minimatch is a glob matcher in JavaScript that converts glob expressions into regular expressions for pattern matching.
The library solves the problem of matching file paths and strings against glob patterns by translating bash-compatible glob syntax into JavaScript RegExp objects. This approach enables npm and other tools to perform glob matching natively in JavaScript environments. The tool supports standard glob features including brace expansion, extended glob matching, globstar double-asterisk patterns, and POSIX character classes that work across Unicode ranges.
Developers should adopt minimatch when they need reliable glob pattern matching in JavaScript without external dependencies. It suits projects that require bash-compatible glob semantics, particularly those handling file operations or pattern-based filtering. The library is production-tested through its use within npm itself. However, adopters must be aware of a critical security consideration: the library converts glob patterns to regular expressions, which makes it vulnerable to ReDoS attacks if patterns come from untrusted input. The README explicitly warns that any system accepting user-supplied glob patterns and passing them to this library will be compromised by a determined attacker. The maintainers have stated that future versions may use a different matching algorithm to address backtracking problems, but such changes will not be backported to existing versions. In the near term, ReDoS reports will be considered working as intended rather than bugs. On Windows, the tool requires forward-slashes only in glob expressions, though it handles UNC paths specially.
The project maintains active engagement with security concerns, documenting ReDoS limitations prominently rather than attempting incremental fixes. Development shows responsiveness to practical constraints, acknowledging that whack-a-mole security patching is unsustainable and signaling architectural changes for future versions. The codebase reflects careful consideration of edge cases, including Windows path handling and Unicode character class support.
