When you build Vaadin it generates two files: package.json and package-lock.json.
Do I need to persist them in my VCS (Git in my case)?
@NpmPackage annotations in Java sources.
package-lock.json is the means to provide a reproducible build. If you remove that, then the next build of the project might use different versions of some dependencies. In the worst case, the new versions have some bugs or compatibility problems and your project will no longer work.
It is therefore recommended to keep at least
package-lock.json in the repository. If you are doing that, then keeping
package.json also makes sense, as they kind of go hand in hand.