Security News
JSR Working Group Kicks Off with Ambitious Roadmap and Plans for Open Governance
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
The picomatch npm package is a minimal matching utility that uses glob patterns to test, match, or parse strings. It is designed to be a faster and lighter alternative to other pattern matching libraries, with a focus on performance and accuracy.
Glob matching
Use picomatch to create a matcher function for glob patterns, which can then be used to test if strings match the pattern.
const picomatch = require('picomatch');
const isMatch = picomatch('*.js');
console.log(isMatch('file.js')); // true
console.log(isMatch('file.txt')); // false
Multiple patterns
Create a matcher function that can handle multiple patterns, including negation patterns, to match against strings.
const picomatch = require('picomatch');
const isMatch = picomatch(['*.js', '!foo.js']);
console.log(isMatch('file.js')); // true
console.log(isMatch('foo.js')); // false
Parse glob patterns
Parse glob patterns to analyze their structure and components, which can be useful for understanding the pattern or for further processing.
const picomatch = require('picomatch');
const result = picomatch.parse('*.js');
console.log(result);
Minimatch is a glob processing library that provides similar functionality to picomatch. It is widely used but is generally slower and less minimal than picomatch.
Micromatch is a more extensive glob matching library built on top of picomatch. It offers additional features and capabilities but is larger in size.
Fast-glob is a fast and efficient library for matching against file paths. It is optimized for file system operations and can handle a large number of patterns and files.
Node-glob is a glob implementation for Node.js that provides pattern matching and directory traversal. It is feature-rich but not as performant as picomatch for simple pattern matching tasks.
Blazing fast and accurate glob matcher written in JavaScript.
No dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
*
and ?
), globstars (**
) for nested directories, advanced globbing with extglobs, braces, and POSIX brackets, and support for escaping special characters with \
or quotes.See the feature comparison to other libraries.
Install with npm:
$ npm install --save picomatch
The main export is a function that takes a glob pattern and an options object and returns a function for matching strings.
const pm = require('picomatch');
const isMatch = pm('*.js');
console.log(isMatch('abcd')); //=> false
console.log(isMatch('a.js')); //=> true
console.log(isMatch('a.md')); //=> false
console.log(isMatch('a/b.js')); //=> false
Option | Type | Default value | Description |
---|---|---|---|
bash | boolean | false | Follow bash matching rules more strictly - disallows backslashes as escape characters. |
dot | boolean | false | Enable dotfile matching. By default, dotfiles are ignored unless a . is explicitly defined in the pattern, or options.dot is true |
expandBrace | function | undefined | Function to be called on brace patterns as an alternative to the built-in functionality. The function receives the entire brace pattern including the enclosing braces as its only argument, and it must return a string to be used in the generated regex. |
expandRange | function | undefined | Custom function for expanding ranges in brace patterns, such as {a..z} . The function receives the range values as two arguments, and it must return a string to be used in the generated regex. It's recommended that returned strings be wrapped in parentheses. This option is overridden by the braces option. |
failglob | boolean | false | Throws an error if no matches are found. Based on the bash option of the same name. |
flags | boolean | undefined | Regex flags to use in the generated regex. If defined, the nocase option will be overridden. |
ignore | array|string | undefined | One or more glob patterns for excluding strings that should not be matched from the result. |
keepQuotes | boolean | false | Retain quotes in the generated regex, since quotes may also be used as an alternative to backslashes. |
lookbehinds | boolean | true | Support regex positive and negative lookbehinds. Note that you must be using Node 8.1.10 or higher to enable regex lookbehinds. |
matchBase | boolean | false | If set, then patterns without slashes will be matched against the basename of the path if it contains slashes. For example, a?b would match the path /xyz/123/acb , but not /xyz/acb/123 . |
maxLength | boolean | 65536 | Limit the max length of the input string. An error is thrown if the input string is longer than this value. |
nobrace | boolean | false | Disabled brace matching. Thus, {a,b} and {1..3} would be treated as literals. |
nocase | boolean | false | Make matching case-insensitive. Equivalent to the regex i flag. Note that this option is overridden by the flags option. |
nodupes | boolean | true | Deprecated, use nounique instead. This option will be removed in a future major release. By default duplicates are removed. Disable uniquification by setting this option to false. |
noextglob | boolean | false | Disable support for matching with extglobs (like +(a|b) ) |
noglobstar | boolean | false | Disable support for matching nested directories with globstars (** ) |
nonegate | boolean | false | Disable support for negating with leading ! |
noquantifiers | boolean | false | Disable support for regex quantifiers (like a{1,2} ) and treat them as brace patterns to be expanded. |
normalize | boolean | false | Normalize returned paths to remove leading ./ |
posix | boolean | false | Support POSX character classes ("posix brackets"). |
prepend | boolean | undefined | String to prepend to the generated regex used for matching. |
strictBrackets | boolean | undefined | Throw an error if brackets, braces, or parens are imbalanced. |
strictSlashes | boolean | undefined | Strictly enforce leading and trailing slashes. |
unescapeRegex | boolean | undefined | Remove backslashes preceding escaped characters in the returned regular expression. By default, backslashes are retained. |
unixify | boolean | undefined | Convert all slashes in the list to match (not in the glob pattern itself) to forward slashes. |
Character | Description |
---|---|
* | Matches any character zero or more times, excluding path separators. Does not match path separators or hidden files or directories ("dotfiles"), unless explicitly enabled by setting the dot option to true . |
** | Matches any character zero or more times, including path separators. Note that ** will only match path separators (/ , and \\ on Windows) when they are the only characters in a path segment. Thus, foo**/bar is equivalent to foo*/bar , and foo/a**b/bar is equivalent to foo/a*b/bar , and more than two consecutive stars in a glob path segment are regarded as a single star. Thus, foo/***/bar is equivalent to foo/*/bar . |
? | Matches any character excluding path separators one time. Does not match path separators or leading dots. |
[abc] | Matches any characters inside the brackets. For example, [abc] would match the characters a , b or c , and nothing else. |
Picomatch's matching features and expected results in unit tests are based on Bash's unit tests and the Bash 4.3 specification, with the following exceptions:
foo/bar/baz
with *
. Picomatch only matches nested directories with **
.!(foo)*
should match foo
and foobar
, since the trailing *
bracktracks to match the preceding pattern. This is very memory-inefficient, and IMHO, also incorrect. Picomatch would return false
for both foo
and foobar
.POSIX classes are disabled by default. Enable this feature by setting the posix
option to true.
Enable POSIX bracket support
console.log(pm.makeRe('[[:word:]]+', { posix: true }));
//=> /^(?:(?=.)[A-Za-z0-9_]+\/?)$/
Supported POSIX classes
The following named POSIX bracket expressions are supported:
[:alnum:]
- Alphanumeric characters, equ [a-zA-Z0-9]
[:alpha:]
- Alphabetical characters, equivalent to [a-zA-Z]
.[:ascii:]
- ASCII characters, equivalent to [\\x00-\\x7F]
.[:blank:]
- Space and tab characters, equivalent to [ \\t]
.[:cntrl:]
- Control characters, equivalent to [\\x00-\\x1F\\x7F]
.[:digit:]
- Numerical digits, equivalent to [0-9]
.[:graph:]
- Graph characters, equivalent to [\\x21-\\x7E]
.[:lower:]
- Lowercase letters, equivalent to [a-z]
.[:print:]
- Print characters, equivalent to [\\x20-\\x7E ]
.[:punct:]
- Punctuation and symbols, equivalent to [\\-!"#$%&\'()\\*+,./:;<=>?@[\\]^_
{|}~]`.[:space:]
- Extended space characters, equivalent to [ \\t\\r\\n\\v\\f]
.[:upper:]
- Uppercase letters, equivalent to [A-Z]
.[:word:]
- Word characters (letters, numbers and underscores), equivalent to [A-Za-z0-9_]
.[:xdigit:]
- Hexadecimal digits, equivalent to [A-Fa-f0-9]
.See the Bash Reference Manual for more information.
If you wish to match the following special characters in a filepath, and you want to use these characters in your glob pattern, they must be escaped with backslashes or quotes:
Special Characters
Some characters that are used for matching in regular expressions are also regarded as valid file path characters on some platforms.
To match any of the following characters as literals: `$^*+?()[]
Examples:
console.log(pm.makeRe('foo/bar \\(1\\)'));
console.log(pm.makeRe('foo/bar \\(1\\)'));
Comparison to other libraries.
The following table shows which features are supported by minimatch, micromatch, picomatch, nanomatch, extglob, braces, and expand-brackets.
Feature | minimatch | micromatch | picomatch | nanomatch | extglob | braces | expand-brackets |
---|---|---|---|---|---|---|---|
wildcard matching (*?+ ) | ✔ | ✔ | ✔ | ✔ | - | - | - |
advancing globbing | ✔ | ✔ | ✔ | - | - | - | - |
brace matching | ✔ | ✔ | ✔ | - | - | ✔ | - |
brace expansion | ✔ | ✔ | - | - | - | ✔ | - |
extglobs | partial | ✔ | ✔ | - | ✔ | - | - |
posix brackets | - | ✔ | ✔ | - | - | - | ✔ |
regular expression syntax | - | ✔ | ✔ | ✔ | ✔ | - | ✔ |
file system operations | - | - | - | - | - | - | - |
minimatch: 4.230ms
picomatch: 2.123ms
Time it takes to return the first match, including require()
time:
console.log(require('minimatch').makeRe('**/*').test('foo/bar/baz/qux.js'));
// 9.275ms
console.log(require('picomatch').makeRe('**/*').test('foo/bar/baz/qux.js'));
// 7.429ms
Pull requests and stars are always welcome. For bugs and feature requests, please create an issue.
Please read the contributing guide for advice on opening issues, pull requests, and coding standards.
Running and reviewing unit tests is a great way to get familiarized with a library and its API. You can install dependencies and run tests with the following command:
$ npm install && npm test
(This project's readme.md is generated by verb, please don't edit the readme directly. Any changes to the readme must be made in the .verb.md readme template.)
To generate the readme, run the following command:
$ npm install -g verbose/verb#dev verb-generate-readme && verb
Jon Schlinkert
Copyright © 2018, Jon Schlinkert. Released under the MIT License.
FAQs
Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.
The npm package picomatch receives a total of 49,760,677 weekly downloads. As such, picomatch popularity was classified as popular.
We found that picomatch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.