Vulnerability: Prototype Pollution via the main (merge) function  #963

Description

Found by vulnerability check OWASP:UsingComponentWithKnownVulnerability

Filename: merge:2.1.1 | Reference: CVE-2021-23397 | CVSS Score: 9.8 | Category: CWE-1321 | All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.

dependency tree:

commitizen@4.2.6
  └ find-node-modules@2.1.3
    └ merge@2.1.1

caused by callumacrae/find-node-modules#18

awaiting fix to upgrade to find-node-modules@2.1.4

Steps to reproduce

1. Clone this repo
2. Install dependencies npm i
3. observe vulnerability

Environment

• commitizen@4.2.6

Wrongly raised in commitizen-tools/commitizen#654