Npm audit fix

[shaunthegeek]

No description provided.

[shaunthegeek]

project 当然要提交 lock，但 lib 是否应该提交 lock 文件？

NPM 官方未说明。https://docs.npmjs.com/cli/v7/configuring-npm/package-lock-json

composer 官方以前说：

Note: For libraries it is not necessarily recommended to commit the lock file

现在说：https://getcomposer.org/doc/02-libraries.md#lock-file

For your library you may commit the composer.lock file if you want to.

所以，随意提交。