fix(model): don't alter original scopes when combining them (#10722)

lib/model.js

@@ -811,6 +811,12 @@ class Model {
         }
       });
     }
+    // If we have a possible object/array to clone, we try it.
+    // Otherwise, we return the original value when it's not undefined,
+    // or the resulting object in that case.
+    if (srcValue) {
+      return Utils.cloneDeep(srcValue, true);
+    }
     return srcValue === undefined ? objValue : srcValue;
   }
 

lib/utils.js

@@ -123,7 +123,7 @@ function formatNamedParameters(sql, parameters, dialect) {
 }
 exports.formatNamedParameters = formatNamedParameters;
 
-function cloneDeep(obj) {
+function cloneDeep(obj, onlyPlain) {
   obj = obj || {};
   return _.cloneDeepWith(obj, elem => {
     // Do not try to customize cloning of arrays or POJOs
@@ -131,8 +131,9 @@ function cloneDeep(obj) {
       return undefined;
     }
 
-    // Don't clone stuff that's an object, but not a plain one - fx example sequelize models and instances
-    if (typeof elem === 'object') {
+    // If we specified to clone only plain objects & arrays, we ignore everyhing else
+    // In any case, don't clone stuff that's an object, but not a plain one - fx example sequelize models and instances
+    if (onlyPlain || typeof elem === 'object') {
       return elem;
     }
 

test/unit/model/scope.test.js

@@ -112,6 +112,10 @@ describe(Support.getTestDialectTeaser('Model'), () => {
       it('should unite attributes with array', () => {
         expect(User.scope('aScope', 'defaultScope')._scope.attributes).to.deep.equal({ exclude: ['value', 'password'] });
       });
+
+      it('should not modify the original scopes when merging them', () => {
+        expect(User.scope('defaultScope', 'aScope').options.defaultScope.attributes).to.deep.equal({ exclude: ['password'] });
+      });
     });
 
     it('defaultScope should be an empty object if not overridden', () => {