[pack] does not handle negations in package.json files property

[flash-me]

Bug description

Command

yarn pack

What is the current behavior?
Yarn pack also includes negated patterns when creating a package.
The files property in package.json allows to define what to include in our package when packing / publishing.
When using negation like !foo.js, yarn still will include foo.js into the package.

What is the expected behavior?
Yarn pack should handle negated globs correctly, like npm handles it.

Steps to Reproduce

# create package with two files
yarn init -y && touch include.me exclude.me
# add files property to package.json
sed -i 's/\(.*lic.*\)/\1,\n\t"files": ["include.me", "!exclude.me"]/' package.json
# pack & extract
yarn pack --filename foo.tgz && tar -xf foo.tgz
# list files in package
ls package/

Will contain include.me, exclude.me and package.json

Whereas npm pack --dry-run --verbose will not include the exclude.me file:

Environment

• Node Version: 12.14.1
• Yarn v1 Version: 1.22.x
• OS and version: Windows 10 Version 1909 (OS Build 19363.628)

[pixelastic]

To add to the severity of this issue, I had a !**/__tests__/ entry in my .files key to not release test files. It was working correctly with npm, but when packaged through yarn it actually released my whole directory to npm, including files and directory that were ignored by git.

Hopefully I didn't have any sensitive information (like .envrc files), but it still pushed a very large set of files to npm

[flash-me]

Same case happened to me, but luckily I was publishing to private registry

Cheers
flash ⚡

[brunohpaiva]

Any updates on this issue? I've faced the same situation that pixelastic wrote.

[merceyz]

Closing as fixed in v2

https://yarnpkg.com/getting-started/migration