yarn.lock should be only updated by developers on their local machines by running yarn install. When we build the production version on a server, the yarn.lock file should not be updated. This is achieved by using the flag --frozen-lockfile.
So all yarn or yarn install commands in all server build scripts should be chaged to yarn install --frozen-lockfile