npm update seems to just update the packages in dependencies, but what about devDependencies.
Right now you can install
One (slow) way to do force the update, is to remove the node_modules directory, and then do npm install again.
This was a known bug of the npm update command, which has been fixed on the development branch of npm, see here:
https://github.com/isaacs/npm/pull/3863
It should land on the latest stable version of npm pretty soon.