Hi @rachaelshaw! It looks like the title of your pull request doesn’t quite match our guidelines yet. Would you please edit your pull request's title so that it begins with [proposal], [patch], [fixes #<issue number>], [implements #<other PR number>], or [misc]? Once you've edited it, I'll take another look!

👋 I still can reproduce the issue locally with

_.defaultsDeep({}, JSON.parse('{"constructor": {"prototype": {"a0": "polluted!"}}}'));
console.log(({}).a0);

I believe you also need to change line

var value = safeGet(object, key),

according to https://github.com/lodash/lodash/blob/master/.internal/baseMergeDeep.js#L30