Fix glob pattern matching on Windows

[Frank3K]

Description

Headers, redirects, and rewrites config rules are silently ignored on Windows. Any glob pattern without a leading slash — e.g. api/**, **/*.json — is never matched, so configured rules have no effect.

Root cause

glob-slasher (v1.0.1, 2014, unmaintained) depends on glob-slash, which normalizes patterns using Node's path module:

// node_modules/glob-slash/index.js
function normalize(value) {
  return path.normalize(path.join('/', value)); // ← uses OS path separator
}

On Windows, path.normalize converts forward slashes to backslashes. The pattern api/** becomes \api\**, which never matches a URL like /api/data.json.

Fix

Replace glob-slasher with a small local utility (src/utils/slasher.ts) that uses path.posix throughout, guaranteeing forward slashes on all platforms.

- const slasher = require("glob-slasher");
+ const { slasher } = require("../utils/slasher");

glob-slasher and its transitive dependencies (glob-slash, toxic, lodash.isobject, lodash._objecttypes) are removed from package.json.

Proof of concept (verified on Windows)

Create a directory with the following files and run npm install && npm start:

package.json

{
  "name": "superstatic-windows-glob-poc",
  "private": true,
  "scripts": {
    "start": "superstatic . -c config.json"
  },
  "dependencies": {
    "superstatic": "10.0.0"
  }
}

config.json

{
  "public": "public",
  "headers": [
    {
      "source": "api/**",
      "headers": [
        { "key": "X-Bug-Fixed", "value": "true" }
      ]
    }
  ]
}

public/api/data.json

{
  "message": "If the response includes 'X-Bug-Fixed: true', the glob pattern
matched correctly.",
  "expected_header": "X-Bug-Fixed: true"
}

Then verify with:

curl -I http://localhost:3474/api/data.json

Version	X-Bug-Fixed header
superstatic@10.0.0 (npm)	absent — rule never matched
this branch	true — fixed

To reproduce with the fix, change the dependency to "superstatic": "https://github.com/Frank3K/superstatic.git#fix-windows-glob-matching" and re-run npm install.

Related PRs

• replaced slasher functionality #249 (earlier Windows-fix by @HaykoKoryun, unmerged)
• Replace lodash with native JS equivalents #522 (removes direct lodash dependency)