`picomatch`

Ecosystem:
npm

Package URL:
pkg:npm/picomatch

Total PRs:
7,133 Dependabot PRs

Latest PR:
about 2 hours ago

Unique Repositories:
5,759 repositories

Unique Repos (30 days):
63 repositories

Security Advisories

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

GHSA-3v7f-55p6-f55p CVE-2026-33672 MODERATE published 7 months ago • updated 4 days ago

### Impact picomatch is vulnerable to a **method injection vulnerability (CWE-1321)** affecting the `POSIX_REGEX_SOURCE` object. Because the object...

4.0.5 → 4.0.7 Patch PR

Open about 2 hours ago 2 comments

Bump the npm_and_yarn group across 1 directory with 23 updates

Isuruvh/ms-identity-docs-code-javascript #9

2.3.1 → 2.3.2 Patch PR

Open about 6 hours ago 1 comment

Bump the npm_and_yarn group across 1 directory with 28 updates

Divyaansh313/Hacktoberfest #1

2.2.2 → 2.3.2 Minor PR

Closed about 9 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates

ai-shifu/remark-flow #50

2.3.1 → 2.3.2 Patch PR

Closed about 20 hours ago 2 comments

Bump the npm_and_yarn group across 1 directory with 9 updates

JaZo/guess-them-all #52

2.3.1 → 2.3.2 Patch PR

Closed 2 days ago 1 comment

chore(deps-dev): bump picomatch from 2.3.2 to 4.0.7

fabricjs/fabric.js #11192

2.3.2 → 4.0.7 Major PR

Closed 3 days ago 4 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 17 updates

wethegit/react-modal #168

2.3.1 → 2.3.2 Patch PR

Open 3 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 16 updates

sreyash3105/knotttoday #1

2.3.1 → 2.3.2 Patch PR

Open 3 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 17 updates

maninthebox235/codex #5

2.3.1 → 2.3.2 Patch PR

Open 4 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 16 updates

TolulopeBabajide/portfolio-website #8

4.0.3 → 4.0.7 Patch PR

Open 5 days ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 8 updates

b1rdmania/motif #16

2.3.1 → 2.3.2 Patch PR

Open 6 days ago 3 comments

Bump picomatch from 2.2.2 to 2.3.2

Mesitis/rfcs-tooling #2

2.2.2 → 2.3.2 Minor PR

Closed 8 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 5 updates

AmirulAndalib/d3 #31

2.3.1 → 2.3.2 Patch PR

Closed 8 days ago 1 comment

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 4 updates

cameronsjo/dev-encyclopedia #12

2.3.1 → 2.3.2 Patch PR

Open 9 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 9 updates

IAMJEHOVAH2/CopilotForXcode #20

4.0.2 → 4.0.7 Patch PR

Closed 10 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 15 directories with 14 updates

Sawsqr68/cli. #2

2.3.1 → 2.3.2 Patch PR

Open 12 days ago 1 comment

Bump the npm_and_yarn group across 3 directories with 13 updates

Sawsqr68/workbox #1

2.3.1 → 2.3.2 Patch PR

Open 12 days ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 11 updates

Sawsqr68/test-results-action #1

2.3.1 → 2.3.2 Patch PR

Open 12 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 8 updates

Sawsqr68/typescript #1

2.3.1 → 2.3.2 Patch PR

Open 12 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates

TW199501/CloakBrowser-Manager #8

4.0.3 → 4.0.7 Patch PR

Open 12 days ago 5 comments

Bump the npm_and_yarn group across 1 directory with 8 updates

Pekiskok25/CopilotForXcode #20

4.0.2 → 4.0.7 Patch PR

Closed 12 days ago 2 comments

Bump the npm_and_yarn group across 2 directories with 23 updates

jasonclarkagain/KimiAgentJacquelin-Memorial-Tribute-Site-2-1zip #2

4.0.3 → 4.0.7 Patch PR

Open 13 days ago 1 comment

chore: Bump the npm_and_yarn group across 1 directory with 3 updates

cnpm/packument #113

4.0.3 → 4.0.7 Patch PR

Closed 13 days ago 3 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 21 updates

GoogleChrome/lighthouse-ci #1165

2.2.2 → 2.3.2 Minor PR

Closed 13 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates

RemyLoveLogicAI/github-repo-mcp #7

2.3.1 → 2.3.2 Patch PR

Open 14 days ago 11 comments

Bump picomatch from 2.3.1 to 2.3.2

MartinDoyleUK/martindoyle-cli #6

2.3.1 → 2.3.2 Patch PR

Closed 14 days ago 4 comments

chore(deps): bump picomatch from 2.3.1 to 2.3.2

LicenseChain/LicenseChain-NodeJS-SDK #17

2.3.1 → 2.3.2 Patch PR

Closed 14 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 10 updates

0xsarawut/Open-Cap-Format-OCF #2

2.3.1 → 2.3.2 Patch PR

Open 15 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 6 updates

shashidhar-02/bluegreendeployment #6

2.3.1 → 2.3.2 Patch PR

Open 15 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates

Redevbionet/dashboard-vue #1

2.3.1 → 2.3.2 Patch PR

Open 18 days ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 17 updates

RemyLoveLogicAI/OpenDevin.OpenDevin #21

2.3.1 → 2.3.2 Patch PR

Open 19 days ago 10 comments

build(deps-dev): bump the development-tools group across 1 directory with 14 updates

mario-andreschak/FLUJO #1053

4.0.5 → 4.0.7 Patch PR

Closed 19 days ago 3 comments

Bump the npm_and_yarn group across 1 directory with 13 updates

theplenkov-forks/cds-types #2

2.3.1 → 2.3.2 Patch PR

Open 20 days ago 2 comments

build(deps): bump the security group across 2 directories with 23 updates

tkjaer/graft #32

2.3.1 → 2.3.2 Patch PR

Closed 21 days ago 2 comments

Bump the all group across 1 directory with 119 updates

tmykkanen/tauri-todo #15

4.0.5 → 4.0.7 Patch PR

Open 21 days ago 1 comment

chore(deps): Bump the npm_and_yarn group across 5 directories with 13 updates

ferni-ai/voiceai #436

2.3.1 → 2.3.2 Patch PR

Open 21 days ago 3 comments

Bump the npm_and_yarn group across 1 directory with 18 updates

MallamTeja/FullstackSchool #5

2.3.1 → 2.3.2 Patch PR

Open 23 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 17 updates

jmsmuigai/upili-app #1

2.3.1 → 2.3.2 Patch PR

Open 23 days ago 1 comment

Bump picomatch from 2.3.1 to 2.3.2

nqlp/cv-next #17

2.3.1 → 2.3.2 Patch PR

Open 25 days ago 1 comment

Bump the routine-npm group across 1 directory with 58 updates

hypark5540/discord-mcp #32

4.0.5 → 4.0.7 Patch PR

Closed 25 days ago 1 comment

build(deps): bump the npm-dependencies group with 56 updates

MohamedJebahi21/cinetrekker #59

4.0.4 → 4.0.7 Patch PR

Closed 25 days ago 2 comments

Bump the npm_and_yarn group across 2 directories with 27 updates

RemyLoveLogicAI/bitcoin-mcp #14

2.3.1 → 2.3.2 Patch PR

Open 26 days ago 9 comments

chore: bump picomatch from 2.3.2 to 4.0.7 in the major group across 1 directory

alrayyes/Hush-Hush #636

2.3.2 → 4.0.7 Major PR

Open 26 days ago 4 comments

build(deps): bump picomatch and @types/picomatch

123hehheyr/DTdsh #12

4.0.4 → 4.0.7 Patch PR

Open 27 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 13 updates

TomiToivio/eclipsephase #1

2.3.0 → 2.3.2 Patch PR

Closed 27 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 11 updates

Surge77/serverless_cloudflare #1

4.0.3 → 4.0.7 Patch PR

Open 27 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 6 updates

mabino/da-gnome #1

2.3.1 → 2.3.2 Patch PR

Closed 27 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 20 updates

Dargon789/Ethereumjs-Webserver #125

2.3.1 → 2.3.2 Patch PR

Open 27 days ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 12 updates

BoozeLee/terminal221b #7

2.3.1 → 2.3.2 Patch PR

Closed 28 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates

0xsarawut/eslint-config #1

2.3.1 → 2.3.2 Patch PR

Open 28 days ago 1 comment

Package Details

Name:	`picomatch`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/picomatch`
JSON API:	View JSON

Security Advisories

2

Active advisories

HIGH 1

MODERATE 1

View All npm Advisories

Package Information

Description:

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Repository:	https://github.com/micromatch/picomatch
Homepage:	https://github.com/micromatch/picomatch
Latest Release:	`4.0.2` over 2 years ago
Dependent Repos:	1,888,591
Dependent Packages:	2,541
Downloads:	476,678,823
Ranking:	Top 0.0171% by dependent repos Top 0.0046% by downloads Top 0.0315% by dependent pkgs

PR Status

Open 3,567 (50.0%)

Merged 5 (0.1%)

Closed 3,561 (49.9%)

PR Types

Major 121 (1.7%)

Minor 194 (2.7%)

Patch 6,805 (95.4%)

Removal 1 (0.0%)

picomatch

Security Advisories

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Picomatch has a ReDoS vulnerability via extglob quantifiers

Recent PRs

Package Details

Security Advisories

2

Package Information

PR Status

PR Types

`picomatch`