Your team's practice of failing to commit lockfiles is risky and (as far as I know) uncommon. Commit your lockfiles. Their whole point is to reduce the risk of

Your team's practice of failing to commit lockfiles is risky and (as far as I know) uncommon. Commit your lockfiles. Their whole point is to reduce the risk of dependencies silently breaking your build. If you don't run tests in your production environment (and most people don't), then you need to commit a lockfile and use it when deploying.