Consolidate glob dependencies

[legrego]

Kibana includes the following third-party dependencies to work with glob patterns:

• globby
• fast-glob

Kibana as a platform should consolidate the implementation to as few dependencies as possible. Within the scope of this issue, that means one of the following:

• Remove globby in favor of fast-globby
• Remove fast-globby in favor of globby
• Remove both dependencies, and standardize on a different solution such as Node's native glob utility.
• Document why the current implementation is the preferred approach, to justify keeping both dependencies within the repository.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[jsoule6]

This has become increasingly urgent with the release of this:

https://www.theregister.com/2025/08/27/popular_nodejs_utility_used_by/

DoD is going to be banning the use of fast-glob.

[legrego]

Thanks, @jsoule6

DoD is going to be banning the use of fast-glob.

The article you linked does not state this directly, but rather leaves it ambiguous:

US Defense Secretary Pete Hegseth said in a July memo [PDF] that the Pentagon would no longer "procure any hardware or software susceptible to adversarial foreign influence." In theory, the Pentagon should want to remove fast-glob from its environment very quickly. Smith told us that his group shared the fast-glob research with the DoD three weeks ago. We asked the DoD what it plans to do about fast-glob but didn't hear back.

---

Regardless, we are evaluating our options here, as we have more than one reason to consolidate our dependency usage.

[AlanMasciangelo]

It looks like fast-glob was moved to only be a dev dependency in #233376. Although I see it as still present in the final builds node_modules, IE docker.elastic.co/kibana/kibana:9.1.3