// the find
isaacs/minimatch
a glob matcher in javascript
minimatch converts glob patterns to regular expressions and tests paths against them. It's the glob library npm uses internally, which tells you both its stability and its constraints. If you need bash-compatible glob matching in Node.js, this is the well-worn path.
The ReDoS mitigation strategy is honest — rather than pretending the problem is solved, the README documents exactly why it can't be fully solved with regex-based matching and sets explicit recursion limits that fail safe (false negative) rather than hanging. The `partial` option is genuinely useful for file-walker pruning, letting you skip entire directory trees early without walking them. Unicode POSIX character class support (e.g. `[[:alpha:]]` matching `é`) is something most glob libs quietly skip. The optimization levels are well-documented with concrete tradeoffs, so you can choose correctness vs. performance deliberately.
The fundamental architecture — glob-to-regex — means the ReDoS warning isn't a caveat, it's load-bearing. If you're matching user-supplied patterns, this library cannot be made safe; a different matching algorithm is needed and the README admits that's a future concern. The `maxExtglobRecursion` default of 2 is low enough to surprise people using complex extglobs in practice, and the fallback behavior (silently switching to noextglob mode) means patterns can fail without an error. Windows path handling works but requires forward-slash discipline from callers — easy to get wrong when constructing patterns from `path.join()` output on Windows without `windowsPathsNoEscape`.