Skip to content

chore(deps-dev): bump glob from 13.0.6 to 14.0.2 - #2288

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/glob-14.0.2
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/glob-14.0.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

Bumps glob from 13.0.6 to 14.0.2.

Changelog

Sourced from glob's changelog.

changeglob

14

  • Use minimatch 11. Each portion of a pattern with magic is now matched with a Matcher from @isaacs/nonrecursive-glob-match in place of a RegExp, so patterns can no longer cause ReDoS. Matching follows the minimatch 11 changes, which are closer to Bash in some edge cases.
  • Pattern#pattern() returns a Matcher for a portion with magic. The MMPattern type is now minimatch's ParseReturnFiltered, and the new MMMatcher type is the Matcher part of it.
  • Rename Pattern#isRegExp() to isMatcher(), and Processor#testRegExp() to testMatcher().
  • Remove the debug option, which minimatch no longer has.
  • Add the normalize option, to normalize unicode in the pattern and in the file names that it is matched against.
  • GlobWalker#walk() and walkSync() return arrays in place of sets, and MatchRecord#entries() is removed.
  • ignore patterns that start with / now start at the same place as other patterns that start with /: the root option if set, or else the root of the cwd, such as C:\ on Windows.
  • ignore patterns follow the windowsPathsNoEscape option, the same as other patterns.
  • On Windows, patterns that start with a long UNC root like //?/UNC/host/share/ walk that share, the same as //host/share/.
  • Faster ignore patterns (about 1.2 to 3 times faster), and less work for each entry in a walk (about 10% faster sync, and 15% to 30% faster async, for large trees).
  • Allow const string[] or readonly string[] as ignore option or pattern argument.
  • When the signal aborts an async walk, the walk stops. Before, it rejected, but continued to read directories.

13

  • Move the CLI program out to a separate package, glob-bin. Install that if you'd like to continue using glob from the command line.

12

  • Remove the unsafe --shell option. The --shell option is now ONLY supported on known shells where the behavior can be implemented safely.

11.1

... (truncated)

Commits
  • 93957bf 14.0.2
  • 4682e8c fix: do not continue walking after signal abort
  • 668a669 14.0.1
  • 6ff2314 allow const/readonly string[] for ignore, patterns
  • bbe1e5d 14.0.0
  • d9586ad use actual published deps, not symlinks
  • 8b16637 handle long unc forms
  • 5bcdc65 extglobs cannot contain /
  • d8b40c2 handle root in platform-independent way, for ignores and patterns
  • 7d1c45a add native fs glob test (todo on failure)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 4, 2026
@dependabot
dependabot Bot temporarily deployed to test-trigger-is November 4, 2026 15:49 Inactive
@rugpanov

rugpanov commented Nov 4, 2026 •

Copy link
Copy Markdown
Contributor

🤖 Integration tests ❌ failed for 65efe7c6.
View run

Bumps [glob](https://github.com/isaacs/node-glob) from 13.0.6 to 14.0.2.
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v13.0.6...v14.0.2)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 14.0.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/glob-14.0.2 branch from 65efe7c to e3de662 Compare November 5, 2026 12:05
@dependabot
dependabot Bot temporarily deployed to test-trigger-is November 5, 2026 12:05 Inactive
@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/vscode

Inputs:

  • PR number: 2288
  • Commit SHA: e3de6626670b411f9c6311eabde21b045535ae01

Checks will be approved automatically on success.

This branch was previously deployed

1 inactive deployment
test-trigger-is — e3de6626 Deployed Nov 5, 2026 by dependabot[bot] via Check secrets access #2488
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant