Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@app/Config/ContentSecurityPolicy.php`:
- Line 200: The CSP setting objectSrc in ContentSecurityPolicy.php was relaxed
to 'self' which re-enables <object>/<embed>/<applet> from same-origin; restore
it to the safer default by changing the public $objectSrc back to 'none' in the
ContentSecurityPolicy class (symbol: objectSrc) unless you have a documented,
necessary use-case—if you must allow same-origin objects, add an inline comment
above objectSrc explaining the specific feature that requires it and
create/update project documentation describing the justification and any
mitigations (e.g., strict MIME type checks, input validation).

In `@app/Config/Filters.php`:
- Around line 68-71: Update the PHPDoc for the Filters::$globals property to
reflect that the 'before' and 'after' arrays can contain both numeric-indexed
string entries and string-keyed arrays (e.g., 'csrf' => ['except' => ...]);
change the type from the current union to a keyed shape such as array{before:
array<int|string, string|array{except: list<string>|string}>, after:
array<int|string, string|array{except: list<string>|string}>} so tools and
static analyzers understand the mixed keys and heterogeneous values for the
before/after lists.

In `@app/Controllers/Receivings.php`:
- Around line 193-197: postEditItem currently accepts null/empty item_id without
validation; add an explicit guard at the start of postEditItem to reject null or
empty strings (e.g., if ($item_id === null || $item_id === '' ||
trim((string)$item_id) === '') ) and return an appropriate error response (HTTP
400 / BadRequest or a JSON error / redirect with flash) instead of proceeding;
ensure you reference the postEditItem method and sanitize/cast the incoming
$item_id before using it in any lookup or DB calls.

In `@app/Models/Customer.php`:
- Line 132: The get_stats method currently declares an overly broad return
union; narrow it to match what $builder->get()->getRow() actually returns by
changing the return type of Customer::get_stats to stdClass|null (or ?stdClass)
and update any docblock/type hints accordingly so callers know it returns either
an object or null coming from $builder->get()->getRow().

In `@app/Models/Item.php`:
- Line 355: The method get_info_by_id_or_number currently declares an overly
broad return type; tighten it to reflect the actual outcomes by changing the
signature to return stdClass|string and ensure the code path that calls
$query->getRow() returns an object (stdClass) rather than an array (or adjust
conversion) so the declared type matches the actual return values from
get_info_by_id_or_number.

In `@app/Views/barcodes/barcode_sheet.php`:
- Around line 16-26: Escape all dynamic outputs and fix the CSS property: wrap
URL outputs like base_url() in esc(..., 'url') for the <link href>, and escape
all attribute/inline-style values from $barcode_config and the class built with
$barcode_lib->get_font_name(...) using esc(..., 'attr'); replace the invalid CSS
property "borderspacing" with "border-spacing" in the <table> style and ensure
barcode height/width/font-size/page-width/page-cellspacing values are escaped
before interpolation.
- Line 26: Replace the invalid CSS property and add a unit: change the inline
style on the <table> element that uses
$barcode_config['barcode_page_cellspacing'] so it uses the correct CSS property
name "border-spacing" (with a hyphen) and append a valid unit (e.g. "px") to the
cellspacing value (e.g. use $barcode_config['barcode_page_cellspacing'] with
"px"), leaving the existing width usage of
$barcode_config['barcode_page_width']% intact so the style becomes
border-spacing:<value>px; width:<value>%.

In `@app/Views/configs/system_info.php`:
- Around line 39-46: The issue is inconsistent inline CSS in the echo statements
for BC Math and INTL: they use style="color: red" (missing the terminating
semicolon and closing >) while others use style="color: red;">; update the two
occurrences (the echo lines that output "BC Math" and "INTL" and contain
'style="color: red"') to match the correct pattern used elsewhere (use
'style="color: red;">') so all extension status spans are syntactically
consistent.

In `@app/Views/errors/html/error_exception.php`:
- Around line 384-386: The echoed header index uses concatenation without
parentheses, causing operator precedence to compute ($i + ' ) ') incorrectly;
update the foreach over $value (variables $i and $header in the loop that calls
$header->getValueLine() and esc()) to wrap the addition in parentheses so it
outputs ($i + 1) correctly — i.e., change the expression that builds the string
around $i + 1 to explicitly evaluate ($i + 1) before concatenation.
- Around line 337-339: The string concatenation in the foreach over $value uses
`' ('. $i+1 . ') '` which misapplies operator precedence and causes PHP to try
adding 1 to a string; update the concatenation around the index in the foreach
(variables $i and $header, method getValueLine()) to explicitly group the
arithmetic, e.g. concatenate ' ('. ($i + 1) .') ' before the
esc($header->getValueLine(), 'html') call so the index increments correctly.

In `@app/Views/sales/invoice_email.php`:
- Around line 174-175: The payment_message from $config is rendered without
escaping (nl2br($config['payment_message'])) which allows HTML injection; update
invoice_email.php to escape the payment_message before applying nl2br (use
esc($config['payment_message']) or esc(..., 'html') depending on project
conventions) so output is sanitized, keeping the existing nl2br usage and
consistency with the comments line that already uses esc() for $comments.
- Around line 104-106: The discount cell condition uses item-level
$item['discount'] but the table schema/header is built from order-level
$discount causing missing <td> and misalignment; update the per-row condition in
invoice_email.php to check the same $discount variable used when building the
table (i.e., use $discount > 0) so each row renders the discount column
consistently, keeping the existing cell content
(to_currency($item['discounted_total'] / $item['quantity'])) intact.

In `@composer.json`:
- Around line 35-39: The composer.json currently requires PHP "^8.1" which
conflicts with packages like codeigniter4/framework v4.7.2 and
laminas/laminas-escaper 2.18.0 that need PHP 8.2+, so update the "php" platform
requirement in composer.json from "^8.1" to "^8.2" and then regenerate
dependencies (run composer update / composer install to refresh composer.lock)
to resolve the dependency conflict and ensure packages (e.g.,
codeigniter4/framework, laminas/laminas-escaper) install correctly.

---

Outside diff comments:
In `@app/Config/Database.php`:
- Around line 130-132: In the switch block inside the Database configuration
(class Database / the switch that sets $this->defaultGroup), replace the
incorrect semicolon after the 'development' case with the standard colon so the
case reads case 'development': before executing $this->defaultGroup =
'development'; and break; — this fixes the unconventional/typo syntax and aligns
the switch-case with normal PHP style.

In `@app/Libraries/Receiving_lib.php`:
- Around line 395-401: The docblock for delete_item incorrectly states $line is
an item_number/item_id but the implementation unsets by cart index
($items[$line]) — either update the docblock to state $line is the cart line key
or change delete_item to locate and remove the item by its item_number or
item_id; to change behavior, iterate $this->get_cart() to find an element where
item['item_number'] == $line or item['item_id'] == $line, unset that entry, and
then call $this->set_cart($items); ensure you update/remove references to $line
typing if switching semantics so callers and get_cart/set_cart remain
consistent.

---

Nitpick comments:
In `@app/Config/Cache.php`:
- Around line 175-197: Tighten the web page cache status codes by setting the
Cache class property public array $cacheStatusCodes to only successful responses
in production (e.g., [200]); update the assignment inside the Cache
configuration so it uses an environment check (like ENVIRONMENT === 'production'
or env('APP_ENV') === 'production') to set $cacheStatusCodes = [200] for
production and keep the looser default ([]) for non-production, ensuring the
PageCache filter only caches 200 responses in prod.

In `@app/Config/Database.php`:
- Around line 77-79: The config currently sets SQLite-specific keys
('foreignKeys', 'busyTimeout', 'synchronous') while DBDriver is MySQLi; remove
these keys from the default MySQLi configuration or move them into a separate
SQLite config branch and/or add a guard that only applies them when DBDriver ===
'SQLite3' (refer to the DBDriver setting and the array entries 'foreignKeys',
'busyTimeout', 'synchronous' in Database.php); update comments to state these
options are only for SQLite if you keep a separate SQLite config.

In `@app/Config/Services.php`:
- Line 66: Update the htmlPurifier signature to use a typed boolean parameter
and a concrete return type: change public static function
htmlPurifier($getShared = true): object to public static function
htmlPurifier(bool $getShared = true): \HTMLPurifier (or the correct concrete
purifier class used in your project), and ensure you import or fully qualify
that class; update any docblocks and call sites that rely on the old untyped
signature to match the new type hints.

In `@app/Models/Employee.php`:
- Line 411: Tighten the return type of get_logged_in_employee_info() to only
object|false by replacing the current union
(float|false|array|int|string|stdClass|null) with object|false; update the
function signature for get_logged_in_employee_info() and ensure any internal
call to get_info() (which returns object) and all callers accept object|false
accordingly to avoid type mismatches.

In `@app/Views/configs/system_info.php`:
- Around line 28-30: Replace the inline font-weight styling on the three <p>
elements ("General Info", "User Setup", "Permissions") with semantic HTML (e.g.,
use <strong> for inline emphasis or appropriate heading tags like <h2>/<h3> for
section titles) and remove the inline style attributes; instead, apply a CSS
class (e.g., .section-title) for layout and spacing (min-height) in your
stylesheet so styling is separated from markup and the elements regain semantic
meaning.

In `@app/Views/errors/cli/error_exception.php`:
- Line 60: Update the inline comment on the expression "$value === null   =>
'null'" so it uses the lowercase word "null" (i.e., comment should read that
null values return 'null' in lowercase rather than 'NULL'); locate the comment
adjacent to the "$value === null" expression and either keep the concise
lowercase comment or, if you prefer, make it slightly more explicit by stating
that this branch returns the string 'null' (lowercase) rather than the uppercase
output of var_export.

In `@app/Views/errors/html/error_400.php`:
- Around line 72-82: In error_400.php adjust the HTML indentation so the <div
class="wrap"> block is indented inside the <body> to match the style used in
error_404.php; locate the <div class="wrap"> in error_400.php and re-indent its
opening tag, inner <h1> and <p> contents to the same nesting level as in
error_404.php for consistent template formatting.

In `@app/Views/reports/graphs/line.php`:
- Around line 66-78: Compute $currency_symbol, $currency_prefix and
$currency_suffix once at the top of the view (using $show_currency and
is_right_side_currency_symbol()) and remove the duplicated PHP blocks later in
the file; keep the first occurrence that sets $currency_symbol,
$currency_prefix, and $currency_suffix and delete the subsequent duplicate
blocks so the rest of the template reuses those variables.

In `@app/Views/reports/graphs/pie.php`:
- Around line 34-54: Remove the extra spaces before the closing object/statement
after the plugins array: in the block that defines plugins: [
Chartist.plugins.tooltip({ transformTooltipTextFnc: function(value) { return
'<?= $currency_prefix ?>' + value + '<?= $currency_suffix ?>'; } }) ]    }; —
collapse the whitespace so the end reads ] }; to match surrounding formatting
and keep the Chartist/plugins tooltip block (transformTooltipTextFnc,
currency_prefix, currency_suffix) intact.