so how did deepvault get into the latest wallet then if there has been no new commit?

The dev is releasing custom Windows binaries without being transparent about his changes, that's how.
Be very, very cautious. I would not be using that Windows binary.
you'll have to explain this in more detail. i'm not a coder so i don't understand why this is bad and why it hasn't been done in the github
Because the "dev" doesn't want anyone to see how trivial the "deepvault" actually is, given the fact that functionality has been possible since 2009 in bitcoin.
That's the non-cynical response.
The more cynical response would be that the "dev" is actually now spreading a trojan with a closed source windows only wallet.