minimatch is a minimal JavaScript glob matching utility. It converts glob expressions into JavaScript RegExp objects and is useful for testing paths against glob patterns, including features like brace expansion, extended globs, and `**` globstar matching. The project notes a security warning about ReDoS risk if patterns are derived from untrusted user input.
Project status
- Actively maintained: the latest upstream push and update were on November 2, 2026.
- Updates were clustered closely in late October, including several v11 updates within days; before that, the supplied history shows longer gaps.
AI summary generated
Recent updates
v11.0.5
The publisher provided no release notes. The diff adds compact matching for large numeric brace ranges, changes optimization-level-2 preprocessing to fail with RangeError when limits are exceeded, and replaces pairwise pattern deduplication with a more scalable approach that also fixes a matching bug.
BreakingFeaturesv11.0.4
minimatch v11.0.4 contains no documented release notes and no source-code changes in the supplied diff. The package version was bumped, and the declared minimum supported Node.js version changed from Node 18 to Node 20.
Breakingv11.0.3
No publisher release notes were provided for v11.0.3. The code adds a 256-entry least-recently-used cache for `minimatch()` and avoids constructing `Matcher` instances for brace-expansion rows that are merged; the repository changelog describes both as performance improvements.
Featuresv11.0.2
v11.0.2 has no publisher-provided release notes. The diff updates the package version and a runtime dependency, and reduces the Windows CI test matrix; it contains no source-code changes.
v11.0.1
The v11.0.1 publisher release notes are empty. The code adds limits to optimization-level-2 preprocessing to prevent large patterns from taking excessive time to compile, and updates the package version without changing dependencies.
v11.0.0
v11.0.0 replaces minimatch's regular-expression-based matching engine with a nonrecursive matcher and adds Unicode normalization support. The publisher provided no release notes; the repository changelog describes substantial API removals, matching behavior changes, and fixes, while the diff also adds a large benchmark suite.
BreakingSecurityFeaturesv10.2.6
Release v10.2.6 contains no published release notes. The provided diff shows no direct minimatch source changes, but it does include a runtime dependency bump (brace-expansion), plus CI, linting, and test expectation updates.
v10.2.5
Release v10.2.5 has no published release notes. The code diff shows a Windows-specific glob matching behavior fix related to how '..' segments are optimized/collapsed, plus several non-behavioral typing/linting/CI and dependency updates.
v9.0.9
No release notes were provided for v9.0.9. The code diff shows substantial internal changes to globstar and extglob parsing and matching behavior, plus new configuration knobs intended to mitigate worst-case performance.
BreakingSecurityFeaturesv7.4.9
Release v7.4.9 primarily changes the runtime matching behavior for Minimatch when the `partial` option is enabled, particularly around how `**` (globstar) segments are sliced and how match success is determined. It also updates README.md with a prominent ReDoS warning and refreshes package-lock.json with a large dependency churn.
Securityv8.0.7
v8.0.7 makes targeted changes to Minimatch's handling of globstar patterns when the { partial: true } option is enabled. The release notes field is empty (no publisher notes were provided), but the diff shows both a behavior change in matching logic and a new security warning added to the README.
Securityv9.0.8
Release v9.0.8 (published 2026-02-25) has no publisher release notes provided. The code diff shows a targeted change to Minimatch glob matching behavior when the { partial: true } option is enabled, along with expanded test coverage and a README documentation update.
v10.2.4
v10.2.4 appears to focus on improving glob matching behavior when the `partial` option is enabled, plus adding an explicit ReDoS security warning to the README. The release notes section is empty, so the functional changes seen in the code and tests are not documented.
Securityv7.4.8
Release v7.4.8 was published on 2026-02-25, but no release notes were provided. As a result, there is no documented information about new features, bug fixes, security updates, or breaking changes in this release.
v8.0.6
v8.0.6 is a major internal refactor of minimatch’s extglob handling, introducing a new AST-based recursive descent parser that changes how extglobs are compiled to regex. The publisher release notes are missing in the provided data, so the notable behavioral and platform changes below are effectively undocumented.
SecurityFeaturesv9.0.7
Release v9.0.7 makes substantial internal changes to glob parsing and matching (especially around globstar and extglob handling), and it also updates the package build and distribution setup. The release notes section provided here is empty, so the actual published behavior changes are not documented in the supplied notes.
SecurityFeaturesv10.2.3
Release v10.2.3 was published on 2026-02-25, but no release notes were provided by the publisher. As a result, no specific changes, fixes, or migration actions can be confirmed from the release notes.
v10.2.2
Release v10.2.2 has no release notes provided. The diff shown indicates this release is primarily a tooling and dependency/CI update (GitHub Actions workflows, package metadata, and npm lockfile), with no application or library source code changes included in the provided diff.
v10.2.1
v10.2.1 has no publisher release notes. The diff indicates a behavioral change in how minimatch translates glob patterns containing multiple consecutive '*' into regex, along with accompanying test snapshot updates and a new regression test for extremely long star sequences.
v10.2.0
Version v10.2.0 introduces a new `braceExpandMax` option to control how many `{...}` brace-expansion results can be produced. The provided release notes are empty, but the code and tests indicate brace expansion behavior is now capped, which can affect output for very large brace patterns. Most other changes shown in the diff are formatting and test refactoring.
Features