@commitlint/load

In practice, @commitlint/load does what it says - it loads commitlint configurations from various sources including extends clauses and shareable configs. The module resolution works reliably for both local and npm-based configs. However, from a security perspective, there are concerns that make me cautious in CI/CD pipelines.

The package executes arbitrary JavaScript from configuration files without clear sandboxing or validation. When loading configs, there's no input sanitization on the extends array, meaning a malicious package name could potentially be resolved. Error messages sometimes leak full file paths, which isn't ideal in containerized environments. The dependency chain includes cosmiconfig and other transitive dependencies that expand the attack surface considerably.

For local development workflows, it's adequate and gets the job done. But for production CI systems where supply chain attacks are a real concern, I'd prefer more explicit controls around what can be loaded and from where. The lack of schema validation before executing config code is a missed opportunity for defense-in-depth.

In practice, @commitlint/load does what it says - loads commitlint configurations from various sources including shareable configs. The configuration resolution works reliably for common cases, but the synchronous file I/O and module resolution can become a bottleneck in CI environments where you're running hundreds of concurrent jobs.

The package lacks meaningful logging hooks, making it difficult to diagnose why configuration resolution is slow or failing in production pipelines. Error messages when a shareable config can't be resolved are often cryptic, especially when dealing with transitive dependencies. There's no timeout configuration, so if module resolution hangs (rare but happens with network-mounted CI runners), your entire pipeline stalls.

Configuration caching is minimal - each invocation re-reads and re-parses configs. For monorepo setups running commitlint on multiple packages, this overhead adds up. The API is straightforward but inflexible - you can't inject custom resolvers or provide hints about where to look for configs.

In practice, @commitlint/load is the core infrastructure piece that loads and resolves commitlint configurations, but you rarely interact with it directly. Most developers use @commitlint/cli which wraps this package. When you do need it directly for custom tooling or programmatic access, the experience is functional but bare-bones.

The API itself is straightforward - you call `load()` with options and get back a resolved configuration object. TypeScript types are present and generally helpful, though the returned configuration shape can be complex with merged rules, plugins, and extends chains. Error messages when configuration resolution fails can be cryptic, especially when dealing with module resolution issues or malformed extends paths.

Documentation is the weakest point. The README is minimal, and you often need to dig through commitlint's monorepo or read source code to understand advanced usage patterns. For basic use cases it works reliably, but debugging configuration loading issues or understanding precedence rules requires detective work.