[BUG] `npm publish` ignores symbolic links

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I have a monorepo with several packages. One of the packages is the main package. I have symlinked its README.md file to the file in the root repository.

README.md -> ../../README.md
LICENSE.MIT
cli.js
index.js
package.json

However, when I tried to publish the package, npm did not include the README file:

=== Tarball Contents ===
LICENSE.MIT
cli.js
index.js
package.json

Expected Behavior

=== Tarball Contents ===
README.md
LICENSE.MIT
cli.js
index.js
package.json

Steps To Reproduce

npm init
touch test
ln -s test README.md
npm publish --dry-run

Environment

• npm: 9.8.1
• Node.js: v20.2.0
• OS Name: Arch Linux
• npm config:

foreground-scripts = true

; node bin location = /usr/bin/node
; node version = v20.2.0
; npm local prefix = /home/matheus/dev/npm-test
; npm version = 9.8.1
; cwd = /home/matheus/dev/npm-test
; HOME = /home/matheus

Reproduce the issue with the shown npm init, test file, symlinked README.md, and npm publish --dry-run commands. Inspect how the package contents are assembled from package.json and the README.md symlink; done means the dry-run tarball contents include README.md as shown in the expected output.