merge-descriptors@1.0.3 (#5781)

* Allow patches for `merge-descriptors` dependency

* Set fixed latest of v1 (1.0.3)

Author: RobinTail

package.json

@@ -43,7 +43,7 @@
     "finalhandler": "1.2.0",
     "fresh": "0.5.2",
     "http-errors": "2.0.0",
-    "merge-descriptors": "1.0.1",
+    "merge-descriptors": "1.0.3",
     "methods": "~1.1.2",
     "on-finished": "2.4.1",
     "parseurl": "~1.3.3",