fix: clone startObj to prevent unintended mutation

FIXES #36

index.js

@@ -4,6 +4,7 @@
  * https://github.com/joshswan/gulp-merge/blob/master/LICENSE
  */
 
+const cloneDeep = require('lodash.clonedeep');
 const mergeWith = require('lodash.mergewith');
 const JSON5 = require('json5');
 const path = require('path');
@@ -61,7 +62,7 @@ module.exports = function mergeJson(opts) {
     throw new PluginError(PLUGIN_NAME, `${PLUGIN_NAME}: Invalid start and/or end object!`);
   }
 
-  let merged = options.startObj;
+  let merged = cloneDeep(options.startObj);
   let firstFile = null;
 
   function parseAndMerge(file) {

package.json

@@ -33,6 +33,7 @@
   },
   "dependencies": {
     "json5": "^2.2.3",
+    "lodash.clonedeep": "^4.5.0",
     "lodash.mergewith": "^4.6.1",
     "plugin-error": "^2.0.1",
     "through": "^2.3.8",

test/index.test.js

@@ -98,14 +98,17 @@ describe('gulp-merge-json', () => {
   });
 
   test('uses supplied start object as base', (done) => {
-    const stream = gulp.src(['test/json/test1.json', 'test/json/test2.json']).pipe(merge({
-      startObj: { initial: 'value' },
-    }));
+    const startObj = { initial: 'value' };
+    const stream = gulp.src(['test/json/test1.json', 'test/json/test2.json']).pipe(merge({ startObj }));
 
     stream.on('data', (file) => {
       const expected = ['{', '\t"initial": "value",', '\t"name": "Josh",', '\t"pet": {', '\t\t"name": "Indy"', '\t},', '\t"tags": [', '\t\t"awesome",', '\t\t"fun"', '\t],', '\t"place": "San Francisco",', '\t"settings": {', '\t\t"likesSleep": true', '\t}', '}'].join('\n');
 
       expect(file.contents.toString()).toBe(expected);
+
+      // Ensure startObj is not modified
+      expect(startObj).toStrictEqual({ initial: 'value' });
+
       done();
     });
   });
@@ -319,14 +322,17 @@ describe('gulp-merge-json', () => {
   });
 
   test('merges JSON files containing arrays when passed an array starting object', (done) => {
-    const stream = gulp.src(['test/json/array1.json', 'test/json/array2.json']).pipe(merge({
-      startObj: [],
-    }));
+    const startObj = [];
+    const stream = gulp.src(['test/json/array1.json', 'test/json/array2.json']).pipe(merge({ startObj }));
 
     stream.on('data', (file) => {
       const expected = ['[', '\t{', '\t\t"a": 1,', '\t\t"b": 2,', '\t\t"c": 3,', '\t\t"d": 4', '\t}', ']'].join('\n');
 
       expect(file.contents.toString()).toBe(expected);
+
+      // Ensure startObj is not modified
+      expect(startObj).toStrictEqual([]);
+
       done();
     });
   });

yarn.lock

@@ -5166,6 +5166,11 @@ lodash.capitalize@^4.2.1:
   resolved "https://registry.yarnpkg.com/lodash.capitalize/-/lodash.capitalize-4.2.1.tgz#f826c9b4e2a8511d84e3aca29db05e1a4f3b72a9"
   integrity sha512-kZzYOKspf8XVX5AvmQF94gQW0lejFVgb80G85bU4ZWzoJ6C03PQg3coYAUpSTpQWelrZELd3XWgHzw4Ck5kaIw==
 
+lodash.clonedeep@^4.5.0:
+  version "4.5.0"
+  resolved "https://registry.yarnpkg.com/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz#e23f3f9c4f8fbdde872529c1071857a086e5ccef"
+  integrity sha512-H5ZhCF25riFd9uB5UCkVKo61m3S/xZk1x4wA6yp/L3RFP6Z/eHH1ymQcGLo7J3GMPfm0V/7m1tryHuGVxpqEBQ==
+
 lodash.escaperegexp@^4.1.2:
   version "4.1.2"
   resolved "https://registry.yarnpkg.com/lodash.escaperegexp/-/lodash.escaperegexp-4.1.2.tgz#64762c48618082518ac3df4ccf5d5886dae20347"