Test-only packages are in production dependencies

[avinxshKD]

A few test libraries are listed under runtime dependencies instead of devDependencies, so they get installed in production builds unnecessarily.

Packages currently in runtime deps:

• sinon
• sinon-mongoose
• jest-express
• mongodb-memory-server

mongodb-memory-server is especially heavy and unnecessary for production installs.

Actual behavior:
Test tooling is shipped in runtime dependencies.

Expected behavior:
Test tooling should be in devDependencies only.

Steps to reproduce:

1. Open package.json.
2. Check the dependencies section.
3. Confirm the above test packages are listed there.

Why this matters:
Larger production install/build footprint.
Slower CI/build pipelines.
Unnecessary runtime dependency surface.

Environment:
Repo: processing/p5.js-web-editor
Date observed: 2026-02-21
Local dev setup on Windows

[avinxshKD]

Hey @raclim I verified this locally in package.json: sinon, sinon-mongoose, jest-express, and mongodb-memory-server are currently in dependencies. These are test-only packages, so moving them to devDependencies is the correct fix.
It’s a low-risk change and should reduce unnecessary production install weight.
Lmk what do you think, Happy to open a PR for this if this makes sense