should you version control package lock json