Using patch-package without package-lock.json?

I don't like to keep package-lock.json in my project because it is a library, and I prefer to catch any in-range breaking updates for my end users.

Libraries should not freeze dependencies, because that defeats the purpose of semver and prevents NPM's ability to dedupe packages that are semver compatible.

Can we make patch-package work without a package-lock.json?

Surely an in-range update to a package could change the source code, which could prevent patch-package's application of patches.

Maybe this is ok, and with an option (f.e. something like `--no-lock`) then patch-package can try to patch dependencies, but throw a helpful error to console if it fails.

I suppose `patch-package` is better suited for applications, not libraries.