hardcoded devDependencies

To avoid bugs like #978