From dce73f389ea2b984ae272217ffdf30e47fb209e0 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Mon, 17 Aug 2026 17:34:25 +0200
Subject: [PATCH] fix(deps): override deepmerge-ts ^8.0.1 (GHSA-ggr8-5vv4-36mx)

deepmerge-ts < 8.0.0 exhausts the stack when merging recursive object
graphs. It reaches us through @prisma/config, which pins it exactly at
7.1.5, so no Prisma release fixes this - the override is the only route.

v8 keeps the dual CJS/ESM exports and still exports the named deepmerge
that @prisma/config imports, and prisma generate runs in every CI job,
so the swap is exercised before merge.
---
 package-lock.json | 16 +++++++++++++---
 package.json      |  1 +
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 8389730..5d8b8b8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5854,9 +5854,19 @@
       "license": "MIT"
     },
     "node_modules/deepmerge-ts": {
-      "version": "7.1.5",
-      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
-      "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-8.0.1.tgz",
+      "integrity": "sha512-szCXE7YLCvLKR9bFPJcvsezOShdalctSvrgN/LM/QGUEPZQajwjmsMObZ6/DuANT5lxzM/wtO8Feubwdkz8myA==",
+      "funding": [
+        {
+          "type": "ko-fi",
+          "url": "https://ko-fi.com/rebeccastevens"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/deepmerge-ts"
+        }
+      ],
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=16.0.0"
diff --git a/package.json b/package.json
index b81032c..3797f6b 100644
--- a/package.json
+++ b/package.json
@@ -70,6 +70,7 @@
     "esbuild": "^0.28.1",
     "js-yaml": "^4.3.1",
     "nanoid": "^3.3.17",
+    "deepmerge-ts": "^8.0.1",
     "@babel/core": "^7.29.6",
     "jsdom": {
       "undici": "^7.28.0"