# What changed in minimatch

> 3 changes in minimatch 10 from its official release notes, upgrade guides and advisories: 3 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/minimatch/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## minimatch 10

### Security

- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (3.1.3 … 10.2.3) — [security advisory](https://github.com/advisories/GHSA-7R86-CG39-JMMJ)
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (3.1.4 … 10.2.3) — [security advisory](https://github.com/advisories/GHSA-23C5-XMQV-RM74)
- minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (3.1.3 … 10.2.1) — [security advisory](https://github.com/advisories/GHSA-3PPC-4F35-3M26)