add shrinkwrap; npm shrinkwrap --dev

Keeps things predictable for releases, hotfixes, bisect.