# What changed in picomatch

> 11 changes in picomatch 4 from its official release notes, upgrade guides and advisories: 5 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/picomatch/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## picomatch 4

### Security

- Fixes the security issue identified as CVE-2026-33671. (2.3.2, 3.0.2, 4.0.4) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.4), [security advisory](https://github.com/advisories/GHSA-C2C7-RCM5-VVQJ)
- Fixes the security issue identified as CVE-2026-33672. (2.3.2, 3.0.2, 4.0.4) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.4), [security advisory](https://github.com/advisories/GHSA-3V7F-55P6-F55P)
- Picomatch has a ReDoS vulnerability via extglob quantifiers (2.3.2, 3.0.2, 4.0.4) — [security advisory](https://github.com/advisories/GHSA-C2C7-RCM5-VVQJ)
- Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching (2.3.2, 3.0.2, 4.0.4) — [security advisory](https://github.com/advisories/GHSA-3V7F-55P6-F55P)
- Fixes the security issues identified as CVE-2026-33671 and CVE-2026-33672. (2.3.2, 3.0.2, 4.0.4) — [release notes](https://github.com/micromatch/picomatch/releases/tag/2.3.2), [security advisory](https://github.com/advisories/GHSA-C2C7-RCM5-VVQJ)

### Fixes and other changes

- Fixed handling of terminal globstars in parenthesized patterns. (4.0.7) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.7)
- Returns complete pattern parts from scan. (4.0.6) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.6)
- Scans the full pattern when tokens are requested. (4.0.6) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.6)
- Rewriting risky repeated extglobs now preserves all branches. (4.0.5) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.5)
- The windows option is now honored when matching basenames. (4.0.5) — [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.5)
- Fixes an exception when a glob pattern contains a constructor. (2.3.2, 3.0.2, 4.0.3) — [release notes](https://github.com/micromatch/picomatch/releases/tag/3.0.2), [release notes](https://github.com/micromatch/picomatch/releases/tag/2.3.2), [release notes](https://github.com/micromatch/picomatch/releases/tag/4.0.3)