should package-lock.json be in version control