From b00de840457d03297ee8c14292e6f18cee0fe99d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 00:31:05 +0000
Subject: [PATCH 1/2] chore(release): prepare 2.3.1

  - Bump version to 2.3.1
  - Update CHANGELOG.md with release notes
---
 CHANGELOG.md                   | 6 ++++++
 package.json                   | 2 +-
 packages/backend/package.json  | 2 +-
 packages/frontend/package.json | 2 +-
 packages/shared/package.json   | 2 +-
 5 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf060c8..315fad8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.1] - 2026-08-18
+
+### Fixed
+
+- **deps**: upgrade deepmerge-ts to 8.0.1 to fix GHSA-ggr8-5vv4-36mx
+
 ## [2.3.0] - 2026-08-17
 
 ### Added
diff --git a/package.json b/package.json
index cfd7e40..d73379f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "scrumooth",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": true,
   "license": "Apache-2.0",
   "description": "Scrumooth - Self-hosted Scrum tool, faithful to the Scrum Guide",
diff --git a/packages/backend/package.json b/packages/backend/package.json
index dd75727..b0cd25d 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scrumooth/backend",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/frontend/package.json b/packages/frontend/package.json
index 978d834..ddb5222 100644
--- a/packages/frontend/package.json
+++ b/packages/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scrumooth/frontend",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": true,
   "license": "Apache-2.0",
   "description": "Frontend UI for Scrumooth - Self-hosted Scrum tool, faithful to the Scrum Guide",
diff --git a/packages/shared/package.json b/packages/shared/package.json
index ca185f3..41d2d1b 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scrumooth/shared",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",

From 0505e210b5355390380f1e59e8659e4840b6ecef Mon Sep 17 00:00:00 2001
From: orbivort <273379167+orbivort@users.noreply.github.com>
Date: Tue, 18 Aug 2026 08:32:09 +0800
Subject: [PATCH 2/2] Update CHANGELOG.md

---
 CHANGELOG.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 315fad8..cf802cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,9 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [2.3.1] - 2026-08-18
 
-### Fixed
+### Security
 
-- **deps**: upgrade deepmerge-ts to 8.0.1 to fix GHSA-ggr8-5vv4-36mx
+- **deepmerge-ts**: fix high stack exhaustion (DoS) vulnerability - override to ^8.0.0
+  - GHSA-ggr8-5vv4-36mx / CVE-2026-40345: unbounded recursion in `deepmerge()`/`deepmergeInto()` when merging recursive object graphs can crash the process with `RangeError: Maximum call stack size exceeded` (availability only; plain JSON is not affected)
 
 ## [2.3.0] - 2026-08-17