pnpm publish produces different package contents than npm publish

[Techassi]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

8.7.0

Which area(s) of pnpm are affected? (leave empty if unsure)

CLI

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

Running pnpm -r publish --access public --no-git-checks --dry-run produces:

npm notice 
npm notice 📦  @my-company/my-package@0.0.6
npm notice === Tarball Contents === 
npm notice 782B   ./dist/index.cjs
npm notice 1.1kB  LICENSE         
npm notice 782B   dist/index.cjs  
npm notice 16.5kB dist/index.d.ts 
npm notice 846B   dist/index.js   
npm notice 1.3kB  package.json  

Running npm publish --workspaces --access public --dry-run produces:

npm notice 
npm notice 📦  @my-company/my-package@0.0.6
npm notice === Tarball Contents === 
npm notice 269B  README.md      
npm notice 1.3kB dist/index.cjs 
npm notice 2.7kB dist/index.d.ts
npm notice 1.6kB dist/index.js  
npm notice 1.3kB package.json 

Describe the Bug

What seems rather odd is that there are slight differences in which files are included in the final package:

• The license file is included only when using pnpm (not explicitly included)
• The readme file is included only when using npm (not explicitly included)
• The dist/index.cjs file is included twice with slightly different paths when using pnpm: ./dist/index.cjs and dist/index.cjs. This shouldn't affect the package contents, as both file paths refer to the same file.

Expected Behavior

The package contents are the same for both tools. Also, the same file is only included once instead of two (or more) times.

Which Node.js version are you using?

20.5.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

Arch

[await-ovo]

Could you share a repo to reproduce this issue? What I can see is that ./dist/index.cjs does appear twice, but LICNESE and README.md are the same whether it's npm publish or pnpm publish

[Techassi]

Sorry for the late response, but you can look at my repo here: https://github.com/vue-youtube/vue-youtube

[Techassi]

Any update on this?

[zkochan]

We need to update npm-packlist. I am working on it.

[Techassi]

Love to see that it got fixed now. pnpm in version 8.10.0 now produces the correct pack list.