
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@flex-development/pathe
Advanced tools
Universal drop-in replacement for node:path
This package is a universal drop-in replacement for Node.js' path module.
It enforces consistency between POSIX and Windows operating systems and also provides additional utilities for working with file URLs, paths, and extensions.
For historical reasons, Windows followed MS-DOS and used backslashes (\) to separate path
components, as opposed to the forwardslashes (/) used by POSIX operating systems. Even though Windows operating
systems now support both separators, there are still discrepancies between operating systems when using Node.js' path
module:
The default operation of the
node:pathmodule varies based on the operating system on which a Node.js application is running. Specifically, when running on a Windows operating system, thenode:pathmodule will assume that Windows-style paths are being used. – Windows vs. POSIX
This package enforces consistency between operating systems by ensuring paths are POSIX-compliant. With support for both
drive and UNC paths as well, platform-specific modules like
node:path/posix and node:path/win32 are no longer needed.
To achieve consistent results when working with Windows file paths on any operating system, usepath.win32.To achieve consistent results when working with POSIX file paths on any operating system, usepath.posix.
To achieve consistent results when working with Windows file paths on any operating system, use pathe. To achieve
consistent results when working with POSIX file paths on any operating system, use pathe. :blush:
This package is ESM only.
In Node.js (version 18+) with yarn:
yarn add @flex-development/pathe
See Git - Protocols | Yarn  for details regarding installing from Git.
In Deno with esm.sh:
import { parse } from 'https://esm.sh/@flex-development/pathe'
In browsers with esm.sh:
<script type="module">
import { parse } from 'https://esm.sh/@flex-development/pathe'
</script>
import {
addExt,
basename,
changeExt,
cwd,
delimiter,
dirname,
dot,
extToValue,
extname,
fileURLToPath,
format,
formatExt,
isAbsolute,
isDeviceRoot,
isSep,
isURL,
join,
matchesGlob,
normalize,
parse,
pathToFileURL,
relative,
removeExt,
resolve,
resolveWith,
root,
sep,
toNamespacedPath,
toPath,
toPosix
} from '@flex-development/pathe'
This package exports the following identifiers:
addExtbasenamechangeExtcwddelimiterdirnamedotextToValueextnameextnamesfileURLToPathformatExtformatisAbsoluteisDeviceRootisSepisURLjoinmatchesGlobnormalizeparsepathToFileURLposixrelativeremoveExtresolveWithresolverootseptoNamespacedPathtoPathtoPosixwin32The default export is pathe.
Documentation website coming soon.
This package is fully typed with TypeScript.
CwdDelimiterDeviceRootDotDriveLetterEmptyStringExtFormatInputPathObjectParsedPathPathePlatformOptionsPlatformPathPosixDelimiterPosixPlatformPathPosixSepSepWindowsDelimiterWindowsPlatformPathWindowsSepSee CONTRIBUTING.md.
This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.
FAQs
Universal drop-in replacement for node:path
We found that @flex-development/pathe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.