[jaquers]

How did you accomplish this practically? using '=' in package.json + shrinkwrap or vendoring in dependencies?

[davidmurdoch]

We bundle most, and ship npm-shrinkwrap.json for these ones we don't. The shrinkwrap is pruned (via a a custom script, not npm's prune command, because of reasons ) at publish time, as npm installs all dev dependencies if they exist in the shrinkwrap file (despite being marked as "dev": true in said shrinkwrap).