• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Add a customizer function to mergeWith to prevent merging undefined values,
preserving the behavior of the original lodash.merge function.

@commitlint/cli/src/cli.test.ts [682-687]

 async function writePkg(payload: unknown, options: TestOptions) {
 	const pkgPath = path.join(options.cwd, "package.json");
 	const pkg = JSON.parse(await fs.readFile(pkgPath, "utf-8"));
-	const result = mergeWith(pkg, payload);
+	const result = mergeWith(pkg, payload, (objValue, srcValue) => {
+		if (srcValue === undefined) {
+			return objValue;
+		}
+	});
 	await fs.writeFile(pkgPath, JSON.stringify(result, null, "  "));
 }

• Apply / Chat

Add an empty object as the first argument to mergeWith to prevent mutation of
the configAngular object and ensure a correct merge.

@commitlint/config-patternplate/index.js [19]

-export default mergeWith(configAngular, {
+export default mergeWith({}, configAngular, {

• Apply / Chat

Add an empty object as the first argument to mergeWith to serve as the merge
target, preventing mutation of the source configuration objects.

@commitlint/load/src/load.ts [51-59]

 config = mergeWith(
+    {},
     {
         extends: [],
         plugins: [],
         rules: {},
         ...
     },
     config
 );

[To ensure code accuracy, apply this suggestion manually]

Instead of replacing one lodash micro-package (lodash.merge) with another
(lodash.mergewith), consider using the full lodash package. This would provide a
more scalable solution for using lodash utilities while maintaining a single
dependency.

Examples:

    "lodash.mergewith": "^4.6.2"

import mergeWith from "lodash.mergewith";

Solution Walkthrough:

Before:

// package.json
"dependencies": {
  "lodash.mergewith": "^4.6.2"
}

// @commitlint/load/src/load.ts
import mergeWith from "lodash.mergewith";
// ...
config = mergeWith(
  { /* ... */ },
  config,
  seed
);

After:

// package.json
"dependencies": {
  "lodash": "^4.17.0" // or latest version
}

// @commitlint/load/src/load.ts
import { mergeWith } from "lodash";
// ...
config = mergeWith(
  { /* ... */ },
  config,
  seed
);