package-lock.json is automatically generated for any operations where npm modifies either the node_modules tree, or package.json. It describes the exact tree that was generated, such that subsequent installs are able to generate identical trees, regardless of intermediate dependency updates.
These information are useless from a debian point of view, because version are managed by dpkg.
Moreover, package-lock.json feature to pin to some version dependencies is a anti feature of the debian way of managing package, and could lead to security problems in the likely case of debian solving security problems by patching instead of upgrading.
The tag is present in Lintian version
That is the most recent version we know about.
We use semantic versions.
The patch number is a commit step indicator relative to the
release tag in our Git