v3.1.0 release publication and verification #338

Release record for v3.1.0. Keep open until the tag, image and release are verified.

Scope

Proposed minor release after v3.0.0: 17 first-included merged PRs (#317 through #337) and two implementation-linked issues (#327 by #328, #334 by #336). All are in milestone v3.1.0. Dependabot PRs #322, #323 were superseded by #324 and are not counted.

Minor rather than patch: the release adds functionality and configuration (per-host SOCKS5 proxies with SOCKS_REMOTE_DNS_ALLOWLIST/SOCKS_PROXY_MAX_RECORDS, automation through saved jump hosts, browser login management, workspace presets, support reports). The existing 3.0 image tag stays on 3.0.0; latest moves to 3.1.0.

Upgrade-relevant changes:

• Additive SQLite columns (ssh_sessions.socks_proxy_id, ssh_sessions.via_socks, socket_sessions.authentication_session_id) and a new per-user socks_proxies.json store.
• Page script policy is script-src 'self'.
• Restore ignores logs/ and tmp/ in archives.
• Project support links are shown by default and can be hidden under Administration → Integrations.

Gates

• Release preparation PR merged (VERSION, release notes, manifest candidate, roadmap).
• Final candidate SHA recorded; main CI and native publication passed on it.
• Tag v3.1.0 resolves to the candidate SHA.
• Tag pipeline passed: full suite, browser end-to-end, SSH/SMB integration, container upgrade and Redis jobs.
• Native AMD64/ARM64 images passed the fixable High/Critical and hardened runtime gates.
• GHCR 3.1.0, 3.1 and latest resolve to one digest; revision label, SPDX SBOM and SLSA provenance checked.
• Upgrade from a 3.0.0 data volume and rollback by restoring the pre-upgrade volumes exercised, or explicitly recorded as not run.
• GitHub Release published from the release notes; documentation PR records the verified delivery.

Deployment-specific identity-provider, native-device and SOCKS5 proxy acceptance is not inferred from CI.