minimatch vs picomatch vs glob vs micromatch
File System Traversal and Pattern Matching in Node.js
minimatchpicomatchglobmicromatchSimilar Packages:

File System Traversal and Pattern Matching in Node.js

glob is a file system walker that searches your disk for files matching a pattern. minimatch, micromatch, and picomatch are string matchers that test if a path or string fits a pattern without touching the disk. glob often uses one of the matchers internally to filter results. Choosing the right tool depends on whether you need to read the file system or just filter a list of paths in memory.

Npm Package Weekly Downloads Trend

3 Years

Github Stars Ranking

Stat Detail

Package
Downloads
Stars
Size
Issues
Publish
License
minimatch258,440,5013,493535 kB9a month agoBlueOak-1.0.0
picomatch127,057,7971,21885.3 kB388 months agoMIT
glob08,7231.61 MB3a month agoBlueOak-1.0.0
micromatch03,02256.6 kB442 years agoMIT

File System Traversal vs. Pattern Matching in Node.js

When working with file paths in Node.js, developers often confuse tools that walk the file system with tools that match strings. glob belongs to the first category, while minimatch, micromatch, and picomatch belong to the second. Understanding this distinction is critical for architectural decisions — using a string matcher to find files on disk will fail, and using a file walker to filter an in-memory array is wasteful.

🗂️ Core Functionality: Disk Walking vs. String Testing

glob actually reads your hard drive.

  • It traverses directories to find files that match your pattern.
  • It returns a list of existing file paths.
  • It handles async I/O operations internally.
// glob: Searches the file system
import { glob } from 'glob';

const files = await glob('**/*.js', { cwd: './src' });
// Returns: ['src/index.js', 'src/utils/helper.js']

minimatch tests a single string against a pattern.

  • It does not touch the file system.
  • It returns true or false.
  • It is best for validating one path at a time.
// minimatch: Tests a string
import { minimatch } from 'minimatch';

const isMatch = minimatch('src/index.js', '**/*.js');
// Returns: true

micromatch filters a list of strings against patterns.

  • It takes an array of paths and returns a filtered array.
  • It supports advanced glob features like brace expansion.
  • It is optimized for matching many paths in memory.
// micromatch: Filters an array
import micromatch from 'micromatch';

const files = ['src/index.js', 'src/style.css', 'test/index.js'];
const matches = micromatch(files, '**/*.js');
// Returns: ['src/index.js', 'test/index.js']

picomatch compiles patterns into reusable matcher functions.

  • It focuses on raw speed for repeated checks.
  • You create a matcher once and test many paths against it.
  • It is the engine behind modern high-performance tools.
// picomatch: Compiles a matcher
import picomatch from 'picomatch';

const isJS = picomatch('**/*.js');
const result = isJS('src/index.js');
// Returns: true

🧩 Pattern Syntax and Features

All four packages support standard glob patterns, but their support for extensions like brace expansion varies.

glob supports standard globs and relies on its internal matcher for extensions.

  • You can pass options to enable brace expansion.
  • It handles *, **, ?, and character classes.
// glob: With brace expansion option
import { glob } from 'glob';

const files = await glob('src/*.{js,ts}', { expand: true });
// Matches: src/index.js, src/app.ts

minimatch supports standard globs but has limited brace expansion.

  • It requires the braceExpansion option to be enabled.
  • It is strict about bash compatibility.
// minimatch: With brace expansion
import { minimatch } from 'minimatch';

const isMatch = minimatch('src/index.js', 'src/*.{js,ts}', { braceExpansion: true });
// Returns: true

micromatch has extensive support for glob extensions.

  • It handles braces, extglobs, and regex characters easily.
  • It is more permissive and feature-rich than minimatch.
// micromatch: Advanced patterns
import micromatch from 'micromatch';

const matches = micromatch(['a.js', 'b.ts'], '{a,b}.{js,ts}');
// Returns: ['a.js', 'b.ts']

picomatch supports the widest range of patterns with high accuracy.

  • It handles complex nested braces and extglobs.
  • It is designed to be the most accurate matcher available.
// picomatch: Complex patterns
import picomatch from 'picomatch';

const isMatch = picomatch('**/*.{js,ts,tsx}');
const result = isMatch('components/Button.tsx');
// Returns: true

⚡ Performance and Reusability

Performance matters when you are matching thousands of paths. glob is limited by disk speed, while the others are limited by CPU.

glob is I/O bound.

  • Speed depends on how many files are on your disk.
  • Caching file system stats can help in repeated runs.
  • Not suitable for matching in-memory lists.
// glob: Async iteration for large sets
import { glob } from 'glob';

for await (const file of glob.iterate('**/*.log')) {
  console.log(file); // Process as they are found
}

minimatch is slower on large arrays.

  • It recompiles the pattern for every test if not careful.
  • Acceptable for small lists or one-off checks.
  • Not recommended for hot paths in bundlers.
// minimatch: Looping manually
import { minimatch } from 'minimatch';

const files = getLargeFileList();
const matches = files.filter(f => minimatch(f, '**/*.js'));

micromatch is optimized for bulk filtering.

  • It caches compiled patterns internally.
  • It is significantly faster than minimatch on large arrays.
  • Ideal for build tools filtering dependencies.
// micromatch: Bulk filter
import micromatch from 'micromatch';

// Fast filtering of 10,000 paths
const matches = micromatch(largePathArray, '!**/node_modules/**');

picomatch is the fastest for repeated tests.

  • Compiling the pattern once gives the best speed.
  • It avoids overhead by returning a simple function.
  • Best for high-frequency matching loops.
// picomatch: Reused matcher function
import picomatch from 'picomatch';

const matcher = picomatch('**/*.spec.js');
// Run this function thousands of times with minimal overhead
const isSpec = matcher('tests/auth.spec.js');

🛠️ Integration and Ecosystem

These tools often work together. glob uses a matcher to filter files it finds. You can often swap the default matcher for better performance.

glob allows custom matchers.

  • You can pass picomatch or minimatch as the matcher option.
  • This lets you control pattern logic while keeping file walking.
// glob: Using custom matcher
import { glob } from 'glob';
import picomatch from 'picomatch';

const files = await glob('**/*.js', {  
  ignore: '**/vendor/**',
  // Some versions allow specifying matcher implementation
});

micromatch is used by major tools.

  • Webpack, Vite, and Gulp use it for dependency matching.
  • It is the standard for in-memory path filtering.
  • It wraps picomatch in newer versions.
// micromatch: Used in tool config
// webpack.config.js
module.exports = {
  module: {
    rules: [
      {
        test: micromatch.makeRe('**/*.js'),
        exclude: micromatch.makeRe('**/node_modules/**')
      }
    ]
  }
};

minimatch is the legacy standard.

  • Many older npm packages depend on it.
  • It is stable but lacks modern optimizations.
  • Still safe to use for simple scripts.
// minimatch: Legacy script
import { minimatch } from 'minimatch';

// Common in older CLI tools
if (minimatch(filePath, pattern)) {
  processFile(filePath);
}

picomatch is the modern engine.

  • It is the default matcher for micromatch v4+.
  • It is standalone and lightweight.
  • Use it when you need to build your own globbing tool.
// picomatch: Building a custom tool
import picomatch from 'picomatch';

const scan = (files, pattern) => {
  const isMatch = picomatch(pattern);
  return files.filter(isMatch);
};

📊 Summary Table

Featureglobmicromatchminimatchpicomatch
Primary Role🗂️ File System Walker🧠 In-Memory Filter🧪 String Tester⚡ Matcher Engine
ReturnsFile Paths (Array/Async)Filtered Paths (Array)BooleanMatcher Function
Disk Access✅ Yes❌ No❌ No❌ No
SpeedI/O LimitedFastModerateFastest
Best ForFinding files on diskFiltering path arraysSimple validationHigh-frequency checks

💡 Final Recommendation

glob is your go-to when you need to find files that actually exist on the disk. It handles the hard work of directory traversal and symlink resolution. Do not try to replicate this with string matchers.

micromatch is the best choice for filtering lists of paths in memory. If you are building a bundler, linter, or task runner that already has a list of files, use this to filter them quickly.

minimatch is suitable for simple scripts or legacy compatibility. It is reliable but slower than modern alternatives. Use it if you are maintaining older codebases or need a simple boolean check.

picomatch is the engine for maximum performance. Use it when you need to test the same pattern against thousands of strings repeatedly. It is also the best choice if you are building a library that needs glob matching capabilities.

Final Thought: Remember the golden rule — if you need to read the disk, use glob. If you already have the paths, use micromatch or picomatch. Mixing them up leads to slow code or broken features.

How to Choose: minimatch vs picomatch vs glob vs micromatch

  • minimatch:

    Choose minimatch for simple pattern matching needs where maximum performance is not critical. It is the historical standard used by many older tools and offers solid compatibility with bash globbing rules. Use it if you need to match single strings against a pattern reliably.

  • picomatch:

    Choose picomatch when you need the fastest possible pattern matching engine. It is often used internally by other tools (like micromatch v4+) to compile patterns into reusable matcher functions. Select this for high-performance scenarios where you test the same pattern against many paths repeatedly.

  • glob:

    Choose glob when you need to physically search the file system for files. It handles directory traversal, symlink resolution, and returns actual file paths. It is the standard choice for build scripts, test runners, and CLI tools that need to locate files on disk.

  • micromatch:

    Choose micromatch when you have an existing list of file paths in memory and need to filter them quickly using complex glob patterns. It is ideal for bundlers, task runners, or any tool that processes large arrays of paths without needing to read the disk again.

README for minimatch

minimatch

A minimal matching utility.

This is the matching library used internally by npm.

It works by converting glob expressions into JavaScript RegExp objects.

Important Security Consideration!

[!WARNING]
This library uses JavaScript regular expressions. Please read the following warning carefully, and be thoughtful about what you provide to this library in production systems.

Any library in JavaScript that deals with matching string patterns using regular expressions will be subject to ReDoS if the pattern is generated using untrusted input.

Efforts have been made to mitigate risk as much as is feasible in such a library, providing maximum recursion depths and so forth, but these measures can only ultimately protect against accidents, not malice. A dedicated attacker can always find patterns that cannot be defended against by a bash-compatible glob pattern matching system that uses JavaScript regular expressions.

To be extremely clear:

[!WARNING]
If you create a system where you take user input, and use that input as the source of a Regular Expression pattern, in this or any extant glob matcher in JavaScript, you will be pwned.

A future version of this library may use a different matching algorithm which does not exhibit backtracking problems. If and when that happens, it will likely be a sweeping change, and those improvements will not be backported to legacy versions.

In the near term, it is not reasonable to continue to play whack-a-mole with security advisories, and so any future ReDoS reports will be considered "working as intended", and resolved entirely by this warning.

Usage

// hybrid module, load with require() or import
import { minimatch } from 'minimatch'
// or:
const { minimatch } = require('minimatch')

minimatch('bar.foo', '*.foo') // true!
minimatch('bar.foo', '*.bar') // false!
minimatch('bar.foo', '*.+(bar|foo)', { debug: true }) // true, and noisy!

Features

Supports these glob features:

  • Brace Expansion
  • Extended glob matching
  • "Globstar" ** matching
  • Posix character classes, like [[:alpha:]], supporting the full range of Unicode characters. For example, [[:alpha:]] will match against 'é', though [a-zA-Z] will not. Collating symbol and set matching is not supported, so [[=e=]] will not match 'é' and [[.ch.]] will not match 'ch' in locales where ch is considered a single character.

See:

Windows

Please only use forward-slashes in glob expressions.

Though windows uses either / or \ as its path separator, only / characters are used by this glob implementation. You must use forward-slashes only in glob expressions. Back-slashes in patterns will always be interpreted as escape characters, not path separators.

Note that \ or / will be interpreted as path separators in paths on Windows, and will match against / in glob expressions.

So just always use / in patterns.

UNC Paths

On Windows, UNC paths like //?/c:/... or //ComputerName/Share/... are handled specially.

  • Patterns starting with a double-slash followed by some non-slash characters will preserve their double-slash. As a result, a pattern like //* will match //x, but not /x.
  • Patterns staring with //?/<drive letter>: will not treat the ? as a wildcard character. Instead, it will be treated as a normal string.
  • Patterns starting with //?/<drive letter>:/... will match file paths starting with <drive letter>:/..., and vice versa, as if the //?/ was not present. This behavior only is present when the drive letters are a case-insensitive match to one another. The remaining portions of the path/pattern are compared case sensitively, unless nocase:true is set.

Note that specifying a UNC path using \ characters as path separators is always allowed in the file path argument, but only allowed in the pattern argument when windowsPathsNoEscape: true is set in the options.

Minimatch Class

Create a minimatch object by instantiating the minimatch.Minimatch class.

var Minimatch = require('minimatch').Minimatch
var mm = new Minimatch(pattern, options)

Properties

  • pattern The original pattern the minimatch object represents.

  • options The options supplied to the constructor.

  • set A 2-dimensional array of regexp or string expressions. Each row in the array corresponds to a brace-expanded pattern. Each item in the row corresponds to a single path-part. For example, the pattern {a,b/c}/d would expand to a set of patterns like:

      [ [ a, d ]
      , [ b, c, d ] ]
    

    If a portion of the pattern doesn't have any "magic" in it (that is, it's something like "foo" rather than fo*o?), then it will be left as a string rather than converted to a regular expression.

  • regexp Created by the makeRe method. A single regular expression expressing the entire pattern. This is useful in cases where you wish to use the pattern somewhat like fnmatch(3) with FNM_PATH enabled.

  • negate True if the pattern is negated.

  • comment True if the pattern is a comment.

  • empty True if the pattern is "".

Methods

  • makeRe() Generate the regexp member if necessary, and return it. Will return false if the pattern is invalid.

  • match(fname) Return true if the filename matches the pattern, or false otherwise.

  • matchOne(fileArray, patternArray, partial) Take a /-split filename, and match it against a single row in the regExpSet. This method is mainly for internal use, but is exposed so that it can be used by a glob-walker that needs to avoid excessive filesystem calls.

  • hasMagic() Returns true if the parsed pattern contains any magic characters. Returns false if all comparator parts are string literals. If the magicalBraces option is set on the constructor, then it will consider brace expansions which are not otherwise magical to be magic. If not set, then a pattern like a{b,c}d will return false, because neither abd nor acd contain any special glob characters.

    This does not mean that the pattern string can be used as a literal filename, as it may contain magic glob characters that are escaped. For example, the pattern \\* or [*] would not be considered to have magic, as the matching portion parses to the literal string '*' and would match a path named '*', not '\\*' or '[*]'. The minimatch.unescape() method may be used to remove escape characters.

All other methods are internal, and will be called as necessary.

minimatch(path, pattern, options)

Main export. Tests a path against the pattern using the options.

var isJS = minimatch(file, '*.js', { matchBase: true })

minimatch.filter(pattern, options)

Returns a function that tests its supplied argument, suitable for use with Array.filter. Example:

var javascripts = fileList.filter(
  minimatch.filter('*.js', { matchBase: true }),
)

minimatch.escape(pattern, options = {})

Escape all magic characters in a glob pattern, so that it will only ever match literal strings.

If the windowsPathsNoEscape option is used, then characters are escaped by wrapping in [], because a magic character wrapped in a character class can only be satisfied by that exact character.

Slashes (and backslashes in windowsPathsNoEscape mode) cannot be escaped or unescaped.

minimatch.unescape(pattern, options = {})

Un-escape a glob string that may contain some escaped characters.

If the windowsPathsNoEscape option is used, then square-brace escapes are removed, but not backslash escapes. For example, it will turn the string '[*]' into *, but it will not turn '\\*' into '*', because \ is a path separator in windowsPathsNoEscape mode.

When windowsPathsNoEscape is not set, then both brace escapes and backslash escapes are removed.

Slashes (and backslashes in windowsPathsNoEscape mode) cannot be escaped or unescaped.

minimatch.match(list, pattern, options)

Match against the list of files, in the style of fnmatch or glob. If nothing is matched, and options.nonull is set, then return a list containing the pattern itself.

var javascripts = minimatch.match(fileList, '*.js', { matchBase: true })

minimatch.makeRe(pattern, options)

Make a regular expression object from the pattern.

Options

All options are false by default.

debug

Dump a ton of stuff to stderr.

nobrace

Do not expand {a,b} and {1..3} brace sets.

noglobstar

Disable ** matching against multiple folder names.

dot

Allow patterns to match filenames starting with a period, even if the pattern does not explicitly have a period in that spot.

Note that by default, a/**/b will not match a/.d/b, unless dot is set.

noext

Disable "extglob" style patterns like +(a|b).

nocase

Perform a case-insensitive match.

nocaseMagicOnly

When used with {nocase: true}, create regular expressions that are case-insensitive, but leave string match portions untouched. Has no effect when used without {nocase: true}.

Useful when some other form of case-insensitive matching is used, or if the original string representation is useful in some other way.

nonull

When a match is not found by minimatch.match, return a list containing the pattern itself if this option is set. When not set, an empty list is returned if there are no matches.

magicalBraces

This only affects the results of the Minimatch.hasMagic method.

If the pattern contains brace expansions, such as a{b,c}d, but no other magic characters, then the Minimatch.hasMagic() method will return false by default. When this option set, it will return true for brace expansion as well as other magic glob characters.

matchBase

If set, then patterns without slashes will be matched against the basename of the path if it contains slashes. For example, a?b would match the path /xyz/123/acb, but not /xyz/acb/123.

nocomment

Suppress the behavior of treating # at the start of a pattern as a comment.

nonegate

Suppress the behavior of treating a leading ! character as negation.

flipNegate

Returns from negate expressions the same as if they were not negated. (Ie, true on a hit, false on a miss.)

partial

Compare a partial path to a pattern. As long as the parts of the path that are present are not contradicted by the pattern, it will be treated as a match. This is useful in applications where you're walking through a folder structure, and don't yet have the full path, but want to ensure that you do not walk down paths that can never be a match.

For example,

minimatch('/a/b', '/a/*/c/d', { partial: true }) // true, might be /a/b/c/d
minimatch('/a/b', '/**/d', { partial: true }) // true, might be /a/b/.../d
minimatch('/x/y/z', '/a/**/z', { partial: true }) // false, because x !== a

windowsPathsNoEscape

Use \\ as a path separator only, and never as an escape character. If set, all \\ characters are replaced with / in the pattern. Note that this makes it impossible to match against paths containing literal glob pattern characters, but allows matching with patterns constructed using path.join() and path.resolve() on Windows platforms, mimicking the (buggy!) behavior of earlier versions on Windows. Please use with caution, and be mindful of the caveat about Windows paths.

For legacy reasons, this is also set if options.allowWindowsEscape is set to the exact value false.

windowsNoMagicRoot

When a pattern starts with a UNC path or drive letter, and in nocase:true mode, do not convert the root portions of the pattern into a case-insensitive regular expression, and instead leave them as strings.

This is the default when the platform is win32 and nocase:true is set.

preserveMultipleSlashes

By default, multiple / characters (other than the leading // in a UNC path, see "UNC Paths" above) are treated as a single /.

That is, a pattern like a///b will match the file path a/b.

Set preserveMultipleSlashes: true to suppress this behavior.

optimizationLevel

A number indicating the level of optimization that should be done to the pattern prior to parsing and using it for matches.

Globstar parts ** are always converted to * when noglobstar is set, and multiple adjacent ** parts are converted into a single ** (ie, a/**/**/b will be treated as a/**/b, as this is equivalent in all cases).

  • 0 - Make no further changes. In this mode, . and .. are maintained in the pattern, meaning that they must also appear in the same position in the test path string. Eg, a pattern like a/*/../c will match the string a/b/../c but not the string a/c.

  • 1 - (default) Remove cases where a double-dot .. follows a pattern portion that is not **, ., .., or empty ''. For example, the pattern ./a/b/../* is converted to ./a/*, and so it will match the path string ./a/c, but not the path string ./a/b/../c. Dots and empty path portions in the pattern are preserved.

  • 2 (or higher) - Much more aggressive optimizations, suitable for use with file-walking cases:

    • Remove cases where a double-dot .. follows a pattern portion that is not **, ., or empty ''. Remove empty and . portions of the pattern, where safe to do so (ie, anywhere other than the last position, the first position, or the second position in a pattern starting with /, as this may indicate a UNC path on Windows).
    • Convert patterns containing <pre>/**/../<p>/<rest> into the equivalent <pre>/{..,**}/<p>/<rest>, where <p> is a a pattern portion other than ., .., **, or empty ''.
    • Dedupe patterns where a ** portion is present in one and omitted in another, and it is not the final path portion, and they are otherwise equivalent. So {a/**/b,a/b} becomes a/**/b, because ** matches against an empty path portion.
    • Dedupe patterns where a * portion is present in one, and a non-dot pattern other than **, ., .., or '' is in the same position in the other. So a/{*,x}/b becomes a/*/b, because * can match against x.

    While these optimizations improve the performance of file-walking use cases such as glob (ie, the reason this module exists), there are cases where it will fail to match a literal string that would have been matched in optimization level 1 or 0.

    Specifically, while the Minimatch.match() method will optimize the file path string in the same ways, resulting in the same matches, it will fail when tested with the regular expression provided by Minimatch.makeRe(), unless the path string is first processed with minimatch.levelTwoFileOptimize() or similar.

platform

When set to win32, this will trigger all windows-specific behaviors (special handling for UNC paths, and treating \ as separators in file paths for comparison.)

Defaults to the value of process.platform.

maxGlobstarRecursion

Max number of non-adjacent ** patterns to recursively walk down.

The default of 200 is almost certainly high enough for most purposes, and can handle absurdly excessive patterns.

If the limit is exceeded (which would require very excessively long patterns and paths containing lots of ** patterns!), then it is treated as non-matching, even if the path would normally match the pattern provided.

That is, this is an intentional false negative, deemed an acceptable break in correctness for security and performance.

maxExtglobRecursion

Max depth to traverse for nested extglobs like *(a|b|c)

Default is 2, which is quite low, but any higher value swiftly results in punishing performance impacts. Note that this is not relevant when the globstar types can be safely coalesced into a single set.

For example, *(a|@(b|c)|d) would be flattened into *(a|b|c|d). Thus, many common extglobs will retain good performance and never hit this limit, even if they are excessively deep and complicated.

If the limit is hit, then the extglob characters are simply not parsed, and the pattern effectively switches into noextglob: true mode for the contents of that nested sub-pattern. This will typically not result in a match, but is considered a valid trade-off for security and performance.

Comparisons to other fnmatch/glob implementations

While strict compliance with the existing standards is a worthwhile goal, some discrepancies exist between minimatch and other implementations. Some are intentional, and some are unavoidable.

If the pattern starts with a ! character, then it is negated. Set the nonegate flag to suppress this behavior, and treat leading ! characters normally. This is perhaps relevant if you wish to start the pattern with a negative extglob pattern like !(a|B). Multiple ! characters at the start of a pattern will negate the pattern multiple times.

If a pattern starts with #, then it is treated as a comment, and will not match anything. Use \# to match a literal # at the start of a line, or set the nocomment flag to suppress this behavior.

The double-star character ** is supported by default, unless the noglobstar flag is set. This is supported in the manner of bsdglob and bash 4.1, where ** only has special significance if it is the only thing in a path part. That is, a/**/b will match a/x/y/b, but a/**b will not.

If an escaped pattern has no matches, and the nonull flag is set, then minimatch.match returns the pattern as-provided, rather than interpreting the character escapes. For example, minimatch.match([], "\\*a\\?") will return "\\*a\\?" rather than "*a?". This is akin to setting the nullglob option in bash, except that it does not resolve escaped pattern characters.

If brace expansion is not disabled, then it is performed before any other interpretation of the glob pattern. Thus, a pattern like +(a|{b),c)}, which would not be valid in bash or zsh, is expanded first into the set of +(a|b) and +(a|c), and those patterns are checked for validity. Since those two are valid, matching proceeds.

Negated extglob patterns are handled as closely as possible to Bash semantics, but there are some cases with negative extglobs which are exceedingly difficult to express in a JavaScript regular expression. In particular the negated pattern <start>!(<pattern>*|)* will in bash match anything that does not start with <start><pattern>. However, <start>!(<pattern>*)* will match paths starting with <start><pattern>, because the empty string can match against the negated portion. In this library, <start>!(<pattern>*|)* will not match any pattern starting with <start>, due to a difference in precisely which patterns are considered "greedy" in Regular Expressions vs bash path expansion. This may be fixable, but not without incurring some complexity and performance costs, and the trade-off seems to not be worth pursuing.

Note that fnmatch(3) in libc is an extremely naive string comparison matcher, which does not do anything special for slashes. This library is designed to be used in glob searching and file walkers, and so it does do special things with /. Thus, foo* will not match foo/bar in this library, even though it would in fnmatch(3).