[BUG] Negation of `files` is ignored in npm v7

[valtlai]

Current Behavior:

Negated patterns in the files array of package.json have no effect.

Expected Behavior:

Negated patterns should cause the matching files to be excluded from the published package.

Steps To Reproduce:

1. Add the following files array in package.json:

   "files": [
      "**/*.js",
      "!foo.js"
   ],

2. Create a foo.js file.

3. Run npm publish --dry-run.

4. See how the output incorrectly contains foo.js.

Environment:

• OS: macOS 10.15.7
• Node: 15.0.1
• npm: 7.0.3

[isaacs]

Ahhh, nice one.

The issue is that we're globbing each of these entries in parallel, but not maintaining the order when they come back. Bug in npm-packlist that I missed because the sync version used by the npm-packlist bin script doesn't suffer from this problem.

Good catch, will have a fix soon.

[isaacs]

Will be in the next npm v7 release.