chore: move doc deps to dev

This moves all the dependencies of the `docs/` workspace to dev deps. I
had originally moved them out of devDeps as part of #5309, but this
seems to go against the grain of other tooling. We would have to special
case both `audit` and `licensee` to run on a custom subset of our
dependency tree.

Maybe one day when all tools can be piped the output of an `npm query`
this will be possible. It would be nice if we could only audit
dependencies that are bundled as part of the CLI.

But for now it's easier to move these to devDeps and then reinstall only
the docs workspace after pruning during the publish step.

.github/workflows/audit.yml

@@ -31,4 +31,4 @@ jobs:
       - name: Reset Deps
         run: node . run resetdeps -- --package-lock
       - name: Run Audit
-        run: node . audit -iwr -w workspaces
+        run: node . audit

DEPENDENCIES.md

@@ -243,8 +243,6 @@ graph LR;
 ## all dependencies
 ```mermaid
 graph LR;
-  acorn-globals-->acorn-walk;
-  acorn-globals-->acorn;
   agent-base-->debug;
   agentkeepalive-->debug;
   agentkeepalive-->depd;
@@ -254,18 +252,11 @@ graph LR;
   ansi-styles-->color-convert;
   are-we-there-yet-->delegates;
   are-we-there-yet-->readable-stream;
-  argparse-->sprintf-js;
   bin-links-->cmd-shim;
   bin-links-->npm-normalize-package-bin;
   bin-links-->read-cmd-shim;
   bin-links-->write-file-atomic;
-  bindings-->file-uri-to-path;
-  bl-->buffer;
-  bl-->inherits;
-  bl-->readable-stream;
   brace-expansion-->balanced-match;
-  buffer-->base64-js;
-  buffer-->ieee754;
   builtins-->semver;
   cacache-->chownr;
   cacache-->fs-minipass;
@@ -292,39 +283,19 @@ graph LR;
   cli-columns-->strip-ansi;
   cli-table3-->colors-colors["@colors/colors"];
   cli-table3-->string-width;
-  cmark-gfm-->bindings;
-  cmark-gfm-->node-addon-api;
-  cmark-gfm-->prebuild-install;
   color-convert-->color-name;
   columnify-->strip-ansi;
   columnify-->wcwidth;
-  combined-stream-->delayed-stream;
-  cssstyle-->cssom;
-  data-urls-->abab;
-  data-urls-->whatwg-mimetype;
-  data-urls-->whatwg-url;
   debug-->ms;
-  decompress-response-->mimic-response;
   defaults-->clone;
   dezalgo-->asap;
   dezalgo-->wrappy;
-  domexception-->webidl-conversions;
   encoding-->iconv-lite;
-  end-of-stream-->once;
-  escodegen-->esprima;
-  escodegen-->estraverse;
-  escodegen-->esutils;
-  escodegen-->optionator;
-  escodegen-->source-map;
-  form-data-->asynckit;
-  form-data-->combined-stream;
-  form-data-->mime-types;
-  front-matter-->js-yaml;
   fs-minipass-->minipass;
   gauge-->aproba;
+  gauge-->color-support;
   gauge-->console-control-strings;
   gauge-->has-unicode;
-  gauge-->object-assign;
   gauge-->signal-exit;
   gauge-->string-width;
   gauge-->strip-ansi;
@@ -337,7 +308,6 @@ graph LR;
   glob-->path-is-absolute;
   has-->function-bind;
   hosted-git-info-->lru-cache;
-  html-encoding-sniffer-->whatwg-encoding;
   http-proxy-agent-->agent-base;
   http-proxy-agent-->debug;
   http-proxy-agent-->tootallnate-once["@tootallnate/once"];
@@ -357,38 +327,6 @@ graph LR;
   init-package-json-->validate-npm-package-name;
   is-cidr-->cidr-regex;
   is-core-module-->has;
-  is-fullwidth-code-point-->number-is-nan;
-  js-yaml-->argparse;
-  js-yaml-->esprima;
-  jsdom-->abab;
-  jsdom-->acorn-globals;
-  jsdom-->acorn;
-  jsdom-->canvas;
-  jsdom-->cssom;
-  jsdom-->cssstyle;
-  jsdom-->data-urls;
-  jsdom-->decimal.js;
-  jsdom-->domexception;
-  jsdom-->escodegen;
-  jsdom-->form-data;
-  jsdom-->html-encoding-sniffer;
-  jsdom-->http-proxy-agent;
-  jsdom-->https-proxy-agent;
-  jsdom-->is-potential-custom-element-name;
-  jsdom-->nwsapi;
-  jsdom-->parse5;
-  jsdom-->saxes;
-  jsdom-->symbol-tree;
-  jsdom-->tough-cookie;
-  jsdom-->w3c-xmlserializer;
-  jsdom-->webidl-conversions;
-  jsdom-->whatwg-encoding;
-  jsdom-->whatwg-mimetype;
-  jsdom-->whatwg-url;
-  jsdom-->ws;
-  jsdom-->xml-name-validator;
-  levn-->prelude-ls;
-  levn-->type-check;
   libnpmaccess-->nock;
   libnpmaccess-->npm-package-arg;
   libnpmaccess-->npm-registry-fetch;
@@ -499,8 +437,6 @@ graph LR;
   make-fetch-happen-->promise-retry;
   make-fetch-happen-->socks-proxy-agent;
   make-fetch-happen-->ssri;
-  marked-man-->marked;
-  mime-types-->mime-db;
   minimatch-->brace-expansion;
   minipass-->yallist;
   minipass-collect-->minipass;
@@ -515,7 +451,6 @@ graph LR;
   minipass-sized-->minipass;
   minizlib-->minipass;
   minizlib-->yallist;
-  node-abi-->semver;
   node-gyp-->env-paths;
   node-gyp-->glob;
   node-gyp-->graceful-fs;
@@ -729,12 +664,6 @@ graph LR;
   npmlog-->gauge;
   npmlog-->set-blocking;
   once-->wrappy;
-  optionator-->deep-is;
-  optionator-->fast-levenshtein;
-  optionator-->levn;
-  optionator-->prelude-ls;
-  optionator-->type-check;
-  optionator-->word-wrap;
   p-map-->aggregate-error;
   pacote-->cacache;
   pacote-->fs-minipass;
@@ -756,55 +685,27 @@ graph LR;
   parse-conflict-json-->json-parse-even-better-errors;
   parse-conflict-json-->just-diff-apply;
   parse-conflict-json-->just-diff;
-  parse5-->entities;
   postcss-selector-parser-->cssesc;
   postcss-selector-parser-->util-deprecate;
-  prebuild-install-->detect-libc;
-  prebuild-install-->expand-template;
-  prebuild-install-->github-from-package;
-  prebuild-install-->minimist;
-  prebuild-install-->mkdirp-classic;
-  prebuild-install-->napi-build-utils;
-  prebuild-install-->node-abi;
-  prebuild-install-->npmlog;
-  prebuild-install-->pump;
-  prebuild-install-->rc;
-  prebuild-install-->simple-get;
-  prebuild-install-->tar-fs;
-  prebuild-install-->tunnel-agent;
   promise-retry-->err-code;
   promise-retry-->retry;
   promzard-->read;
-  pump-->end-of-stream;
-  pump-->once;
-  rc-->deep-extend;
-  rc-->ini;
-  rc-->minimist;
-  rc-->strip-json-comments;
   read-->mute-stream;
   read-package-json-->glob;
   read-package-json-->json-parse-even-better-errors;
   read-package-json-->normalize-package-data;
   read-package-json-->npm-normalize-package-bin;
   read-package-json-fast-->json-parse-even-better-errors;
   read-package-json-fast-->npm-normalize-package-bin;
-  readable-stream-->core-util-is;
   readable-stream-->inherits;
-  readable-stream-->isarray;
-  readable-stream-->process-nextick-args;
-  readable-stream-->safe-buffer;
   readable-stream-->string_decoder;
   readable-stream-->util-deprecate;
   readdir-scoped-modules-->debuglog;
   readdir-scoped-modules-->dezalgo;
   readdir-scoped-modules-->graceful-fs;
   readdir-scoped-modules-->once;
   rimraf-->glob;
-  saxes-->xmlchars;
   semver-->lru-cache;
-  simple-get-->decompress-response;
-  simple-get-->once;
-  simple-get-->simple-concat;
   smoke-tests-->minify-registry-metadata;
   smoke-tests-->npmcli-eslint-config["@npmcli/eslint-config"];
   smoke-tests-->npmcli-promise-spawn["@npmcli/promise-spawn"];
@@ -822,7 +723,6 @@ graph LR;
   spdx-expression-parse-->spdx-exceptions;
   spdx-expression-parse-->spdx-license-ids;
   ssri-->minipass;
-  string-width-->code-point-at;
   string-width-->emoji-regex;
   string-width-->is-fullwidth-code-point;
   string-width-->strip-ansi;
@@ -835,40 +735,16 @@ graph LR;
   tar-->minizlib;
   tar-->mkdirp;
   tar-->yallist;
-  tar-fs-->chownr;
-  tar-fs-->mkdirp-classic;
-  tar-fs-->pump;
-  tar-fs-->tar-stream;
-  tar-stream-->bl;
-  tar-stream-->end-of-stream;
-  tar-stream-->fs-constants;
-  tar-stream-->inherits;
-  tar-stream-->readable-stream;
-  tough-cookie-->psl;
-  tough-cookie-->punycode;
-  tough-cookie-->universalify;
-  tough-cookie-->url-parse;
-  tr46-->punycode;
-  tunnel-agent-->safe-buffer;
-  type-check-->prelude-ls;
   unique-filename-->unique-slug;
   unique-slug-->imurmurhash;
-  url-parse-->querystringify;
-  url-parse-->requires-port;
   validate-npm-package-license-->spdx-correct;
   validate-npm-package-license-->spdx-expression-parse;
   validate-npm-package-name-->builtins;
-  w3c-xmlserializer-->xml-name-validator;
   wcwidth-->defaults;
-  whatwg-encoding-->iconv-lite;
-  whatwg-url-->tr46;
-  whatwg-url-->webidl-conversions;
   which-->isexe;
   wide-align-->string-width;
   write-file-atomic-->imurmurhash;
   write-file-atomic-->signal-exit;
-  ws-->bufferutil;
-  ws-->utf-8-validate;
 ```
 
 ## npm dependency heirarchy
@@ -887,4 +763,4 @@ packages higher up the chain.
  - @npmcli/git, make-fetch-happen, @npmcli/config, init-package-json
  - @npmcli/installed-package-contents, @npmcli/map-workspaces, cacache, npm-pick-manifest, @npmcli/run-script, read-package-json, readdir-scoped-modules, promzard
  - @npmcli/docs, npm-bundled, read-package-json-fast, @npmcli/fs, unique-filename, npm-install-checks, npm-package-arg, npm-packlist, normalize-package-data, @npmcli/package-json, bin-links, nopt, npmlog, parse-conflict-json, dezalgo, read
- - ignore-walk, @npmcli/eslint-config, @npmcli/template-oss, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, semver, @npmcli/move-file, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, wrappy, treeverse, minify-registry-metadata, @npmcli/disparity-colors, @npmcli/ci-detect, mute-stream, ini, npm-audit-report, npm-user-validate
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, semver, @npmcli/move-file, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, wrappy, treeverse, minify-registry-metadata, @npmcli/disparity-colors, @npmcli/ci-detect, mute-stream, ini, npm-audit-report, npm-user-validate

docs/package.json

@@ -22,21 +22,19 @@
     "url": "https://github.com/npm/cli.git",
     "directory": "docs"
   },
-  "dependencies": {
+  "devDependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.7.1",
     "cmark-gfm": "^0.9.0",
     "front-matter": "^4.0.2",
     "ignore-walk": "^6.0.0",
     "jsdom": "^20.0.1",
     "marked-man": "^0.7.0",
     "mkdirp": "^1.0.4",
+    "tap": "^16.0.1",
     "yaml": "^2.1.3"
   },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.7.1",
-    "tap": "^16.0.1"
-  },
   "author": "GitHub Inc.",
   "license": "ISC",
   "files": [