lock down devDependencies too