{"id":11321,"library":"micromatch","title":"Micromatch Glob Matching Utility","description":"Micromatch is a comprehensive and highly performant JavaScript utility for glob matching, serving as a faster and more feature-rich alternative to older libraries like minimatch and multimatch. The current stable version is 4.0.8, actively maintained with regular updates to address bug fixes and security vulnerabilities. Key differentiators include its speed and extensive support for the Bash 4.3 specification, often surpassing Bash itself in terms of adherence to its glob test suite. It is widely adopted across the JavaScript ecosystem for file system operations, build tooling, and configuration management, providing a robust solution for pattern matching in both Node.js and browser environments.","status":"active","version":"4.0.8","language":"javascript","source_language":"en","source_url":"https://github.com/micromatch/micromatch","tags":["javascript","bash","bracket","character-class","expand","expansion","expression","extglob","extglobs"],"install":[{"cmd":"npm install micromatch","lang":"bash","label":"npm"},{"cmd":"yarn add micromatch","lang":"bash","label":"yarn"},{"cmd":"pnpm add micromatch","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Core dependency providing the underlying glob matching engine, enforced and updated in recent releases for bug fixes.","package":"picomatch","optional":false},{"reason":"Utility for brace expansion, used internally by micromatch.","package":"braces","optional":false}],"imports":[{"note":"ESM import for modern JavaScript environments. CommonJS `require` is also fully supported, as shown in the package's quickstart.","wrong":"const micromatch = require('micromatch');","symbol":"micromatch","correct":"import micromatch from 'micromatch';"},{"note":"isMatch is a property of the default micromatch export, not a named export. Ensure you import the default and access methods via dot notation.","wrong":"import { isMatch } from 'micromatch';","symbol":"micromatch.isMatch","correct":"import micromatch from 'micromatch';\nmicromatch.isMatch('file.js', '*.js');"},{"note":"For TypeScript projects, install `@types/micromatch` to get full type safety. The library ships with TypeScript support, allowing `import micromatch from 'micromatch';` to work correctly with types.","wrong":"import * as micromatch from 'micromatch'; // While sometimes works, less idiomatic for default exports","symbol":"micromatch (TypeScript types)","correct":"import micromatch from 'micromatch';\n// Type definitions are available via @types/micromatch"}],"quickstart":{"code":"import micromatch from 'micromatch';\n\n// Basic usage: filter a list of strings against glob patterns\nconst files = ['foo.txt', 'bar.js', 'baz.md', 'qux.ts', 'image.png'];\nconst jsAndMdFiles = micromatch(files, ['*.js', '*.md']);\nconsole.log('Matching .js and .md files:', jsAndMdFiles); // => ['bar.js', 'baz.md']\n\n// Using negation to exclude patterns\nconst allButJsFiles = micromatch(files, ['*', '!*.js']);\nconsole.log('All files except .js:', allButJsFiles); // => ['foo.txt', 'baz.md', 'qux.ts', 'image.png']\n\n// Boolean matching for a single string\nconst isSourceFile = micromatch.isMatch('src/index.ts', ['src/**/*.ts', 'src/**/*.tsx']);\nconsole.log('Is src/index.ts a source file?', isSourceFile); // => true\n\nconst isConfigFile = micromatch.isMatch('config.json', '**/config.json');\nconsole.log('Is config.json a config file?', isConfigFile); // => true","lang":"typescript","description":"This quickstart demonstrates basic glob matching, filtering lists of strings, using negation patterns, and performing boolean checks with micromatch. It covers common scenarios like selecting files by extension or excluding specific types, showcasing the flexibility of its API."},"warnings":[{"fix":"Review the official changelog for v4.0.0 and update your glob patterns and options usage accordingly. Ensure your Node.js version meets the minimum requirement.","message":"Micromatch v4.x introduced several breaking changes from v3.x, including a minimum Node.js requirement of `>=8.6`. The `micromatch.braces()` method no longer accepts an array of patterns, `strictErrors` was replaced by `strictBrackets=true`, and caching options/methods were removed.","severity":"breaking","affected_versions":">=4.0.0"},{"fix":"Use forward slashes (`/`) for path separators in glob patterns instead of backslashes (`\\`) to ensure consistent behavior across operating systems and to avoid unintended escape sequences. Escape literal backslashes with another backslash if needed.","message":"Upgrading from micromatch v2.x to v3.x changed how backslashes are handled. Previously, backslashes were converted to forward slashes; now they are respected as escape characters per Bash spec. This can alter matching behavior for existing patterns using backslashes.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Upgrade to micromatch `4.0.8` or newer immediately. Implement input validation for user-supplied glob patterns to reject overly complex or malformed inputs. Consider adding timeout mechanisms for pattern matching operations as a defensive measure.","message":"Micromatch 4.0.8 fixes CVE-2024-4067 and CVE-2024-4068, which are Regular Expression Denial of Service (ReDoS) vulnerabilities in the `micromatch.braces()` function. Maliciously crafted patterns with greedy regex or unclosed brace patterns could lead to catastrophic backtracking, causing severe performance degradation or application unresponsiveness.","severity":"gotcha","affected_versions":"<4.0.8"},{"fix":"If patterns that previously worked now fail or yield different results, double-check that your glob expressions are syntactically valid according to the Bash 4.3 specification and micromatch's documentation. Adjust patterns to be strictly correct.","message":"Due to parser accuracy improvements in v4, some previously 'invalid' glob patterns that might have worked by coincidence in older versions may now behave differently or fail. This is considered a correction, not a regression.","severity":"gotcha","affected_versions":">=4.0.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"Try installing with `--legacy-peer-deps` (`npm install micromatch --legacy-peer-deps`) or `--force` (`npm install micromatch --force`) as a temporary workaround, then investigate the underlying dependency tree to resolve conflicts properly.","cause":"Dependency conflict during installation, often due to peer dependency mismatches or incompatible package versions.","error":"npm ERR! code ERESOLVE"},{"fix":"Ensure `micromatch` is listed in your `package.json` and run `npm install` or `yarn install`. Verify the package exists in your `node_modules` directory and that your import path is correct (e.g., `import micromatch from 'micromatch';`).","cause":"The `micromatch` package was not installed or resolved correctly in your project.","error":"Error: Cannot find module 'micromatch'"},{"fix":"Use `import micromatch from 'micromatch';` and then call methods as `micromatch.isMatch(...)` or `micromatch.not(...)`. Do not attempt `import { isMatch } from 'micromatch';` as these are not named exports.","cause":"Incorrect import statement when using ESM, or attempting to destructure methods from the default import incorrectly. `micromatch` is the default export, and its utility methods are properties of that default export.","error":"TypeError: micromatch is not a function (for .isMatch or other methods)"},{"fix":"Always use forward slashes (`/`) as path separators in your glob patterns, even on Windows. If you need to match a literal backslash, you must escape it (e.g., `\\\\`).","cause":"From v3 onwards, micromatch treats backslashes as escape characters, not path separators. This is a change from v2 behavior.","error":"Patterns with backslashes behave unexpectedly or don't match correctly."}],"ecosystem":"npm"}