glob
The classic and most widely used glob pattern matching library for Node.js. Finds files using glob patterns (*, **, ?, {a,b}, etc.) and returns matching file paths. Glob v10 is a complete rewrite with ESM-first support, async iterators, and modern API. Powers npm, webpack, Jest, ESLint, and most build tools that need file discovery. Also available as a CLI command.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Filesystem access library — runs with process permissions. Path traversal risk if patterns include user-controlled input (e.g., '../../../etc/passwd' via **). Sanitize glob patterns from untrusted input.
⚡ Reliability
Best When
You need to find files on disk matching glob patterns in Node.js build tools, test runners, or file processing scripts.
Avoid When
You need in-memory pattern matching without filesystem access (use micromatch), or are watching for file changes (use chokidar).
Use Cases
- • Find all TypeScript files in a project: glob('src/**/*.ts') for build system integration
- • Discover test files matching patterns for test runner configuration: glob('**/*.test.{js,ts}')
- • List files matching patterns in deployment scripts: copy all HTML files, exclude node_modules
- • Implement file watchers by first discovering existing files then combining with chokidar for new files
- • Process all files of a specific type in batch operations: glob('data/**/*.json') for data processing
Not For
- • In-memory pattern matching without filesystem — use micromatch or picomatch for string pattern matching without file I/O
- • File watching (change events) — use chokidar for watching file changes; glob is for static discovery
- • Very simple patterns in Node.js 22+ — native fs.glob() is now built-in for basic use cases
Interface
Authentication
No authentication — filesystem utility library.
Pricing
Fully free, ISC licensed.
Agent Metadata
Known Gotchas
- ⚠ glob v10 is ESM-only — use glob v9 or fast-glob for CommonJS projects; breaking change from v7/v8 which supported CJS
- ⚠ ** pattern matches zero or more path segments — 'src/**/*.ts' matches 'src/foo.ts' AND 'src/a/b/foo.ts'; verify patterns match expected depth
- ⚠ Patterns use forward slashes even on Windows — glob normalizes paths; don't mix OS-native backslashes in patterns
- ⚠ No matches returns empty array — glob never throws for no matches; check array length to distinguish 'pattern found nothing' from errors
- ⚠ Negation patterns: pass ignore option for exclusions — glob('**/*.js', { ignore: ['**/node_modules/**'] }); negation syntax (!) is supported in v10
- ⚠ Symlinks: glob follows symlinks by default — use follow: false to not follow symlinks if you have circular symlink structures that could cause infinite traversal
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for glob.
Scores are editorial opinions as of 2026-03-06.