diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44be7ef..a834a79 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,44 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
+## [0.3.1] - 2026-08-24
+
+### Security
+
+- **`mcp` pins the workspace root and bounds `exec` children** — tool
+  calls resolve paths against the server's pinned workspace root instead
+  of the ambient process CWD, and spawned commands run under a
+  wall-clock timeout so a hung command can no longer wedge the stdio
+  loop.
+- **`exec` rejects unquoted shell metacharacters** — arguments carrying
+  shell metacharacters fail fast with a `sh -c` hint instead of reaching
+  a shell.
+
+### Fixed
+
+- **Symbol correctness pack** — AST walks are depth-bounded so deeply
+  nested code can no longer overflow the stack; the Markdown backend
+  gates its preprocessor fold; byte offsets are correct for CRLF input;
+  C/C++ unions report the new `union` kind.
+- **`deps` anchored to the project root** — import resolution starts at
+  the project root, ignore globs apply to relative paths only, and
+  unresolvable imports surface with an explicit unresolved kind.
+- **exec fidelity** — the pending fold buffer is bounded, passthrough
+  bytes are preserved verbatim, and the over-broad-keep warning fires
+  exactly when folding was ineffective; empty keep patterns are rejected
+  and options are validated before spawn.
+- **MCP contract parity** — non-zero exec exits surface as errors with
+  matching exit codes and tool arguments are validated before dispatch.
+- **Config tolerance** — unreadable configs discovered during lookup are
+  skipped with a warning instead of aborting.
+
+### Changed
+
+- **File guardrails** — inputs that are not regular files or exceed the
+  size limit are refused up front with a clear error.
+- Backend dedup polish: shared helpers consolidated, signature caps and
+  markers tightened, clap help strings aligned.
+
 ## [0.3.0] - 2026-08-23
 
 ### Added
diff --git a/Cargo.lock b/Cargo.lock
index 4e1b5db..c210ea9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -157,7 +157,7 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "ctx-exec"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "regex",
  "serde",
@@ -167,7 +167,7 @@ dependencies = [
 
 [[package]]
 name = "ctx-symbol"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "regex",
  "serde",
@@ -191,7 +191,7 @@ dependencies = [
 
 [[package]]
 name = "ctxctl"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "clap",
  "ctx-exec",
diff --git a/Cargo.toml b/Cargo.toml
index 5891e4d..318cc64 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/ctx-symbol", "crates/ctx-exec", "crates/ctxctl"]
 
 [workspace.package]
-version = "0.3.0"
+version = "0.3.1"
 edition = "2024"
 license = "MIT"
 authors = ["fuyu"]
@@ -11,8 +11,8 @@ repository = "https://github.com/Xuepoo/ctxctl"
 homepage = "https://ctxctl.xuepoo.xyz"
 
 [workspace.dependencies]
-ctx-symbol = { path = "crates/ctx-symbol", version = "0.3.0" }
-ctx-exec = { path = "crates/ctx-exec", version = "0.3.0" }
+ctx-symbol = { path = "crates/ctx-symbol", version = "0.3.1" }
+ctx-exec = { path = "crates/ctx-exec", version = "0.3.1" }
 clap = { version = "4", features = ["derive"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"