should package-lock.json be committed? - Theo's Typesafe Cult