glob - npm Package Compare versions

Comparing version 13.0.5 to 13.0.6

package.json

@@ -5,3 +5,3 @@ {
   "description": "the most correct and second fastest glob implementation in JavaScript",
-  "version": "13.0.5",
+  "version": "13.0.6",
   "type": "module",
@@ -77,8 +77,8 @@ "tshy": {
   "dependencies": {
-    "minimatch": "^10.2.1",
-    "minipass": "^7.1.2",
-    "path-scurry": "^2.0.0"
+    "minimatch": "^10.2.2",
+    "minipass": "^7.1.3",
+    "path-scurry": "^2.0.2"
   },
   "devDependencies": {
-    "@types/node": "^25.2.3",
+    "@types/node": "^25.3.0",
     "esbuild": "^0.27.3",
@@ -88,10 +88,7 @@ "memfs": "^4.50.0",
     "prettier": "^3.6.2",
-    "rimraf": "^6.1.0",
-    "tap": "^21.1.3",
-    "tshy": "^3.0.3",
-    "typedoc": "^0.28.14"
+    "rimraf": "^6.1.3",
+    "tap": "^21.6.1",
+    "tshy": "^3.3.2",
+    "typedoc": "^0.28.17"
   },
-  "tap": {
-    "before": "test/00-setup.ts"
-  },
   "license": "BlueOak-1.0.0",
@@ -102,4 +99,4 @@ "funding": {
   "engines": {
-    "node": "20 || >=22"
+    "node": "18 || 20 || >=22"
   }
 }

README.md

@@ -388,7 +388,28 @@ # Glob
 > [!NOTE]
-> `nocase` should only be explicitly set when it is
-> known that the filesystem's case sensitivity differs from the
-> platform default. If set `true` on case-sensitive file
-> systems, or `false` on case-insensitive file systems, then the
-> walk may return more or less results than expected.
+> `nocase` should only be explicitly set when it is known that
+> the filesystem's case sensitivity differs from the platform
+> default. If set `true` on case-sensitive file systems, or
+> `false` on case-insensitive file systems, then the walk may
+> return more or less results than expected.
+>
+> As a shortcut to avoid excessive `RegExp` creations, `Glob`
+> will use string portions as-is to `readdir()` calls while doing
+> its traversal. If you are setting a `nocase: true` match on a
+> file system that is in fact case sensitive, then this will
+> result in matches not being found that you might expect,
+> because for example the pattern `Foo/*` will fail to read the
+> `FOO/` or `foo/` directories.
+>
+> On the other hand, if you set `nocase: false` on a
+> case-_insensitive_ system, then the opposite problem occurs:
+> `Foo/*` will match `foo/bar`, but because we only detect the
+> existence of the `foo/` folder by successfully performing a
+> `readdir`, there's no way to know what the "real" case is, and
+> the match will be reported as `Foo/bar`, using the case of the
+> string portion of the glob pattern.
+>
+> The default is usually correct, however it _is_ possible to
+> mount file systems with a different case-sensitivity from the
+> host system. If you know this is the case, set this flag
+> appropriately to the file system you are searching.
 
@@ -552,2 +573,7 @@ - `maxDepth` Specify a number to limit the depth of the directory
 
+- `braceExpandMax` number, defaults to `10_000`. This is the
+  maximum number of `{x,y,...}` patterns to expand. It is very
+  unlikely that you'll need more than this, and setting it higher
+  exposes the system to out-of-memory errors.
+
 ## Glob Primer
@@ -554,0 +580,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1607230

0.11%

Lines of code

4868

0.04%

Number of lines in readme file

1204

2.21%

Dependency changes

• Updated

  minimatch@^10.2.2

• Updated

  minipass@^7.1.3

• Updated

  path-scurry@^2.0.2