[BUG] `bundleDependencies` symlinks are not included if packages are not in `package-lock.json`file

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If I install some local dependencies with npm install, and define them as bundle dependencies, and later overwrite the package-lock.json file with the previous one, when doing npm pack the bundle dependencies are not resolved nor included in the tarfile, no matter if the dependencies are defined in the package.json file or not.

Expected Behavior

bundle dependencies must be added in the tarfile as far as they are defined in the bundleDependencies array, no matter if they are defined or not at dependencies field or at package-lock.json file. At most, they should be added automagically in that file, but definitely they should not be ignored.

Steps To Reproduce

1. create a dependency package
2. create a sibling dependent package
3. install the dependency with npm install ../dependency-package
4. restore dependent package both package.json and package-lock.json files
5. add dependency package as a dependent package bundleDependency
6. run npm pack on dependent package

Both output of npm pack and tar -t shows that the dependency package is not included

Environment

• npm: 9.5.0
• Node.js: 19.7.0
• OS Name: Ubuntu 22.10
• System Model Name: Slimbook Executive
• npm config:

; "user" config from /home/piranna/.npmrc

//npm.pkg.github.com/:_authToken = (protected) 
//registry.npmjs.org/:_authToken = (protected) 
frame:apiServer = "127.0.0.1" 
frame:traverseNat = true 

; node bin location = /usr/bin/node
; node version = v19.7.0
; npm local prefix = /home/piranna/github/Mafalda/ROPE-server-CLI
; npm version = 9.5.0
; cwd = /home/piranna/github/Mafalda/ROPE-server-CLI
; HOME = /home/piranna
; Run `npm config ls -l` to show all defaults.

Reproduce the case using the sibling packages, restored package.json and package-lock.json, then run npm pack and tar -t as described. Trace how npm pack resolves bundleDependencies when the package is absent from package-lock.json and dependencies; done means the bundled dependency appears in the generated tarfile.