@babblebey @travi @gr2m would I be able to get a review on this PR? It's a bit difficult to keep it updated to avoid merge conflicts since rennovate is constantly updating the lockfile. Thanks!

The number of dependencies is not a problem, especially if both globby and and all of its sub dependencies are quite established and from @sindresorhus whom we know and trust.

tinyglobby seems to be widely used as well, but we would have to investigate thoroughly before we expose us to a new 3rd party injection attack vector. So I'm not saying no, we are just being careful

Yeah, it's good to be thoughtful about dependency changes. In case it helps, here are the top 10 packages using both libraries. Overall, I'd say that the most popular packages are leaning towards using tinyglobby, but globby has more downloads overall as it takes awhile for people to upgrade their packages and become aware of newer packages.

I'll also note that you don't have to just trust Sindre, but all 14 people who have access to publish globby or one of its dependencies as compared to only 6 for tinyglobby. I generally think that everyone involved in both packages and their dependencies is quite trustworthy, but am more worried about compromised machines/credentials. The more people with the ability to publish, the more attack surface area exists.

Great assessment, thank you for doing the research. Let me talk to @travi to have another set of eyes, but I'm in favor.

hey @gr2m, sorry it took me a little while to get back to this, but I've fixed the merge conflict now

🎉 This PR is included in version 11.0.6 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

🎉 This PR is included in version 12.0.0-beta.3 🎉

The release is available on:

• npm package (@beta dist-tag)
• GitHub release

Your semantic-release bot 📦🚀