bifrost0x · Nov 14, 2026 · Nov 14, 2026
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -4,9 +4,10 @@ WebSSH is a self-hosted SSH and file workspace. This roadmap explains the direct
 the current release focus, and the evidence behind completed work. It is not a release-date
 promise or a replacement for issues, pull requests, and release notes.
 
-Release status updated: **2026-11-08**, [v3.0.0](https://github.com/bifrost0x/webssh/releases/tag/v3.0.0) at
-[`c6ecb87`](https://github.com/bifrost0x/webssh/commit/c6ecb87c23a1b9369b1534770f248df4a6994933).
-Check linked GitHub items for newer status.
+Release preparation updated: **2026-11-14**. Version **3.1.0** is selected from
+`origin/main`; the latest published release remains
+[v3.0.0](https://github.com/bifrost0x/webssh/releases/tag/v3.0.0) until tag and image
+publication are verified. Check linked GitHub items for newer status.
 
 ## Product direction
 
@@ -18,7 +19,22 @@ Check linked GitHub items for newer status.
 These themes summarize the existing product and published release history; they do not
 add new feature commitments.
 
-## Now: WebSSH 3.0 published
+## Now: prepare v3.1.0
+
+The [3.1.0 candidate notes](docs/releases/v3.1.0.md) cover per-host SOCKS5 proxy
+routes, automation through saved jump hosts, browser login management,
+workspace presets, a task-first overview, the in-app version display, a stricter
+script policy, restore hardening and dependency updates. The scope comes from
+changes merged since v3.0.0 and is tracked in the
+[v3.1.0 milestone](https://github.com/bifrost0x/webssh/milestone/15); it adds no
+further feature commitment.
+
+Publication requires the exact final candidate's CI, native image scans and
+versioned AMD64/ARM64 image, SBOM and provenance verification, recorded in
+[#338](https://github.com/bifrost0x/webssh/issues/338). Data used by 3.1 must not
+be opened with 3.0.0; roll back by restoring the pre-upgrade volumes.
+
+## Published: WebSSH 3.0
 
 Version 3 combines a customizable dashboard and SSH topology, a selectable
 start page and classic overview, consistent host and credential management,
@@ -74,7 +90,7 @@ deployment supported. Do not promote an idea into a promised release by listing
 
 - [Project history](docs/project-history.md): what shipped, documented reasons and lessons.
 - [Planning and release workflow](docs/project-planning.md): how issues, PRs and milestones fit together.
-- [Milestones](https://github.com/bifrost0x/webssh/milestones): native release grouping, with twelve published-release milestones closed.
+- [Milestones](https://github.com/bifrost0x/webssh/milestones): native release grouping, with every published-release milestone closed.
 - [Retrospective mapping](docs/release-history.json): release/PR/issue membership, milestone numbers and backfill verification.
 
 The native milestone backfill was applied on 2026-10-04: 185 items assigned and
@@ -83,6 +99,9 @@ manifest. The 2026-10-05 release update adds PRs #249-#252 to v2.5.0, closes
 release-readiness issue #248 and recorded the then-open operational follow-up #254.
 The 2026-10-23 v2.6.0 update adds 24 PRs and three implementation-linked issues,
 closes release record #289 and milestone 12, and tracks current deployment acceptance in #288.
+On 2026-11-14 the missing v2.7.0 and v3.0.0 milestones were created from the
+manifest, assigned their first-included PRs and issues, and closed; the open
+v3.1.0 milestone holds the work merged since v3.0.0.
 
 The historical mapping was reconstructed on 2026-10-03. It does not imply that these
 milestones or this roadmap existed at the time. Actual GitHub milestone creation and

diff --git a/app/version.py b/app/version.py
@@ -9,7 +9,7 @@
 import re
 
 
-VERSION = '3.0.0'
+VERSION = '3.1.0'
 
 _REVISION = re.compile(r'[0-9a-f]{40}')
 

diff --git a/docs/project-planning.md b/docs/project-planning.md
@@ -135,6 +135,15 @@ fourteen releases, 210 merged PR mappings and 29 implementation-linked issues.
 immutable image identity and SBOM/provenance verification. Historical backfill
 snapshots remain unchanged.
 
+Applied on **2026-11-14**: v2.7.0 and v3.0.0 had been published without a native
+milestone. [Milestone 13](https://github.com/bifrost0x/webssh/milestone/13) (v2.7.0,
+16 PRs and #303) and [milestone 14](https://github.com/bifrost0x/webssh/milestone/14)
+(v3.0.0, 5 PRs and #312) were created from the manifest mapping, verified and
+closed. The proposed [v3.1.0 milestone](https://github.com/bifrost0x/webssh/milestone/15)
+holds the 17 PRs merged since v3.0.0, issues #327 and #334 and release record
+[#338](https://github.com/bifrost0x/webssh/issues/338). The manifest records this in
+`native_milestone_followups`; earlier snapshots remain unchanged.
+
 For historical backfill:
 
 1. Read all existing native milestones before creating anything; reuse matching versions

diff --git a/docs/release-history.json b/docs/release-history.json
@@ -571,7 +571,8 @@
       "release_url": "https://github.com/bifrost0x/webssh/releases/tag/v2.7.0",
       "release_notes": "docs/releases/v2.7.0.md",
       "image_digest": "sha256:1a9ac06d0aca3e88bb8f48d0395b8f87e39d33cb2f19be437cca2b8e193aa5d2",
-      "tag_workflow_url": "https://github.com/bifrost0x/webssh/actions/runs/41798705520"
+      "tag_workflow_url": "https://github.com/bifrost0x/webssh/actions/runs/41798705520",
+      "milestone_number": 13
     },
     {
       "title": "v3.0.0",
@@ -599,7 +600,8 @@
       "release_url": "https://github.com/bifrost0x/webssh/releases/tag/v3.0.0",
       "release_notes": "docs/releases/v3.0.0.md",
       "image_digest": "sha256:126bfd4c2a35f9d1f7424060bced4b7ecf88bd701f33f7ec8398ffe66333b178",
-      "tag_workflow_url": "https://github.com/bifrost0x/webssh/actions/runs/42480130060"
+      "tag_workflow_url": "https://github.com/bifrost0x/webssh/actions/runs/42480130060",
+      "milestone_number": 14
     }
   ],
   "excluded_issues": [
@@ -706,8 +708,79 @@
     ],
     "verification": "All 185 accessible planned items matched their intended milestone through the GitHub API. Browser milestone overview confirmed 10 closed and 1 open. Release-readiness issue #248 remains open. No due dates were added."
   },
-  "candidate": null,
-  "updated_on": "2026-11-08",
+  "native_milestone_followups": [
+    {
+      "applied_on": "2026-11-14",
+      "milestones": [
+        {
+          "number": 13,
+          "title": "v2.7.0",
+          "state": "closed",
+          "url": "https://github.com/bifrost0x/webssh/milestone/13",
+          "assigned_items": 17
+        },
+        {
+          "number": 14,
+          "title": "v3.0.0",
+          "state": "closed",
+          "url": "https://github.com/bifrost0x/webssh/milestone/14",
+          "assigned_items": 6
+        },
+        {
+          "number": 15,
+          "title": "v3.1.0",
+          "state": "open",
+          "url": "https://github.com/bifrost0x/webssh/milestone/15",
+          "assigned_items": 20
+        }
+      ],
+      "verification": "v2.7.0 and v3.0.0 had no native milestone after publication. Both were created from the first-tagged-inclusion mapping above, assigned their PRs and implementation-linked issues, and closed. v3.1.0 holds the 17 PRs first included after v3.0.0, issues #327 and #334 and release record #338. Superseded Dependabot PRs #322 and #323 are not assigned. No due dates were added; milestone creation dates are the actual 2026-11-14 dates."
+    }
+  ],
+  "candidate": {
+    "title": "v3.1.0",
+    "state": "prepared",
+    "previous_release": "v3.0.0",
+    "base_commit": "b7b1ff5b31c61405634196dec96d53b994d6359d",
+    "goal": "Per-host SOCKS5 proxy routes, automation through saved jump hosts, browser login management, workspace presets and script-policy/restore hardening",
+    "compare_url": "https://github.com/bifrost0x/webssh/compare/v3.0.0...main",
+    "release_notes": "docs/releases/v3.1.0.md",
+    "milestone_number": 15,
+    "release_gate": 338,
+    "pull_requests": [
+      317,
+      318,
+      319,
+      320,
+      321,
+      324,
+      325,
+      326,
+      328,
+      329,
+      330,
+      331,
+      332,
+      333,
+      335,
+      336,
+      337
+    ],
+    "issues": [
+      {
+        "number": 327,
+        "implemented_by": 328,
+        "evidence": "GitHub closingIssuesReferences for PR #328"
+      },
+      {
+        "number": 334,
+        "implemented_by": 336,
+        "evidence": "GitHub closingIssuesReferences for PR #336"
+      }
+    ],
+    "publication_status": "Pending final candidate review, CI, tag and native image verification"
+  },
+  "updated_on": "2026-11-14",
   "release_updates": [
     {
       "version": "v2.5.0",

diff --git a/docs/releases/v3.1.0.md b/docs/releases/v3.1.0.md
@@ -0,0 +1,99 @@
+# WebSSH 3.1.0
+
+WebSSH 3.1 adds per-host SOCKS5 proxy routes, automation through saved jump
+hosts and browser login management, and makes everyday connection, command
+and recovery work easier to reach. It also tightens the page script policy and
+restore handling and updates dependencies.
+
+## Highlights
+
+- **SOCKS5 proxy routes.** Saved hosts can select a reusable, user-owned SOCKS5
+  proxy for the terminal and its session SFTP channel, including proxy password
+  authentication, reconnects and persistent sessions. Proxy endpoints pass the
+  SSH network policy; a missing, changed or failed proxy never falls back to a
+  direct connection. Proxy passwords use the encrypted credential store. SOCKS
+  username/password authentication itself is unencrypted between WebSSH and
+  the proxy. (#334, #336, #337)
+- **Automation through saved jump hosts.** Hosts behind one saved jump host are
+  valid automation targets, with the network policy, verified host keys and
+  separate credentials on both hops. Changing the jump host invalidates pending
+  runs and schedules. Finished runs can be deleted, and runs on several hosts
+  can be compared per step. Terminal tabs can be named. (#319, #320)
+- **Updates and restart status.** A new read-only workflow template reports the
+  restart marker and, on Debian/Ubuntu, pending updates without sudo or writes.
+  It runs only when a user starts or schedules it; while a restart hint is shown,
+  each login rereads only the restart marker. (#320, #321)
+- **Browser logins and access transparency.** Users list their active browser
+  logins and revoke selected or all other logins. Disabling an authentication
+  feature previews affected accounts and MFA loss first; deleting a personal
+  host-key entry shows the trust that remains. Multiline and control-character
+  input to several sessions requires a session-bound preview. (#333)
+- **Task-first overview and workspace presets.** Session, favorite and
+  recent-host shortcuts, a first-connection checklist, clearer command details
+  and account-owned workspace presets, listed directly in the Layout menu.
+  Presets store host references and pane choices, never credentials or
+  commands. After a portable restore, a recovery checklist guides
+  re-provisioning. (#332, #333, #335)
+- **Support reports** with an exact preview, generated locally only on request.
+  (#333)
+- **Version display.** Signed-in users see the running version and source
+  commit in the account menu and Settings; sign-in pages do not show it. (#327,
+  #328)
+- **Project support links** in Settings and the account menu. Administrators
+  can hide them under Administration → Integrations. (#331)
+- **Interface languages.** Remaining English labels in the workspace, file
+  manager and quick connect are translated. (#331)
+
+## Security and maintenance
+
+- The page script policy is `script-src 'self'`; inline scripts and handlers
+  moved to static files. (#320)
+- Restore ignores `logs/` and `tmp/` in archives, so an edited backup cannot
+  replace the audit log. (#320)
+- Authlib 1.9.5 (includes the 1.9.3 security fix), python-socketio 5.18.1,
+  Flask-SocketIO 5.7.2 and the Python 3.14.10 base image. Dependabot Python
+  locks are regenerated with the repository lock script. (#324, #325, #326, #328)
+- Architecture diagrams, README entry point and the product-site tour are
+  updated for version 3. (#318, #329, #330)
+
+## Configuration
+
+New optional settings; existing Compose files keep working unchanged:
+
+- `SOCKS_REMOTE_DNS_ALLOWLIST`: exact names a SOCKS5 proxy may resolve while
+  internal targets are blocked. Other names are resolved locally and sent as
+  validated addresses. It is separate from `PROXY_JUMP_REMOTE_DNS_ALLOWLIST`.
+- `SOCKS_PROXY_MAX_RECORDS` (default 100): SOCKS5 proxies per user.
+
+See the [Configuration reference](../wiki/Configuration-Reference.md) and
+[SOCKS5 proxies](../wiki/SSH-Connections-and-Host-Keys.md#socks5-proxies).
+
+## Upgrade and recovery
+
+Preserve the complete persistent data and recovery volumes before upgrading
+and keep the 3.0.0 image pinned by version or digest. The upgrade adds
+database columns and a per-user `socks_proxies.json` store; existing data is
+retained.
+
+Roll back only by restoring the matching pre-upgrade volumes with the 3.0.0
+image. Do not start 3.0.0 on data already used by 3.1: it does not know SOCKS5
+routes and would connect routed hosts directly.
+
+Portable backups include SOCKS5 proxy metadata and exclude proxy passwords,
+like other saved remote passwords. Reload open browser tabs after upgrading.
+
+[Changes from 3.0.0](https://github.com/bifrost0x/webssh/compare/v3.0.0...v3.1.0)
+
+## Image tags
+
+`ghcr.io/bifrost0x/webssh:3.1.0` and `:3.1`; `latest` moves to 3.1.0. The
+`3.0` tag remains on 3.0.0.
+
+## Validation
+
+Publication requires the final candidate to pass tag CI, browser end-to-end,
+SSH and SMB integration, container upgrade and Redis tests, and the native
+AMD64/ARM64 image vulnerability and hardened runtime gates. The release record
+[#338](https://github.com/bifrost0x/webssh/issues/338) tracks the evidence.
+Deployment-specific identity-provider, native-device and SOCKS5 proxy
+acceptance is not inferred from automated CI.
diff --git a/docs/wiki/Upgrading-Rollback-and-FAQ.md b/docs/wiki/Upgrading-Rollback-and-FAQ.md
@@ -55,6 +55,16 @@ the production file removes those previously implicit limits on recreation.
 Existing image-only upgrades do not change container settings. Review the merged
 configuration before recreating containers; keep data and recovery volumes intact.
 
+## v3.1.0 compatibility
+
+The [3.1 release notes](https://github.com/bifrost0x/webssh/blob/main/docs/releases/v3.1.0.md)
+cover the changes. Existing 3.0 Compose files keep working unchanged; the new
+`SOCKS_REMOTE_DNS_ALLOWLIST` and `SOCKS_PROXY_MAX_RECORDS` settings are optional.
+The upgrade adds database columns and a per-user SOCKS5 proxy store. Keep the
+3.0.0 image and the complete pre-upgrade volumes for rollback, and do not start
+3.0.0 on data used by 3.1: it ignores SOCKS5 routes and would connect routed
+hosts directly. Reload open browser tabs after upgrading.
+
 ## v3.0.0 compatibility
 
 The [3.0 release notes](https://github.com/bifrost0x/webssh/blob/main/docs/releases/v3.0.0.md)