Library packages should not have pubspec.lock in source control.