The PR is fixing a Prototype Pollution vulnerability in _.defaultsDeep. You can see details about similar vulnerability here: https://snyk.io/vuln/SNYK-JS-LODASH-73638