Fix for prototype pollution

[rachaelshaw]

Incorporated fix from https://github.com/lodash/lodash/pull/4336/files

[sailsbot]

Hi @rachaelshaw! It looks like the title of your pull request doesn’t quite match our guidelines yet. Would you please edit your pull request's title so that it begins with [proposal], [patch], [fixes #<issue number>], [implements #<other PR number>], or [misc]? Once you've edited it, I'll take another look!

[Kirill89]

👋 I still can reproduce the issue locally with

_.defaultsDeep({}, JSON.parse('{"constructor": {"prototype": {"a0": "polluted!"}}}'));
console.log(({}).a0);

I believe you also need to change line

lodash/lib/index.js

Line 2597 in a621444

var value = object[key],

to

var value = safeGet(object, key),

according to https://github.com/lodash/lodash/blob/master/.internal/baseMergeDeep.js#L30

[Kirill89]

👍