CommandBox will now only include installed dependencies in the "outdated" and "update" command. Whether or not it is installed is determined by whether there is an installation path stored in box.json. If you use the --verbose flag, you will see a message for each uninstalled dependency that was skipped. In this way, the update command doesn't care if --production was used or not, it simply updates package that are already installed and ignores any others.

After further thought, I think i'm ok to say that the "package update" command will only re-install packages who are have an installPath set in box.json that exists on the file system. I think interceptors and models are becoming an edge case as we no longer recommend that package type in favor of modules.

Linking in original forum thread here:
https://groups.google.com/a/ortussolutions.com/d/topic/commandbox/gwy-FpRacdw/discussion

And quoting myself:

We can add a production flag to the update command, but in theory, the update command should already know what's been installed. Unfortunately there's no reliable way to determine what packages are installed since not all packages save an install path in the box.json. (anything that doesn't create a package directory like an interceptor or model) It's also possible that there could have been manually-installed packages as well, though I'm ok with those being an edge case.
Another option is to save a flag in box.json that marks if the last install was production, but I'm not sure how I feel about that.

Do you have any opinions on how we try to solve this?