Why this matters
The bug. JavaScript passes objects by reference. Object.assign(user, prefs) mutates the *caller's* user object — not a local copy. In React and most state-management libraries, mutating a state object skips the change-detection equality check and breaks rendering. The next line returning user looks innocent because user is now also the mutated input.
The fix. Build a new object: return { ...user, ...prefs }. Same inputs always produce the same output, no side effects. The function becomes safe to call with a frozen value, a Redux state slice, or any reference the caller still holds.
Heuristic. Treat function arguments as const. If you find yourself mutating one, copy first.
Review heuristic
Library functions that take an object and mutate it should be loud about it (named sortInPlace, not sort). Sites that pass a config object through a chain of middleware should not allow any link in the chain to mutate it.