devDependency status is ignored in yarn audit

[ar1em]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
yarn audit --json doesn’t calculate devDependencies. As a result “dev” objects are always false for any dependency.

If the current behavior is a bug, please provide the steps to reproduce.

1. create package.json with vulnerable dependencies. For example:
   { "name": "yarn-audit-bug", "version": "0.1.0", "description": "Yarn audit bug", "devDependencies": { "lodash": "1.2.0" }, "dependencies": { "hawk": "2.0.0" }, "engines": { "yarn": ">= 1.0.0" } }
2. Install dependencies yarn install
3. Execute yarn audit --json
   result: https://gist.github.com/ar1em/94a71b68492162020af24c166cf0d9c4
4. "devDependencies" object in "auditSummary" equals 0 and “dev” objects in lodash advisories equals false

What is the expected behavior?
"devDependencies" object must be equal to 1 and “dev” object for lodash advisories must be true. npm audit --json works correctly in this case.
result: https://gist.github.com/ar1em/1d008dc1c6cdae8bd30e85965bd91e81

Please mention your node.js, yarn and operating system version.
node version v10.15.3
yarn version v1.16.0
Mac OS X version v10.14.4

yarn audit --verbose
https://gist.github.com/ar1em/29b00d6bed7d45890b4e420cc3af439c

[ar1em]

Duplicate #6970