[raspbeguy]

Release 3.1.0. This PR sets VERSION to 3.1.0, regenerates the spec, turns ## [Unreleased] into ## [3.1.0] - 2026-10-11, and adds "Shipped in 3.1.0" to the roadmap. Nothing else changes.

What is in 3.1.0

The full list is in the [3.1.0] section of CHANGELOG.md, and scripts/release-notes.sh turns that section into the GitHub Release body.

• Added:
  • system/cron_jobs (feat: manage /etc/crontabs/root one line at a time through system/cron_jobs #193).
  • dhcp/hosts.match_tag (feat: dhcp/hosts.match_tag, and refuse dnsmasq syntax in name and tag #199).
• Fixed:
  • A dhcp/hosts reservation on a taken IP is refused (fix: refuse a dhcp/hosts reservation IP another host already holds #186).
  • An unreadable authorized_keys no longer loses keys (fix: an unreadable authorized_keys was read as empty, so the next write dropped every other key #194).
  • A full filesystem no longer empties authorized_keys or the crontab (fix: a full filesystem emptied authorized_keys or the crontab, and three smaller review findings #198).
  • A package install retries after a refresh (fix: a package install failed on a cached index younger than apk's 4-hour refresh age #195).
  • Package versions are complete (fix: a package version was cut to its release suffix when the version held no tilde #196).
  • The spec and SBOM links name the right project (fix: the provider link pointed at a registry namespace that does not exist #190).
• Security: dhcp/hosts refuses dnsmasq syntax in name and tag. A newline in name could add any dnsmasq directive (feat: dhcp/hosts.match_tag, and refuse dnsmasq syntax in name and tag #199).
• Internal: a moved tag no longer leaves an unpublished draft release (fix: a moved tag left its release as an unpublished draft #189).

Pre-release checklist

Item	State
Candidate sweep	Done. dhcp/hosts.match_tag was eligible and is in (#199). Two stale roadmap entries were fixed (#200). No open issues, PRs or due deprecations.
VERSION matches the tag	3.1.0
info.version in the spec	3.1.0 (make openapi-check)
scripts/changelog-missing.sh v3.0.0 prints nothing, [Unreleased] renamed	yes
Versions announced ahead of time	none: no doc names 3.1.0
make test coverage	green: 1287 tests, direct coverage 80.6%
CI green on the commit to tag	green on this PR (unit, lint, integration). main runs again after the merge, before the tag
.github/release-signers.asc holds the signing key	yes: E4B5C3548E3CFB30, present on the maintainer machine
build/sdk.sha256 pins all four arch SDKs	unchanged since 3.0.0; OPENWRT_VERSION is still 25.12.5
verify-arch-build dispatch	green on this branch (run 38090362982): aarch64_generic, arm_cortex-a7 and mips_24kc all built

Does this change the wire surface?

The release itself does not: it only carries the version bump. The wire changes it ships are additive (system/cron_jobs, dhcp/hosts.match_tag), plus one tightening: dhcp/hosts.name and tag now refuse a comma, a double quote, a #, a control character and a blank value. That uses the carve-out in docs/versioning.md and has a Security entry, because each refused value broke dnsmasq or injected config. So this is a minor release.

Was it verified against a real device, or only by CI?

Both. On the test VM (OpenWrt 25.12.5), with the full main tree deployed:

• Integration tests: 05, 26, 28, 50 and 51 passed.
• Direct checks of each change:
  • fix: refuse a dhcp/hosts reservation IP another host already holds #186: a duplicate IP got 422, and dnsmasq kept running.
  • fix: the provider link pointed at a registry namespace that does not exist #190: the served spec and a locally built SBOM name openwrt-iac/uapi.
  • feat: manage /etc/crontabs/root one line at a time through system/cron_jobs #193: a cron job posted through the API ran at the next minute.
  • fix: a package install failed on a cached index younger than apk's 4-hour refresh age #195: an install on a stale index, and on a stale index with one feed down, both succeeded.
  • fix: a package version was cut to its release suffix when the version held no tilde #196: versions are complete.
  • fix: a full filesystem emptied authorized_keys or the crontab, and three smaller review findings #198: a write on a full tmpfs answered 500 and kept the old crontab.
  • feat: dhcp/hosts.match_tag, and refuse dnsmasq syntax in name and tag #199: a real DHCP client on an isolated bridge measured what match_tag matches, and the name and tag injection was reproduced and then refused.

The whole series was then reviewed as one diff, from v3.0.0 to main. That review found the four problems fixed in #198, and the review of #199 found the problems fixed in its second commit.

The live router was not touched.

Was LuCI checked?

Per change, in each PR. Not applicable to the release commit itself.

🤖 Generated with Claude Code