Upgrade or switch from glob

[benmccann]

The current version of glob used has 26 dependencies. The latest version of glob has only 6 dependencies, tinyglobby has 2, or best yet use Node's built-in for 0 dependencies

[Eomm]

What if those deps save us from some injection?

I say that because I trust the glob's maintainer and his work.
In this scenario, the number of dependancies is not important for me.

or best yet use Node's built-in for 0 dependencies

This is not an option right now because we need to support Node.js 20

[benmccann]

That's why I also mentioned upgrading as a potential option. I didn't want to presume to know what your preference would be.

glob 12 had packages from 18 different maintainers and glob 13 has packages from only 1 maintainer, so if you want to rely on trusting him that's even more reason to upgrade and drop 17 other people from the dependency graph so you don't have to put so much trust in so many different people.

[mcollina]

We should just move to use the node core one. PRs are welcome ;).