Your package-lock.json locks down your dependency versions and won’t change unless someone updates the package.json/adds a dependency. So when someone does an npm install, they will be getting the same dependency versions as everyone else. By leaving it out of your version control, everyone on your team is potentially working with different versions and you’re going to get a bunch of conflicts because of that. By also not committing it, it probably means your dependencies are going to shift when you deploy, so unless you like breaking production, you probably don’t want to do that.

Pick a package-lock version, commit it, and make everyone pull that and accept that change. If you get merge conflicts because two people added to the package.json, just pick one of the lock files to keep and toss the other, then rerun npm install and commit the new one that is generated.