When checking third party libraries used in
build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities for these dependencies. But if they are not shipped and only used for testing is there any risk with not updating them?
This Snyk blog says that "dev dependencies matter little". So I am looking for confirmation that this is the case, as they are not tested by default.