While we have a pretty thorough process around security and license vetting for shipped dependencies, we don't currently hold our dev dependencies to the same standards and also assign Renovate PRs to the build cop (who might not have a whole lot of context on our dependencies) to auto-upgrade all of our dev dependencies.

One idea is that given the history of security incidents related to npm dev dependencies (e.g. event-stream), we should introduce guidelines and processes to either limit dev dependencies where possible, version-lock vetted dev dependencies, or have a re-vetting process for upgrading Renovate PRs. Publishing a custom version of our dependencies under our own amphtml npm namespace is also an idea to guard against left-pad-like issues.

Context:
https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos/
https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident

/cc @ampproject/wg-infra