I have a Rails application using React, Webpack, and Yarn for the client side. I have everything relating to the client side within the /client directory. This includes my yarn.
You can keep both package.json and yarn.lock by adding one of these to .slugignore.
It works like .gitignore - it just defines which files to ignore pushing to Heroku.
Check more information here