fix(glob): strip trailing slash from gitignore-derived ignore patterns

[Simon (simonhj)]

Summary

TL;DR Buggy glob pattern generation caused traversal of ignored trees.

• fast-glob silently discards ignore entries that end in / — the underlying micromatch matcher treats a trailing slash as a literal character that requires a matching trailing slash on the input path, and readdir entries never carry one. Validated this (to me non-obvious) behavior locally:

$ cat probe.mjs
import fg from 'fast-glob'

for (const pat of ['**/dist/', '**/dist', '**/dist/**']) {
  console.log(pat, await fg.glob(['**/*'], { cwd: 'fixture', ignore: [pat] }))
}

$ ls -T fixture/
fixture
├── a.txt
└── dist
    └── b.txt
$ node probe.mjs
**/dist/ [ 'a.txt', 'dist/b.txt' ]
**/dist [ 'a.txt' ]
**/dist/** [ 'a.txt' ]

• The standard gitignore convention of writing directory entries as dist/ arrives at fast-glob as **/dist/ after ignorePatternToMinimatch, so fast-glob walks the directory anyway and the result has to be filtered out post-walk — wasting a readdir of the entire subtree on every call.
• Strip the trailing slash before passing positives to fast-glob's ignore so the pattern actually matches.

Test plan

• New regression test: directory ignored via trailing-slash pattern is correctly excluded.
• All pre-existing globWithGitIgnore tests still pass (11 total: 10 existing + 1 new).
• pnpm check:tsc clean.
• `pnpm check:lint` clean on changed files.
• End-to-end: socket fix against a fixture with a 300 000-file gitignored dist/ and --max-old-space-size=128 no longer OOMs and proceeds past the glob walk in well under a second.

---

Note

Medium Risk
Changes globbing ignore behavior for gitignore-derived directory entries, which can alter which files are scanned/returned. Low implementation complexity, but impacts filesystem traversal and results in tooling that relies on globWithGitIgnore.

Overview
Fixes globWithGitIgnore so gitignore directory patterns written with a trailing slash (e.g. dist/) actually prevent fast-glob from walking those directories by normalizing ignore patterns via a new stripTrailingSlash helper.

Adds a regression test confirming that dist/ in .gitignore excludes files under dist/ from glob results.

^{Reviewed by Cursor Bugbot for commit ee42879. Configure here.}

[Martin Torp (mtorp)]

LGTM ✅ Thanks Simon (@simonhj)!

[John-David Dalton (jdalton)]

Thank you Simon (@simonhj). I'll update this in the @socketsecurity/lib for vNext versions.

[John-David Dalton (jdalton)]

Related to mrmlnc/fast-glob#437