I think requiring it as a dev dependency is good. It makes it install when `create-project` is used, but not when the app is installed in production.