Ah. I just saw that the regular requirement is pinned to a SHA. Cool. I would still like our dev dependency to be pinned as well.