package lock json git or not