--- title: "glob 14.0.3" description: "Latest published version of glob is 14.0.3, licensed BlueOak-1.0.0. Current as of our last registry check." url: https://inlinr.com/packages/glob lang: en --- [Packages](https://inlinr.com/packages) # glob 14.0.3 · 28 Oct 2026 BlueOak-1.0.0 535.7M / week [Repository](https://github.com/isaacs/node-glob) [Homepage](https://github.com/isaacs/node-glob#readme) [npm](https://www.npmjs.com/package/glob) [Atom feed](https://inlinr.com/packages/feed/glob) Your version ## Where each line stands [Plan an upgrade](https://inlinr.com/packages/glob/upgrade) LineNewestSecurity - 14.x 14.0.3 Safe from 14.0.2 Latest line - 13.x 13.0.6 1 open advisory, worst moderate [To 14.0.3](https://inlinr.com/packages/glob/upgrade/13.0.6-14.0.3) - 12.x 12.0.0 1 open advisory, worst moderate [To 14.0.3](https://inlinr.com/packages/glob/upgrade/12.0.0-14.0.3) - 11.x 11.1.0 1 open advisory, worst moderate [To 14.0.3](https://inlinr.com/packages/glob/upgrade/11.1.0-14.0.3) - 10.x 10.5.0 1 open advisory, worst moderate [To 14.0.3](https://inlinr.com/packages/glob/upgrade/10.5.0-14.0.3) - 9.x 9.3.5 1 open advisory, worst moderate · last release Apr 2023, no longer updated [To 14.0.3](https://inlinr.com/packages/glob/upgrade/9.3.5-14.0.3) ## What to use instead ## A better maintained package From the [e18e module-replacements](https://github.com/es-tooling/module-replacements) list, maintained by the community. The list compares the options for glob: [read the comparison](https://github.com/es-tooling/module-replacements/blob/main/docs/modules/glob.md). ## Before you switch 1. 1 Check what else depends on it Paste your package.json in the [dependency check](https://inlinr.com/tools/dependency-check) to see every deprecated or outdated package in one pass, not only this one. 2. 2 Read the replacement's peers and releases A native API or a few lines of code need no release notes, but check the Node version your project runs on. 3. 3 Know when it ships Follow the new package on inlinr: its releases and advisories land in your feed, and the time spent on the migration branch shows on its page. ## Latest releases [All 186 releases](https://inlinr.com/packages/glob/releases) 1. 14.x · latest line 2. 14.0.0 – 14.0.3 4 releases without a note Show each - [14.0.3](https://inlinr.com/packages/glob/releases/14.0.3 "Open this release") 28 Oct 2026 no note - [14.0.2](https://inlinr.com/packages/glob/releases/14.0.2 "Open this release") 27 Oct 2026 no note - [14.0.1](https://inlinr.com/packages/glob/releases/14.0.1 "Open this release") 27 Oct 2026 no note - [14.0.0](https://inlinr.com/packages/glob/releases/14.0.0 "Open this release") 27 Oct 2026 no note 3. 13.x · maintenance 4. 13.0.0 – 13.0.6 7 releases without a note Show each - [13.0.6](https://inlinr.com/packages/glob/releases/13.0.6 "Open this release") 19 Feb 2026 no note - [13.0.5](https://inlinr.com/packages/glob/releases/13.0.5 "Open this release") 17 Feb 2026 no note - [13.0.4](https://inlinr.com/packages/glob/releases/13.0.4 "Open this release") 17 Feb 2026 no note - [13.0.3](https://inlinr.com/packages/glob/releases/13.0.3 "Open this release") 12 Feb 2026 no note - [13.0.2](https://inlinr.com/packages/glob/releases/13.0.2 "Open this release") 10 Feb 2026 no note - [13.0.1](https://inlinr.com/packages/glob/releases/13.0.1 "Open this release") 3 Feb 2026 no note - [13.0.0](https://inlinr.com/packages/glob/releases/13.0.0 "Open this release") 19 Nov 2025 no note 5. 12.x · maintenance 6. ### [12.0.0](https://inlinr.com/packages/glob/releases/12.0.0 "Open this release") 17 Nov 2025 Dependency tracking · free for 3 projects ## Know when your own dependencies move glob had 2 security advisories in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it. - Advisories reach you An email when a critical or high advisory affects a project, before the next install. - Upgrades checked first Peer ranges, Node, ESM-only and types changes read before you bump. - Only what matters Majors and breaking notes stay; patches and sibling bumps fold into one line. [How dependency tracking works](https://inlinr.com/dependencies) ## Security [Details](https://inlinr.com/packages/glob/security) - [glob CLI: Command injection via -c/--cmd executes matches with shell:true](https://inlinr.com/advisories/GHSA-5j98-mcp5-4vw2) High · fixed in 11.1.0, 10.5.0 - [Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal](https://inlinr.com/advisories/GHSA-3g3m-2fjr-6pw4) Moderate · fixed in 14.0.2 ## Health [Details](https://inlinr.com/packages/glob/security#signals) - **Provenance**: - **Publisher**: - **Maintainers**: - **Scorecard**: - **Size**: ## Weekly downloads Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.