[BUG] `npm pack` no longer auto-adds `npm-shrinkwrap.json` to tarball when `files` is specified

[zackschuster]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

As of v9, npm pack will no longer add npm-shrinkwrap.json to the generated tarball if you specify files within package.json without including npm-shrinkwrap.json in the specified array. This behavior is present in v10 as well.

Expected Behavior

The generated tarball should automatically include npm-shrinkwrap.json even if it is not included in a specified files array in package.json.

Steps To Reproduce

1. Create a package with npm init -y
2. Add a package (e.g. npm i react)
3. Run npm shrinkwrap
4. Add a files array to package.json
5. Run npm pack
6. The cli output will not list npm-shrinkwrap.json, nor will it be present in the tarball

Environment

• npm: 9.5.1
• Node.js: 18.16.1
• OS Name: macOS 12.6.8
• System Model Name: MacBook Pro (Retina, 13-inch, Early 2015)
• npm config:

update-notifier = false 

[ljharb]

Is npm-shrinkwrap.json explicitly listed in the files array?

I believe this was an intentional breaking change in v9 - explicit is better than implicit, so, just list it.

[zackschuster]

To me, the fact that a producer has to explicitly generate npm-shrinkwrap.json is enough of a signal that they want to publish the file; if they didn't, they could just stick with package-lock.json and achieve the same end more safely. I don't see a reason why someone would opt-in to a shrinkwrap otherwise, since it's an identical file but for the name. Its only independent value is that it's "allowed to be published", so I would think the expectation would be that it's always published if it exists.

[ljharb]

It can definitely be accidentally generated, and accidentally including it causes lot of problems.

[zackschuster]

I'm curious how it can be accidentally generated. As far as I know, it only shows up if you run npm shrinkwrap or manually create the file.

[ljharb]

I've accidentally published it when running npm shrinkwrap for testing purposes.

When using files, the only things that should be included are what's in files - with very very narrow exceptions, like package.json and readme.me.