Picomatch is a JavaScript glob matcher that is described as fast and accurate, with no dependencies. It supports standard and extended Bash glob features like braces, extglobs, POSIX brackets, globstars, and regular expressions, and it can be used to create matcher functions for repeated matching of strings.
Project status
- The source appears actively maintained, with recent GitHub updates in August 2026 (last upstream push 2026-08-25, updates 4.0.7 and 4.0.6 dated 2026-08-24).
- The apparent update cadence is fairly regular in 2026, with 4.0.7 and 4.0.6 only minutes/hours apart, 4.0.5 about 7 weeks earlier, and 4.0.4 about 5 months earlier.
AI summary generated
Recent updates
4.0.7
picomatch 4.0.7 adds a parsing fix so that globstars at the logical end of patterns inside balanced parentheses are handled correctly. This specifically targets cases like test(/utils/**), ensuring the trailing /** can match the parent path segment as intended.
4.0.6
picomatch 4.0.6 updates the internal scan logic to correctly process glob patterns when tokenization is requested, and to return the complete set of pattern parts. The changes are localized to lib/scan.js and are accompanied by new/updated tests that cover token-driven part splitting and nested-group handling.
4.0.5
Release 4.0.5 fixes two matcher correctness issues: the “risky” repeated extglob rewrite no longer drops branches when rewriting into a ReDoS-safe form, and basename matching now properly honors the windows option. The diff shows corresponding test additions for both behaviors.
Security4.0.4
Release 4.0.4 is described as a security release that fixes CVE-2026-33671 and CVE-2026-33672. However, the diff shows additional functional and compatibility changes beyond those CVEs, including environment detection changes, new/extant glob safety behavior, and Node support policy updates.
BreakingSecurityFeatures3.0.2
Release 3.0.2 is described as a security-only patch that fixes multiple security relevant issues (including CVE-2026-33671 and CVE-2026-33672) and a reported exception involving glob patterns with a constructor. However, the actual code diff shows several behavioral and API changes beyond what is documented in the release notes.
BreakingSecurityFeatures2.3.2
Release 2.3.2 is presented as a security release addressing multiple glob-related issues, including CVE-2026-33671 and CVE-2026-33672. The code diff shows additional hardening in the glob parsing layer, including new logic that changes how certain risky extglobs are compiled by default.
SecurityFeatures4.0.3
Release 4.0.3 release notes only mention a fix for an exception when a glob pattern contains `constructor`. However, the actual diff shows a much larger underlying refactor across the project, including changes to platform/path handling, API behavior, and runtime requirements that are not described in the 4.0.3 notes.
Security4.0.2
Release 4.0.2 was published on 2024-03-28, but the publisher did not provide any release notes (no changes described). Without documented notes, there is no actionable information about new functionality, fixes, security changes, or migration steps for developers.
4.0.1
Release 4.0.1 was published on 2024-02-08, but the publisher did not provide any release notes or change details. As a result, there is no disclosed information about new features, bug fixes, security updates, or breaking changes in this release.
3.0.1
Release 3.0.1 was published on 2023-10-29, but no release notes were provided. As a result, there is not enough information here to determine what changed, whether any breaking changes occurred, or if there were fixes or security updates.
3.0.0
Release 3.0.0 is published, but no release notes were provided by the publisher. As a result, this analysis cannot confirm whether there are new features, breaking changes, bug fixes, security updates, or dependency changes in this version.
2.3.1
Picomatch 2.3.1 includes a targeted bug fix for negation extglobs where a pattern fragment following the closing parenthesis was incorrectly converted into a regular expression source. The release notes also mention only documentation improvements otherwise.
2.2.3
Release 2.2.3 contains two targeted fixes related to glob parsing, specifically around square bracket pattern separation and how negated extglobs are detected. The code changes are small and localized to the parser/lexer behavior plus updated tests.
2.2.2
Release 2.2.2 was published on 2020-03-21, but the publisher did not provide any release notes. As a result, no specific new features, breaking changes, bug fixes, security updates, or migration guidance can be confirmed from the provided information.