`picomatch`

Ecosystem:
npm

Package URL:
pkg:npm/picomatch

Total PRs:
6,376 Dependabot PRs

Latest PR:
about 3 hours ago

Unique Repositories:
5,119 repositories

Unique Repos (30 days):
725 repositories

Security Advisories

Picomatch has a ReDoS vulnerability via extglob quantifiers

GHSA-c2c7-rcm5-vvqj CVE-2026-33671 HIGH published 2 months ago • updated 2 days ago

### Impact `picomatch` is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns usi...

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

GHSA-3v7f-55p6-f55p CVE-2026-33672 MODERATE published 2 months ago • updated 5 days ago

### Impact picomatch is vulnerable to a **method injection vulnerability (CWE-1321)** affecting the `POSIX_REGEX_SOURCE` object. Because the object...

Recent PRs

RSS Feed

Bump the npm_and_yarn group across 1 directory with 9 updates

usa-glitch/eat-group-asset #1

4.0.3 → 4.0.4 Patch PR

Open about 3 hours ago 1 comment

build(deps): Bump picomatch from 4.0.3 to 4.0.4 in /web

sydlexius/media-reaper #87

4.0.3 → 4.0.4 Patch PR

Open about 4 hours ago 5 comments

Bump the npm_and_yarn group across 1 directory with 14 updates

bobvarkey/diabetes-buddy #6

2.3.1 → 2.3.2 Patch PR

Open about 4 hours ago 1 comment

Bump picomatch from 2.3.1 to 2.3.2

BennettSchwartz/Codect #34

2.3.1 → 2.3.2 Patch PR

Open about 9 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 9 directories with 13 updates

nosportugal/codesandbox-client #19

2.2.2 → 2.3.2 Minor PR

Closed about 12 hours ago 1 comment

chore(deps): bump picomatch from 2.3.1 to 2.3.2 in /website

jarvis-terragon/hermes-agent #2

2.3.1 → 2.3.2 Patch PR

Closed about 13 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

choysum-dev/choysum #33

2.3.1 → 2.3.2 Patch PR

Open about 18 hours ago 1 comment

build(deps): Bump the npm_and_yarn group across 1 directory with 7 updates

botfusions/BOTCRm #3

4.0.3 → 4.0.4 Patch PR

Open about 20 hours ago 1 comment

Bump the npm_and_yarn group across 1 directory with 15 updates

adrianwedd/gpt4-pdf-chatbot-langchain #4

2.3.1 → 2.3.2 Patch PR

Open about 20 hours ago 2 comments

chore(deps): bump the npm_and_yarn group across 11 directories with 16 updates

Web3Auth/core #25

2.3.1 → 2.3.2 Patch PR

Closed about 21 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates

GlacierEQ/langgraph #9

2.3.1 → 2.3.2 Patch PR

Open 1 day ago 4 comments

build(deps): bump the npm_and_yarn group across 1 directory with 17 updates

c92d58/blog #2

2.3.1 → 2.3.2 Patch PR

Closed 1 day ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 13 updates

HarleyCoops/ai #1

2.3.1 → 2.3.2 Patch PR

Open 1 day ago 2 comments

build(deps): bump picomatch from 2.3.1 to 2.3.2 in /TrafficLightsEnhancement/UI in the npm_and_yarn group across 1 directory

mayor-modder/Cities2-TrafficLightsEnhancement-Extended #62

2.3.1 → 2.3.2 Patch PR

Closed 1 day ago 2 comments

build(deps): Bump the npm_and_yarn group across 1 directory with 10 updates

aref-vc/theme-generator #1

2.3.1 → 2.3.2 Patch PR

Open 1 day ago 1 comment

chore(deps): Bump the npm_and_yarn group across 1 directory with 6 updates

aref-vc/pod-explorer #1

4.0.3 → 4.0.4 Patch PR

Open 1 day ago 1 comment

chore(deps): bump picomatch

YDVPWebDevTeam/NTI_frontend #26

2.3.1 → 2.3.2 Patch PR

Open 1 day ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 11 updates

support371/whimsy-trade-bot #1

2.3.1 → 2.3.2 Patch PR

Open 1 day ago 2 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 6 updates

4xiaxia/opentu #10

2.3.1 → 2.3.2 Patch PR

Open 1 day ago 1 comment

build(deps-dev): bump picomatch from 2.3.0 to 2.3.2

maicol07/flarum_sso_wp_plugin #4

2.3.0 → 2.3.2 Patch PR

Open 1 day ago 1 comment

Bump the npm_and_yarn group across 1 directory with 22 updates

KoalaG/nsw-vic-border #30

2.2.2 → 2.3.2 Minor PR

Open 1 day ago 1 comment

chore(deps): bump the npm_and_yarn group across 8 directories with 22 updates

michaelhughes2501/ruflo #8

2.3.1 → 2.3.2 Patch PR

Closed 1 day ago 1 comment

Bump the npm_and_yarn group across 1 directory with 6 updates

laspearx/Whiskora #2

2.3.1 → 2.3.2 Patch PR

Closed 2 days ago 2 comments

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates

Tygo-van-den-Hurk/Slyde #33

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 3 directories with 13 updates

CommunityToolkit/Aspire #1354

4.0.2 → 4.0.4 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

John-Varghese-EH/Nizhal-AI #18

4.0.3 → 4.0.4 Patch PR

Open 2 days ago 1 comment

deps(deps): bump picomatch from 2.3.1 to 2.3.2

RBKunnela/paybot-mcp #28

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 6 updates

MomenMushtaha/worldcup-betting #3

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 2 directories with 14 updates

MomenMushtaha/worldcup-betting #1

2.3.1 → 2.3.2 Patch PR

Closed 2 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 5 directories with 19 updates

GlacierEQ/langgraphjs #10

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 4 comments

Bump the npm_and_yarn group across 1 directory with 21 updates

Bonniemarie216/streamlit #92

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 13 updates

HarleyCoops/gemini-google-extension #1

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 5 updates

fchastanet/my-documents #23

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

build(deps): bump the npm_and_yarn group across 3 directories with 21 updates

ahump20/gemini-cli #25

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 2 comments

build(deps-dev): bump picomatch from 2.3.1 to 2.3.2

Tom4U/koralle-dienste #23

2.3.1 → 2.3.2 Patch PR

Closed 2 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 8 updates

jianminy931020-coder/financeflow #1

4.0.3 → 4.0.4 Patch PR

Open 2 days ago 2 comments

Bump the npm_and_yarn group across 1 directory with 4 updates

markusknudtsen-droid/solana-improvement-documents #6

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 13 directories with 7 updates

danielbodnar/web-ai-demos #17

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 2 comments

npm(deps-dev): bump picomatch from 2.3.1 to 2.3.2

FreeForCharity/FFC-EX-friendsof362.org #12

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

build(deps): bump the npm_and_yarn group across 3 directories with 8 updates

Web8kameleon-hub/clisonix.com #76

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 2 comments

Bump the npm_and_yarn group across 2 directories with 21 updates

rorymclaughlin432/admin-dashboard-charts #2

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

npm(deps-dev): bump picomatch from 2.3.1 to 2.3.2

FreeForCharity/FFC-EX-technomonasteries.org #83

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 5 directories with 22 updates

michaelhughes2501/ruflo #4

2.3.1 → 2.3.2 Patch PR

Closed 2 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 21 updates

cosmiccareer/terminai #13

4.0.3 → 4.0.4 Patch PR

Closed 2 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates

Mostafa-SAID7/clothing-shop #158

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates

GlacierEQ/mcp-playwright #5

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 5 directories with 18 updates

vinnub143/QuarterBack_BackStage_Sec_Testing #54

2.3.1 → 2.3.2 Patch PR

Closed 2 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 3 directories with 7 updates

Metatronsdoob369/Domicile #36

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Build(deps): bump the npm_and_yarn group across 3 directories with 10 updates

alpro1000/STAVAGENT #1216

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Bump the npm_and_yarn group across 3 directories with 10 updates

ahump20/servers #7

2.3.1 → 2.3.2 Patch PR

Open 2 days ago 1 comment

Package Details

Name:	`picomatch`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/picomatch`
JSON API:	View JSON

Security Advisories

2

Active advisories

HIGH 1

MODERATE 1

View All npm Advisories

Package Information

Description:

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

Repository:	https://github.com/micromatch/picomatch
Homepage:	https://github.com/micromatch/picomatch
Latest Release:	`4.0.2` about 2 years ago
Dependent Repos:	1,888,591
Dependent Packages:	2,541
Downloads:	476,678,823
Ranking:	Top 0.0171% by dependent repos Top 0.0046% by downloads Top 0.0315% by dependent pkgs

PR Status

Open 3,227 (50.6%)

Merged 5 (0.1%)

Closed 3,144 (49.3%)

PR Types

Minor 167 (2.6%)

Major 95 (1.5%)

Patch 6,111 (95.8%)