babel-jest should live in devDependencies

[MitchLillie]

Description

babel-jest appears in the regular dependencies, so it's getting installed along with the rest of the code.

What type of issue is this? (place an x in one of the [ ])

• bug
• enhancement (feature request)
• question
• documentation related
• testing related
• discussion

Requirements (place an x in each of the [ ])

• I've read and understood the Contributing guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've searched for any related issues and avoided creating a duplicate issue.

---

Bug Report

Filling out the following details about bugs will help us solve your issue sooner.

Reproducible in:

slackhq/csp-html-webpack-plugin version: 3.0.0

node version: 8, 10

OS version(s): macOS 10.14 (Mojave)

Steps to reproduce:

1. npm i csp-html-webpack-plugin
2. Inspect node_modules directory

Expected result:

Only the deps which are actually consumed are installed along with csp-html-webpack-plugin

Actual result:

babel-jest is present. Also you get a warning if you don't satisfy babel-jest's peerDependency for babel-core.

[hvolschenk]

This is also causing an npm audit vulnerability (in v3.0.0):

$ npm audit
                       === npm audit security report ===
                                 Manual Review
             Some vulnerabilities require your attention to resolve
          Visit https://go.npm.me/audit-guide for additional guidance

Low             Regular Expression Denial of Service
Package         braces
Patched in      >=2.3.1
Dependency of   csp-html-webpack-plugin [dev]                                 
Path            csp-html-webpack-plugin > babel-jest > babel-plugin-istanbul  
                  > test-exclude > micromatch > braces                          

More info       https://nodesecurity.io/advisories/786

$ npm ls --depth=0
...
+-- csp-html-webpack-plugin@3.0.0
...

[MitchLillie]

Awesome, thanks for the quick fix!