[email protected] default bundle retains pre-fix minimatch and brace-expansion copies

[email protected] has different dependency behavior between its default and raw entries:

require('glob')     -> dist/commonjs/index.min.js -> bundled dependencies
require('glob/raw') -> dist/commonjs/index.js     -> dependencies from node_modules

The default bundle's source map contains:

• minimatch source byte-identical to [email protected]
• brace-expansion source matching the affected 5.0.2/5.0.3 implementation

A fresh install on 2026-09-18 resolved patched external versions [email protected] and [email protected]. Those versions are used by glob/raw, but they do not replace the copies frozen inside the default bundle.

This leaves the default entry behind two already-public upstream fixes:

• minimatch nested-extglob backtracking, fixed in 10.2.3: https://github.com/advisories/GHSA-23c5-xmqv-rm74
• brace-expansion numeric-range allocation before max, fixed in 5.0.6: https://github.com/advisories/GHSA-jxxr-4gwj-5jf2

For example, the brace-expansion difference can be observed safely without walking the filesystem. In an empty directory:

npm install [email protected]

Save as check.cjs:

'use strict';

const entry = process.argv[2];
const { hasMagic } = require(entry);

global.gc?.();
const before = process.memoryUsage().heapUsed;
const started = process.hrtime.bigint();

hasMagic('{1..1000000}', { braceExpandMax: 10 });

console.log({
  entry,
  elapsedMs: Number(process.hrtime.bigint() - started) / 1e6,
  heapDeltaMiB: (process.memoryUsage().heapUsed - before) / 1024 / 1024,
});

Run each entry separately:

node --expose-gc check.cjs glob/raw
node --expose-gc check.cjs glob

Observed on my machine:

glob/raw: about 1.4 ms, 0.2 MiB additional heap
glob:     about 46 ms, 45 MiB additional heap

The same entry difference applies to the minimatch fix. With the nested extglob from its public advisory, glob/raw completed in about 32 ms while the default bundle remained CPU-bound until a bounded five-second timeout. The default entry did not load external minimatch during that run.

Could the default CommonJS and ESM bundles be regenerated with [email protected] or later and [email protected] or later, then published in a new glob release? Updating a consumer lockfile or override does not alter the dependency code already compiled into the published index.min.js files.