chore(backend): move build tooling out of runtime dependencies

[DerekRoberts]

Problem

Updated: Synced with main after #2790 merged (Trivy report-only). CI green on latest push.

backend/package.json listed @nestjs/cli, @nestjs/schematics, @nestjs/testing, rimraf, and the prisma CLI as runtime dependencies. Two consequences:

• The dependencies stage of backend/Dockerfile runs npm ci --omit=dev and copies the result into the distroless runtime image, so the Nest build toolchain, webpack, and fork-ts-checker were shipping to production.
• npm marked that whole subtree as production in the lockfile, so Trivy counted its transitive advisories as production findings. Both brace-expansion alerts came from there.

Change

Those five packages move to devDependencies. Nothing else. The build stage runs npm run deploy, which is a full npm ci followed by nest build, so the build has everything it needs.

Note that this does not remove the Prisma CLI from the production tree: @prisma/client declares an optional peer dependency on prisma, which npm installs regardless of where it is listed. Advisories reaching the report through that path are handled separately.

Results

• Production dependency tree, the one copied into the runtime image: 546M to 378M, a 31% reduction. node_modules/@nestjs/cli is absent from that tree afterwards.
• Trivy HIGH findings: 4 to 2, both brace-expansion alerts cleared.

Verification

• npm run deploy, the exact command the Dockerfile build stage runs: prisma generate and nest build both succeed, 0 TypeScript issues.
• npm test: 8 files, 32 tests passing.
• npm ci --omit=dev followed by node dist/main against an unreachable database: "Nest application successfully started", confirming nothing the runtime needs was moved out.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

This PR reduces the backend production dependency footprint by moving NestJS build/test tooling and other CLIs from dependencies to devDependencies, aligning with the Dockerfile’s npm ci --omit=dev runtime install behavior.

Changes:

• Moved @nestjs/cli, @nestjs/schematics, and @nestjs/testing to devDependencies.
• Moved prisma (CLI) and rimraf to devDependencies.
• Updated backend/package-lock.json accordingly to reflect the dev/prod classification changes.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
backend/package.json	Reclassifies build/test tooling and CLIs as dev-only dependencies.
backend/package-lock.json	Lockfile updates reflecting the dependency/devDependency move.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.