If I upgrade using poetry with poetry update --lock pprp, I get nose and coverage installed as non-dev dependencies.

In a vanilla Python 3.7 virtualenv:

$ pip -q install pprp
$ pip freeze
coverage==5.2
nose==1.3.7
pprp==0.2.7

Is that expected behaviour?

I would expect them only to be test dependencies for the project itself, not pulled in for downstream projects that use pprp.

I think the change came as part of 90b3d0c, but I'm not very familiar with setup.py and packaging python libraries, so can't easily offer a code change to fix it.