We use npm shrink-wrap, so this won't actually happen, unless someone kills the shrink-wrap file (which actually locks this (and everything else) in place to avoid just this from happening)