chore: prepare release v3.0.1

[freshtonic]

Prepares the 3.0.1 release, following the same shape as the 3.0.0 prep (#444).

Version

• [workspace.package] version bumped 3.0.0 → 3.0.1 in the root Cargo.toml, with cargo update --workspace run so Cargo.lock matches (only the workspace crates' own versions change).

Changelog

• The [Unreleased] content is now the ## [3.0.1] - 2026-08-05 section: 2 Added, 5 Fixed and 3 Security entries, covering PRs fix(proxy): stop the JSON selector fusion leaking plaintext (CIP-3682) #435, fix(proxy): refuse statements on a legacy eql_v2_encrypted column instead of serving it as plaintext (CIP-3688) #437, fix(mapper): inference hardening — LIMIT/FETCH, UPDATE targets, unmatched statements (CIP-3700) #439, fix(mapper): close inference gaps on AST fields of type-checked statements (CIP-3699) #440, fix(proxy): protocol desync on transformation error after a mapped statement (CIP-3678) #441 and fix(mapper): make the late native fallback for unresolved value nodes fail closed (CIP-3715) #442.
• Also repairs the link references at the bottom of the file, which the 3.0.0 release had left stale: [Unreleased] still compared from v2.2.4 and [3.0.0] had no link at all. Both now resolve, and [3.0.1] is added.

Verification

• mise run check — exit 0.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workspace package version changed to 3.1.0. The changelog now includes the 3.1.0 release heading and updated comparison links.

Changes

Release metadata

Layer / File(s)	Summary
Version and changelog update Cargo.toml, CHANGELOG.md	The workspace version changed from 3.0.0 to 3.1.0. The changelog adds the 3.1.0 release date and updates version comparison links.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• cipherstash/proxy#444: Both PRs update the workspace version and changelog for consecutive releases.

Suggested reviewers: coderdan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes release preparation but names v3.0.1, while the changes prepare the v3.1.0 release.	Change the title to "chore: prepare release v3.1.0".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/prepare-3.1.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Around line 9-10: Update CHANGELOG.md so the top-level [Unreleased] section
contains a user-facing entry for this change under the appropriate Keep a
Changelog subsection, or explicitly document a release-specific exception before
the 3.1.0 entries.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d9049819-f4c6-4565-85d2-6677479250d0

📥 Commits

Reviewing files that changed from the base of the PR and between 73c6b2e and d235c5d.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• Cargo.toml

[freshtonic]

Superseded by a correctly-named branch — same commit, new PR incoming.