should i version package lock json