Mongoose is a production dependency, not a dev dependency.
Add shrinkwrap to lock down npm dependencies.