npm-packlist@1.4.4

Never include /.git in the package.  It creates packages that, once
installed, can not be easily removed.

Prevent .DS_Store files from being picked up if they are files rather
than folders.  (Note that a .DS_Store file in a specifically included
dir _will_ still be included.)

Don't bother walking node_modules in the root if no packages are
bundled.  (Saves thousands of lstat calls on npm publish in normal
cases.)

Sort package file lists in the tarball to optimize for gzip compression.

package.json

@@ -96,7 +96,7 @@
     "npm-install-checks": "~3.0.0",
     "npm-lifecycle": "^2.1.0",
     "npm-package-arg": "^6.1.0",
-    "npm-packlist": "^1.4.1",
+    "npm-packlist": "^1.4.4",
     "npm-pick-manifest": "^2.2.3",
     "npm-registry-fetch": "^3.9.0",
     "npm-user-validate": "~1.0.0",

test/tap/pack-files-and-ignores.js

@@ -484,7 +484,7 @@ test('default-ignored files can be explicitly included', function (t) {
     })
   )
   withFixture(t, fixture, function (done) {
-    t.ok(fileExists('.git'), '.git included')
+    t.notOk(fileExists('.git'), '.git should never be included')
     t.ok(fileExists('.svn'), '.svn included')
     t.ok(fileExists('CVS'), 'CVS included')
     t.ok(fileExists('.hg'), '.hg included')

test/tap/publish.js

@@ -125,8 +125,8 @@ test('npm publish --json', (t) => {
           name: 'publish-organized',
           version: '1.2.5',
           files: [
-            {path: 'package.json'},
-            {path: 'index.js'}
+            {path: 'index.js'},
+            {path: 'package.json'}
           ],
           entryCount: 2
         }, 'JSON output reflects package contents')
@@ -154,8 +154,8 @@ test('npm publish --dry-run --json', (t) => {
         name: 'publish-organized',
         version: '1.2.5',
         files: [
-          {path: 'package.json'},
-          {path: 'index.js'}
+          {path: 'index.js'},
+          {path: 'package.json'}
         ],
         entryCount: 2
       }, 'JSON output reflects package contents')