package lock json git commit