minimatch

Eight versions of glob in one repo produced a year of mostly unexploitable security alerts

A TypeScript monorepo accumulated eight glob versions, seven of minimatch and three of brace-expansion, and the dozens of GitHub alerts they raised over twelve months were mostly ReDoS the code could not reach.