You build the app with the dev dependencies, so you need to trust them as well.