In my preliminary testing with moonshot update for a set of stacks, it seems that using --dry-run resulted in changes being forcefully applied (the same as if I had passed --force). Maybe I'm misunderstanding the intended use of --dry-run, but I thought it would basically either create the Change Set then leave it for me to inspect later in the CloudFormation UI, or create the Change Set, display the changes in it (as reported back from AWS), then delete the Change Set.
It looks like it actually:
- Created the Change Set
- Applied the Change Set (with no user confirmation)