ignoring the package-lock.json