* We should:-   
  - https://stackoverflow.com/questions/44206782/do-i-commit-the-package-lock-json-file-created-by-npm-5   

* We shouldn't:-   
  - https://github.com/nodejs/citgm/issues/451   
  - https://dev.to/gajus/stop-using-package-lock-json-or-yarn-lock-3ddi   
  The origin of this misuse is NPM documentation. It should instead explain that package-lock.json should only be committed to the source code version control when the project is not a dependency of other projects, i.e. package-lock.json should only by committed to source code version control for top-level projects (programs consumed by the end user, not other programs).   
