I am new to Go and was wondering whether it's safe to commit the Gopkg.lock file in a VCS?
Yes, you should commit it. This file makes much less sense if everybody has his own version.
It makes the build reproducible from one developer to another, and more importantly it ensures the deployment build environnment won't use an unexpected set of dependency versions.