When dealing with dependencies I prefer having the lock file committed as it simplifies troubleshooting.