refactor(node-resolve): remove deep-freeze and deepmerge from depende…

…ncies

This 2 dependencies are currently used to deepfreeze an exported symbol. Which seems to be an wasteful to add 2 extra dependencies for something trivial.

Also `deep-freeze` is licensed as Public Domain, which might be problematic for some 3rd parties such as the Angular CLI.

In Angular CLI we have a license validator that validates direct and transitive dependencies, and Public Domain is a problematic license becuse it falls under the "unencumbered' group which requires legal audit.

More context: https://opensource.google/docs/thirdparty/licenses/#unencumbered

packages/node-resolve/package.json

@@ -52,8 +52,6 @@
     "@rollup/pluginutils": "^3.1.0",
     "@types/resolve": "1.17.1",
     "builtin-modules": "^3.1.0",
-    "deep-freeze": "^0.0.1",
-    "deepmerge": "^4.2.2",
     "is-module": "^1.0.0",
     "resolve": "^1.17.0"
   },

packages/node-resolve/src/index.js

@@ -2,8 +2,6 @@
 import { dirname, normalize, resolve, sep } from 'path';
 
 import builtinList from 'builtin-modules';
-import deepFreeze from 'deep-freeze';
-import deepMerge from 'deepmerge';
 import isModule from 'is-module';
 
 import { isDirCached, isFileCached, readCachedFile } from './cache';
@@ -19,6 +17,17 @@ import {
 const builtins = new Set(builtinList);
 const ES6_BROWSER_EMPTY = '\0node-resolve:empty.js';
 const nullFn = () => null;
+const deepFreeze = object => {
+  Object.freeze(object);
+
+  for (const value of Object.values(object)) {
+    if (typeof value === 'object' && !Object.isFrozen(value)) {
+      deepFreeze(value);
+    }
+  }
+
+  return object;
+};
 const defaults = {
   customResolveOptions: {},
   dedupe: [],
@@ -27,7 +36,7 @@ const defaults = {
   extensions: ['.mjs', '.js', '.json', '.node'],
   resolveOnly: []
 };
-export const DEFAULTS = deepFreeze(deepMerge({}, defaults));
+export const DEFAULTS = deepFreeze(defaults);
 
 export function nodeResolve(opts = {}) {
   const options = Object.assign({}, defaults, opts);