feat: switch to fast-glob

This removes `node-glob` in favor of `fast-glob`. The main motivation
for this is because `node-glob` has a security warning and I can't
update to `node-glob@9` unless we drop compatibility for node v8.

Switching to `fast-glob` seems to be fairly straightforward, although
some options need to be changed by default for bash compatibility.

Fixes #828
Fixes #1149

package.json

@@ -55,7 +55,7 @@
   },
   "dependencies": {
     "execa": "^1.0.0",
-    "glob": "^7.0.0",
+    "fast-glob": "^3.3.2",
     "interpret": "^1.0.0",
     "rechoir": "^0.6.2"
   },

src/common.js

@@ -6,7 +6,7 @@
 
 var os = require('os');
 var fs = require('fs');
-var glob = require('glob');
+var glob = require('fast-glob');
 var shell = require('..');
 
 var shellMethods = Object.create(shell);
@@ -262,7 +262,12 @@ function expand(list) {
     } else {
       var ret;
       try {
-        ret = glob.sync(listEl, {});
+        ret = glob.sync(listEl, {
+          // These options are just to make fast-glob be compatible with POSIX
+          // (bash) wildcard behavior.
+          onlyFiles: false,
+          followSymbolicLinks: false,
+        });
         // if nothing matched, interpret the string literally
         ret = ret.length > 0 ? ret : [listEl];
       } catch (e) {

src/ls.js

@@ -1,7 +1,7 @@
 var path = require('path');
 var fs = require('fs');
 var common = require('./common');
-var glob = require('glob');
+var glob = require('fast-glob');
 
 var globPatternRecursive = path.sep + '**';
 
@@ -105,13 +105,20 @@ function _ls(options, paths) {
     if (stat.isDirectory() && !options.directory) {
       if (options.recursive) {
         // use glob, because it's simple
-        glob.sync(p + globPatternRecursive, { dot: options.all, follow: options.link })
-          .forEach(function (item) {
-            // Glob pattern returns the directory itself and needs to be filtered out.
-            if (path.relative(p, item)) {
-              pushFile(item, path.relative(p, item));
-            }
-          });
+        glob.sync(p + globPatternRecursive, {
+          // These options are just to make fast-glob be compatible with POSIX
+          // (bash) wildcard behavior.
+          onlyFiles: false,
+
+          // These options depend on the cmdOptions provided to ls.
+          dot: options.all,
+          followSymbolicLinks: options.link,
+        }).forEach(function (item) {
+          // Glob pattern returns the directory itself and needs to be filtered out.
+          if (path.relative(p, item)) {
+            pushFile(item, path.relative(p, item));
+          }
+        });
       } else if (options.all) {
         // use fs.readdirSync, because it's fast
         fs.readdirSync(p).forEach(function (item) {