Add expandNegationOnlyPatterns option

Fixes #274

Author: sindresorhus

index.d.ts

@@ -63,6 +63,28 @@ export type Options = {
 	*/
 	readonly ignoreFiles?: string | readonly string[];
 
+	/**
+	When only negation patterns are provided (e.g., `['!*.json']`), automatically prepend a catch-all pattern (`**\/*`) to match all files before applying negations.
+
+	Set to `false` to return an empty array when only negation patterns are provided. This can be useful when patterns are user-controlled, to avoid unexpectedly matching all files.
+
+	@default true
+
+	@example
+	```
+	import {globby} from 'globby';
+
+	// Default behavior: matches all files except .json
+	await globby(['!*.json']);
+	//=> ['file.txt', 'image.png', ...]
+
+	// Disable expansion: returns empty array
+	await globby(['!*.json'], {expandNegationOnlyPatterns: false});
+	//=> []
+	```
+	*/
+	readonly expandNegationOnlyPatterns?: boolean;
+
 	/**
 	The current working directory in which to search.
 

index.js

@@ -290,9 +290,14 @@ const createFilterFunction = (isIgnored, cwd) => {
 const unionFastGlobResults = (results, filter) => results.flat().filter(fastGlobResult => filter(fastGlobResult));
 
 const convertNegativePatterns = (patterns, options) => {
-	// If all patterns are negative, prepend a positive catch-all pattern
-	// This makes negation-only patterns work intuitively (e.g., '!*.json' matches all files except JSON)
+	// If all patterns are negative and expandNegationOnlyPatterns is enabled (default),
+	// prepend a positive catch-all pattern to make negation-only patterns work intuitively
+	// (e.g., '!*.json' matches all files except JSON)
 	if (patterns.length > 0 && patterns.every(pattern => isNegativePattern(pattern))) {
+		if (options.expandNegationOnlyPatterns === false) {
+			return [];
+		}
+
 		patterns = ['**/*', ...patterns];
 	}
 

readme.md

@@ -106,6 +106,27 @@ This is a more generic form of the `gitignore` option, allowing you to find igno
 
 **Performance tip:** Using a specific path like `'.gitignore'` is much faster than recursive patterns.
 
+##### expandNegationOnlyPatterns
+
+Type: `boolean`\
+Default: `true`
+
+When only negation patterns are provided (e.g., `['!*.json']`), automatically prepend a catch-all pattern (`**/*`) to match all files before applying negations.
+
+Set to `false` to return an empty array when only negation patterns are provided. This can be useful when patterns are user-controlled, to avoid unexpectedly matching all files.
+
+```js
+import {globby} from 'globby';
+
+// Default behavior: matches all files except .json
+await globby(['!*.json']);
+//=> ['file.txt', 'image.png', ...]
+
+// Disable expansion: returns empty array
+await globby(['!*.json'], {expandNegationOnlyPatterns: false});
+//=> []
+```
+
 ##### fs
 
 Type: [`FileSystemAdapter`](https://github.com/mrmlnc/fast-glob#fs)\

tests/globby.js

@@ -272,6 +272,27 @@ test('negation pattern with absolute path is normalized to relative', async t =>
 	t.deepEqual(result, []);
 });
 
+test('expandNegationOnlyPatterns: false returns empty array for negation-only patterns', async t => {
+	const result = await runGlobby(t, ['!a.tmp', '!b.tmp'], {cwd: temporary, expandNegationOnlyPatterns: false});
+	t.deepEqual(result, []);
+});
+
+test('expandNegationOnlyPatterns: false with single negation pattern returns empty array', async t => {
+	const result = await runGlobby(t, '!a.tmp', {cwd: temporary, expandNegationOnlyPatterns: false});
+	t.deepEqual(result, []);
+});
+
+test('expandNegationOnlyPatterns: false does not affect mixed patterns', async t => {
+	// When there are positive patterns, negation-only expansion is not triggered
+	const result = await runGlobby(t, ['*.tmp', '!a.tmp', '!b.tmp'], {cwd: temporary, expandNegationOnlyPatterns: false});
+	t.deepEqual(result, ['c.tmp', 'd.tmp', 'e.tmp']);
+});
+
+test('expandNegationOnlyPatterns: true (default) works with negation-only patterns', async t => {
+	const result = await runGlobby(t, ['!a.tmp', '!b.tmp'], {cwd: temporary, expandNegationOnlyPatterns: true});
+	t.deepEqual(result, ['c.tmp', 'd.tmp', 'e.tmp']);
+});
+
 test('glob - stream async iterator support', async t => {
 	const results = [];
 	for await (const path of globbyStream('*.tmp')) {