It's what I used to do with package-lock.json when I had little production experience.