It's something we can lock down with a shrinkwrap file, the same way we lock deps down with a composer lock file. Our current shrinkwrap implementation doesn't lock down dev-dependencies because the native Node shrinkwrap is a bit rubbish at handing dev-dependencies. We have a workaround in in the above branch which uses https://github.com/uber/npm-shrinkwrap via the `npm run lock` script.