Is picomatch safe to use?

picomatch has no known vulnerabilities on the latest version (4.0.4). DepScope rates its health at 86/100 (low risk).

What is the latest version of picomatch?

The latest version of picomatch is 4.0.4, released 2026-03-23.

Does picomatch have known vulnerabilities?

No known vulnerabilities on the latest version of picomatch.

Is picomatch deprecated?

No, picomatch is actively maintained. Latest release: 4.0.4 (2026-03-23).

What are alternatives to picomatch?

Popular alternatives to picomatch in npm include: ?, semver, debug, ansi-styles, minimatch.

What license does picomatch use?

picomatch is licensed under MIT.

picomatch

npmv4.0.4

Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.

License MITpermissive32 versions4 maintainers0 deps362,033,070 weekly dl

micromatch/picomatch

/ 100

Health

safe to use

[email protected] is safe to use (health: 86/100)

Health breakdown0 – 100

20/25

maintenance

20/20

popularity

25/25

security

12/15

maturity

9/15

community

0/15

popularity_floor

Vulnerabilities

none known

Bundle & TypeScript

📦

Bundle Size

22.7 KBminified

8.2 KB gzipped

0 direct dependencies

🌟

TypeScript

7/10typed

Types from @types/picomatch (DefinitelyTyped)

OSS Scorecard

OpenSSF security posture score

6.2/10

moderate

Maintainer trust

Active maintainers (3m)

6

Contributors (12m)

8

Primary author dominance

58%

GitHub stars

1,250

Quality signals

OSS Criticality

0.85critical

Download trend

stable(+5%)

Publish security

npm signed

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/picomatch