fix: prototype pollution in _.defaultsDeep (#4336)

lodash.js

@@ -6589,7 +6589,7 @@
     }
 
     /**
-     * Gets the value at `key`, unless `key` is "__proto__".
+     * Gets the value at `key`, unless `key` is "__proto__" or "constructor".
      *
      * @private
      * @param {Object} object The object to query.
@@ -6597,6 +6597,10 @@
      * @returns {*} Returns the property value.
      */
     function safeGet(object, key) {
+      if (key === 'constructor' && typeof object[key] === 'function') {
+        return;
+      }
+      
       if (key == '__proto__') {
         return;
       }