package-lock.json should not be committed
package-lock.json should not be committed

Module users will always get the latest version of our dependencies, so we should not trick ourselves into thinking things work by locking down our versions with a package-lock.json

package-lock.json only makes sense for apps, not modules.

feross/simple-peer