Acceptance Criteria (Required on creation):

Currently, transitive dev dependencies can override production dependencies in the license book. For instance, the package q is listed as version 1.4.1. However, the production dependency is defined as version 1.5.1.

Root Cause

The wrong node_modules folder is used: it tries to use the packages installed in the ee webapp instead of the packages installed under ee-webapp/node_modules/camunda-bpm-webapp/node_modules. I think we broke it when merging the ce webapp into the mono repo.
It's not clear to me why this problem did not bubble up more early. License book of 7.15 is the same if the fix is applied.