package-lock.json should be committed to git in order to have build reproducibility: https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-json