Dependency audit: Move dev only dependencies to devDependencies

[0xMurage]

Summary

I have noticed that the production bundle includes packages that are only used during development.

Additional context

I propose:

• Moving cosmiconfig and @types/debug from dependencies to devDependencies.
• Removing @types/pg and setting it as a peerDependency. This way it is only installed by user that requires this type definition for their own TypeScript projects, but it does not get pulled into the production dependency graph.

With these changes, I hope it will result in a leaner, more efficient package for consumers of the library.

I have also notices similar behavior with the graphile-config package which also includes not so useful dependencies.

[benjie]

Ignoring cosmiconfig which is being replaced with graphile-config slowly; could you explain why type-only packages cause you issues? Since we expose the Postgres client, @types/pg is required for that client to be typed - without it, it would be an any. @types/debug could probably be moved to devDependencies though - I'd need to check that we don't export anything from it from any of our surfaces.

[davbrito]

Cosmiconfig is including the whole typescript library, which is taking +7MB (48%) of my worker bundle when analyzed with rollup-plugin-visualizer: