@faker-js/faker ships as a production dependency

[iamgarriTech]

Faker is only needed by orm/Factory.js, which is a test/seed-time concern, but every production install pulls it in (it is a multi-megabyte package with large locale data). dotenv is similarly a host-application concern.