[BUG] `npm pack` doesn't match directory prefiex (`dist-*` doesn't match `dist-cjs/index.js`)

[Caleb Everett]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

With npm 10 files: ["dist-*"] does not include dist-es or dist-es/index.js. This is changed from npm 8, not clearly documented, and inconsistent with other patterns.

Expected Behavior

I expect the same behavior as npm 8. I don't see anything in the change logs that would explain this difference.

https://docs.npmjs.com/cli/v9/using-npm/changelog#%EF%B8%8F-breaking-changes-2

npm pack now follows a strict order of operations when applying ignore rules. If a files array is present in the package.json, then rules in .gitignore and .npmignore files from the root will be ignored.

This bug occurs when there's only a files array, there's no .gitignore or .npmignore to ignore (or respect in npm 8)

Steps To Reproduce

Setup a test project

.
├── dist-cjs
│   └── index.js
├── dist-es
│   └── index.js
├── dist-other.js
└── package.json

# package.json
{ "name": "test", "version": "1.0.0" }

This test script will print the differences between files included by npm 8 and 10

#!/bin/bash
set -euo pipefail
patterns=('null'  '[]' '["*"]' '["dist-*"]' '["dist-**"]' '["dist-*/*.js"]')
for files in "${patterns[@]}"; do
  npm pkg set files="$files" --json
  echo "8 ($files)	10 ($files)	both"
  comm \
    <(npx npm@8 pack --dry-run --json | jq '.[].files[].path' -r) \
    <(npx npm@10 pack --dry-run --json | jq '.[].files[].path' -r)
done

Results

8 (null)            | 10 (null)            | both
                    |                      | dist-cjs/index.js
                    |                      | dist-es/index.js
                    |                      | dist-other.js
                    |                      | package.json
8 ([])              | 10 ([])              | both
                    |                      | package.json
8 (["*"])           | 10 (["*"])           | both
                    |                      | dist-cjs/index.js
                    |                      | dist-es/index.js
                    |                      | dist-other.js
                    |                      | package.json
8 (["dist-*"])      | 10 (["dist-*"])      | both
dist-cjs/index.js   |                      |
dist-es/index.js    |                      |
                    |                      | dist-other.js
                    |                      | package.json
8 (["dist-*/"])     | 10 (["dist-*/"])     | both
dist-cjs/index.js   |                      |
dist-es/index.js    |                      |
                    |                      | package.json
8 (["dist-**"])     | 10 (["dist-**"])     | both
dist-cjs/index.js   |                      |
dist-es/index.js    |                      |
                    |                      | dist-other.js
                    |                      | package.json
8 (["dist-**/"])    | 10 (["dist-**/"])    | both
dist-cjs/index.js   |                      |
dist-es/index.js    |                      |
                    |                      | package.json
8 (["dist-*/*.js"]) | 10 (["dist-*/*.js"]) | both
                    |                      | dist-cjs/index.js
                    |                      | dist-es/index.js
                    |                      | package.json

Environment

• npm: 10.7.0 (vs 8.19.4)
• Node.js: 22.00
• OS Name: Ubuntu
• System Model Name: N/A
• npm config:

; node bin location =~/.local/share/rtx/installs/node/22.0.0/bin/node
; node version = v22.0.0
; npm local prefix = /tmp/npm-pack-test
; npm version = 10.5.1
; cwd = /tmp/npm-pack-test
; HOME = ~
; Run `npm config ls -l` to show all defaults.

[Caleb Everett]

It seems like npm 10 will only treat exactly * as a directory wildcard, so * or lib/* will match directories, but dist-* or *.ts will only match files.

[Caleb Everett]

Okay, there's a closed npm/cli issue saying it's fixed #6164, and a npm-packlist issue tracking other packlist changes npm/npm-packlist#152

The fix they reference npm/npm-packlist#147 suggests that packlist should treat * the same as **, however dist-**/ doesn't match dist-es/index.js either.

[Caleb Everett]

interestingly dist-*/* does match and has the same packlist between 8 and 10.