Upgrading glob 10 to 11
Breaking10.5.0 → 11.1.0Security2Platform1New2
SecurityHigh · CVSS 7.5References security advisory GHSA-5j98-mcp5-4vw2 for this release.GHSA-5j98-mcp5-4vw2 · CVE-2025-64756 ↗
BreakingUpgrade verdict
A platform requirement change and 2 security fixes.
In plain terms
- This version no longer works on older versions of Node.js. You need Node.js 20 or newer.
- This version is linked to a security advisory, so upgrading is recommended.
- The CLI now handles commands containing spaces or quotes safely instead of running them through a shell.
Must act 3 items need code or config changes
Requires Node.js 20 || >=22 from 11.0.0 (none stated before).
Installs 17 packages in all (was 40).
What you must change
Security2
References security advisory GHSA-5j98-mcp5-4vw2 for this release.
High · CVSS 7.5Detects commands with space or quote characters on known shells and passes positional arguments safely, avoiding shell:true execution.
shell:truePlatform1
Drops support for Node.js versions before v20.