minimatch

library10.2.5jsnpmunverified

Minimatch is a JavaScript utility library that provides robust glob matching functionality, converting glob expressions into JavaScript `RegExp` objects for efficient pattern matching. It is famously used internally by npm for its file system operations. The current stable version is 10.2.5, with releases typically occurring as needed to address bugs, enhance features, or align with npm's requirements. Key features include support for brace expansion, extended glob matching, globstar (`**`), and Posix character classes (e.g., `[[:alpha:]]`), which are Unicode-aware. A critical aspect of minimatch is its explicit warning regarding Regular Expression Denial of Service (ReDoS) vulnerabilities, advising users to never use untrusted input as glob patterns due to the inherent risks of RegExp-based matching. It also provides specific guidance for Windows users, emphasizing the exclusive use of forward slashes in glob expressions to avoid misinterpretation of backslashes as escape characters.

serialization devops

npm install minimatch

github ↗package ↗

INSTALL

IMPORT

SIG · MINIMATCH

minimatch

serializationjavascriptv10.2.5

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

minimatch

✓ import { minimatch } from 'minimatch'

✗ import minimatch from 'minimatch'

Minimatch is a named export, not a default export.

minimatch (CJS)

✓ const { minimatch } = require('minimatch')

✗ const minimatch = require('minimatch')

When using CommonJS require, the `minimatch` function is a named property of the module object, requiring destructuring.

Minimatch class

✓ import { Minimatch } from 'minimatch'

✗ import { minimatch } from 'minimatch'; new minimatch(...)

For advanced usage or pre-compiling patterns, the `Minimatch` class can be imported. The class name is capitalized.

Demonstrates basic glob matching, usage with options, and pre-compiling patterns with the `Minimatch` class, including Unicode-aware Posix character classes.

import { minimatch, Minimatch } from 'minimatch'; // Basic usage console.log(minimatch('foo/bar/baz.js', 'foo/**/baz.js')); // true console.log(minimatch('foo/bar/file.txt', '*.txt')); // false (needs path) console.log(minimatch('file.txt', '*.txt')); // true // With options: debug and nobrace const pattern = 'a/{b,c}/d'; const options = { debug: false, nobrace: false }; console.log(minimatch('a/b/d', pattern, options)); // true console.log(minimatch('a/c/d', pattern, options)); // true // Using the Minimatch class for pre-compiled patterns const mm = new Minimatch('src/**/*.ts', { matchBase: true }); console.log(mm.match('src/components/button.ts')); // true console.log(mm.match('dist/index.js')); // false // Example with Posix character classes (Unicode aware) console.log(minimatch('é', '[[:alpha:]]')); // true console.log(minimatch('123', '[[:digit:]]')); // false

Debug

Known issues

gotchaGlob patterns derived from untrusted user input can lead to Regular Expression Denial of Service (ReDoS) attacks due to the library's reliance on JavaScript regular expressions. This is an inherent risk for any RegExp-based matcher.

fix

Never use user-provided input directly as a glob pattern without rigorous sanitization or whitelisting. Consider alternative matching strategies for untrusted inputs that do not rely on RegExp.

affects: all

gotchaOn Windows, glob expressions must exclusively use forward slashes ('/') as path separators. Backslashes ('\') will always be interpreted as escape characters within patterns, leading to incorrect matching.

fix

Always normalize paths to use forward slashes (`/`) before passing them to minimatch as patterns. For example, use `path.posix.normalize(myPath)` or `myPath.replace(/\\/g, '/')` for pattern construction.

affects: all

breakingThis package requires Node.js version 18, 20, or greater than or equal to 22. Older Node.js versions are not supported.

fix

Upgrade your Node.js runtime to a compatible version (18, 20, or >=22) to use minimatch version 10 and above.

affects: <18.0.0

deprecatedFuture versions of minimatch may introduce a different matching algorithm to mitigate ReDoS. These improvements will NOT be backported to legacy versions. Any future ReDoS reports against older versions will be considered 'working as intended' due to inherent RegExp limitations.

fix

For the latest ReDoS mitigations (when available), upgrade to the newest major version of minimatch. Be aware that older versions will not receive such security updates.

affects: <10.0.0

Errors

Common errors & fixes

RangeError: Maximum call stack size exceeded

A complex or maliciously crafted glob pattern caused excessive backtracking in the underlying regular expression engine, leading to a ReDoS condition.

fix

Review glob pattern sources. If patterns originate from user input, implement strict sanitization or whitelisting. Avoid using complex patterns with untrusted input.

Glob pattern with backslashes on Windows does not match expected files.

On Windows, backslashes (`\`) in glob patterns are interpreted as escape characters, not path separators, causing patterns like `foo\bar` to match `foo\bar` exactly, not `foo/bar`.

fix

Ensure all glob patterns consistently use forward slashes (`/`) as path separators, even when running on Windows. Convert any `\` to `/` in the pattern string.

TypeError: minimatch is not a function OR TypeError: minimatch is not iterable

Attempting to use `minimatch` as a default import (e.g., `import minimatch from 'minimatch'`) or without destructuring in CommonJS (e.g., `const minimatch = require('minimatch')`).

fix

Use a named import for ESM: `import { minimatch } from 'minimatch'`. For CommonJS, use destructuring: `const { minimatch } = require('minimatch')`.

Upgrade

Version history

10.2.5latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

3 hits · last 30 days

node

Amazon

Resources

githubhttps://github.com/isaacs/minimatch ↗

packagehttps://www.npmjs.com/package/minimatch ↗