npm / picomatch

picomatch

What changed in picomatch 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

5 security6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

picomatch 411 changes

Fixes the security issue identified as CVE-2026-33671.
2.3.2, 3.0.2, 4.0.4release notes security advisory
Fixes the security issue identified as CVE-2026-33672.
2.3.2, 3.0.2, 4.0.4release notes security advisory
Picomatch has a ReDoS vulnerability via extglob quantifiers
2.3.2, 3.0.2, 4.0.4security advisory
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
2.3.2, 3.0.2, 4.0.4security advisory
Fixes the security issues identified as CVE-2026-33671 and CVE-2026-33672.
2.3.2, 3.0.2, 4.0.4release notes security advisory

Fixed handling of terminal globstars in parenthesized patterns.
4.0.7release notes
Returns complete pattern parts from scan.
4.0.6release notes
Scans the full pattern when tokens are requested.
4.0.6release notes
Rewriting risky repeated extglobs now preserves all branches.
4.0.5release notes
The windows option is now honored when matching basenames.
4.0.5release notes
Fixes an exception when a glob pattern contains a constructor.
2.3.2, 3.0.2, 4.0.3release notes release notes release notes