https://www.atatus.com/blog/package-json-vs-package-lock-json/