test development --conservative would update all test & development gems and any dependencies that were not shared OR shared exclusively with other test & development gems.

What actually happened?

I can either do an extremely conservative update which does not update any dev & test gem dependencies OR I can update all dependencies even if they are used by production gems; which is outside the scope of dev & test gems that I specified.

If not included with the output of your command, run bundle env and paste the output below

Environment

Bundler       2.4.21
  Platforms   ruby, arm64-darwin-22
Ruby          3.0.5p211 (2022-11-24 revision ba5cf0f7c52d4d35cc6a173c89eda98ceffa2dcf) [arm64-darwin-22]
  Full Path   /Users/dmorehouse/.rbenv/versions/3.0.5/bin/ruby
  Config Dir  /Users/dmorehouse/.rbenv/versions/3.0.5/etc
RubyGems      3.4.21
  Gem Home    /Users/dmorehouse/.rbenv/versions/3.0.5/lib/ruby/gems/3.0.0
  Gem Path    /Users/dmorehouse/.gem/ruby/3.0.0:/Users/dmorehouse/.rbenv/versions/3.0.5/lib/ruby/gems/3.0.0
  User Home   /Users/dmorehouse
  User Path   /Users/dmorehouse/.gem/ruby/3.0.0
  Bin Dir     /Users/dmorehouse/.rbenv/versions/3.0.5/bin
Tools
  Git         2.39.2
  RVM         not installed
  rbenv       rbenv 1.2.0
  chruby      not installed

Bundler Build Metadata

Built At          2023-10-17
Git SHA           d10b46bd15
Released Version  true

Bundler settings

Gemfile

Gemfile

source 'https://rubygems.org'

group :test do
  gem 'net-imap'
end

gem 'net-smtp'

Gemfile.lock

GEM
  remote: https://rubygems.org/
  specs:
    date (3.3.0)
    net-imap (0.4.2)
      date
      net-protocol
    net-protocol (0.2.0)
      timeout
    net-smtp (0.4.0)
      net-protocol
    timeout (0.4.0)

PLATFORMS
  arm64-darwin-22

DEPENDENCIES
  net-imap
  net-smtp

BUNDLED WITH
   2.4.21

Start by reproducing the two documented commands with the provided Gemfile and Gemfile.lock, then inspect Bundler's group and conservative-update behavior. Done means a defined update mode can refresh dependencies reachable only from the selected test/development groups while leaving production-shared dependencies unchanged, with coverage for the net-imap/net-smtp example.