FEATURE: Separate production and development dependencies into distinct requirement files

[DewaldOosthuizen]

Summary

web/requirements.txt bundles pytest and pytest-cov alongside production dependencies (Flask, pymongo, bcrypt, PyJWT). The Docker image built from web/Dockerfile installs all of these, shipping test tooling into the production container, which increases image size and attack surface unnecessarily.

Background

Separating runtime and dev/test dependencies is a standard Python packaging convention. It also allows CI to install requirements-dev.txt while the production Docker build uses only requirements.txt, keeping the image lean.

Affected Areas

• web/requirements.txt — pytest entries on lines 8-9
• web/Dockerfile — pip install instruction
• CI workflow (if present) / README instructions

Recommended Fix

Create web/requirements-dev.txt:

-r requirements.txt
pytest==9.0.3
pytest-cov>=4.1

Remove pytest lines from web/requirements.txt. Update web/Dockerfile to only pip install -r requirements.txt. Update the README testing section to instruct developers to install requirements-dev.txt locally.

Acceptance Criteria

• web/requirements.txt contains only runtime dependencies
• web/requirements-dev.txt exists and pulls in pytest + pytest-cov
• web/Dockerfile installs only requirements.txt
• README updated with pip install -r web/requirements-dev.txt instruction for local testing
• All existing tests still pass after the split

Complexity Estimate

XS — file split and two-line Dockerfile edit.

Priority

Low — no runtime risk, but teaches a clean dependency hygiene pattern to tutorial readers.

---

Auto-identified by workspace issue-logger
Category: dependency upgrade
Complexity: XS
Repository: DewaldOosthuizen/python_rest_tutorial