Remove yarn.lock from publish files

[styfle]

This was already ignored in .npmignore but was still published to npm due to files in package.json

[lfarrel6]

Is there any timeline on when this can be merged and included in a release?

The yarn.lock being included in the released package incorrectly triggers vulnerability scanners.

[styfle]

cc @garycourt

[MFTabriz]

I have complained about this to my poor colleague without knowing it’s your package that’s shipping this. You owe him an apology! 😉

[jorrit]

I think the entire files section can be removed. Most files it mentions are always included in the NPM package, even when not specified. Also, as this bug demonstrates, having .npmignore and files is confusing.

[prajwalmr62]

@garycourt can this be merged? We are also facing issues with vulnerability scanners due to this lock file.