Make note about releasing package-lock.json

docs/contributing.rst

@@ -187,7 +187,8 @@ To release a new version of the theme, core team will take the following steps:
 #. Run ``npm install && npm run build && python setup.py bdist_wheel sdist`` to rebuild all the theme assets and the Python
    package, notice that ``package-lock.json`` will be updated with a new package
    version. But take care that it isn't also bumping versions of dependencies
-   in ways that are risky to the release.
+   in ways that are risky to the release. *If* ``package-lock.json`` changes, you
+   need to commit it to git and tag it together with your release.
 #. Commit these changes.
 #. Tag the release in git: ``git tag $NEW_VERSION``.
 #. Push the tag to GitHub: ``git push --tags origin``.