Use lodash/cloneDeep instead of deep-assign

packages/core/package.json

@@ -23,14 +23,13 @@
     "@loopback/context": "^4.0.0-alpha.9",
     "@loopback/openapi-spec": "^4.0.0-alpha.6",
     "@types/bluebird": "^3.5.8",
-    "@types/deep-assign": "^0.1.0",
     "@types/http-errors": "^1.5.34",
     "@types/swagger-parser": "^4.0.1",
     "bluebird": "^3.5.0",
     "body": "^5.1.0",
     "debug": "^2.6.0",
-    "deep-assign": "^2.0.0",
     "http-errors": "^1.6.1",
+    "lodash": "^4.17.4",
     "path-to-regexp": "^1.7.0",
     "swagger-parser": "^3.4.1"
   },

packages/core/src/application.ts

@@ -4,7 +4,6 @@
 // License text available at https://opensource.org/licenses/MIT
 
 import {AssertionError} from 'assert';
-import * as deepAssign from 'deep-assign';
 import * as SwaggerParser from 'swagger-parser';
 import {
   Binding,
@@ -32,6 +31,12 @@ import {RejectProvider} from './router/reject';
 import {FindRoute, InvokeMethod, Send, Reject} from './internal-types';
 import {ControllerClass} from './router/routing-table';
 
+// NOTE(bajtos) we cannot use `import * as cloneDeep from 'lodash/cloneDeep'
+// because it produces the following TypeScript error:
+//  Module '"(...)/node_modules/@types/lodash/cloneDeep/index"' resolves to
+//  a non-module entity and cannot be imported using this construct.
+const cloneDeep: <T>(value: T) => T = require('lodash/cloneDeep');
+
 const debug = require('debug')('loopback:core:application');
 
 export class Application extends Context {
@@ -307,9 +312,9 @@ export class Application extends Context {
     const spec = this.getSync('api-spec');
     this._setupHandlerIfNeeded();
 
-    // Apply deep-assign (deep clone) to prevent getApiSpec() callers from
+    // Apply deep clone to prevent getApiSpec() callers from
     // accidentally modifying our internal routing data
-    spec.paths = deepAssign({}, this._httpHandler.describeApiPaths());
+    spec.paths = cloneDeep(this._httpHandler.describeApiPaths());
 
     return spec;
   }