# What changed in glob

> 2 changes in glob 10 to 11 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/glob/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## glob 11

### Security

- glob CLI: Command injection via -c/--cmd executes matches with shell:true (10.5.0, 11.1.0) — [security advisory](https://github.com/advisories/GHSA-5J98-MCP5-4VW2)

## glob 10

### Breaking changes

- Default exports are no longer available; use named exports instead. (10.0.0) — [release notes](https://github.com/isaacs/node-glob/blob/HEAD/changelog.md)