Use yarn.lock or package-json.lock to lock dependency versions

[jivanvl]

I noticed that there's no package-json.lock or yarn.lock file in the repo, this could be a potential problem in the future. I can submit a PR to fix this, but I'm unsure what the maintainers want to use.

[Ovilia]

@Jivanvl Thanks! We will add a package-json.lock later.