chore: release 0.3.1

Patch release for the fixes from the Codex review of 0.3.0: ticker
validation and encoded cache file names (path traversal via a ticker),
cross-process ownership DB locking, history-preserving snapshot sync,
and MCP input limits. MSRV is now 1.89.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.lock

@@ -901,7 +901,7 @@ dependencies = [
 
 [[package]]
 name = "idx-cli"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "assert_cmd",
  "chrono",
@@ -921,7 +921,7 @@ dependencies = [
 
 [[package]]
 name = "idx-core"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "chrono",
  "clap",
@@ -940,7 +940,7 @@ dependencies = [
 
 [[package]]
 name = "idx-mcp"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "clap",
  "idx-core",

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/idx-core", "crates/idx-cli", "crates/idx-mcp"]
 
 [workspace.package]
-version = "0.3.0"
+version = "0.3.1"
 edition = "2024"
 rust-version = "1.89"
 license = "MIT"
@@ -11,7 +11,7 @@ repository = "https://github.com/0xrsydn/idx-cli"
 homepage = "https://github.com/0xrsydn/idx-cli"
 
 [workspace.dependencies]
-idx-core = { path = "crates/idx-core", version = "=0.3.0" }
+idx-core = { path = "crates/idx-core", version = "=0.3.1" }
 clap = { version = "4", features = ["derive"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["raw_value"] }

README.md

@@ -13,7 +13,7 @@ curl -fsSL https://raw.githubusercontent.com/0xrsydn/idx-cli/main/install.sh | s
 Downloads the prebuilt `idx` binary for your platform from GitHub Releases,
 verifies it against the release `SHA256SUMS`, and installs it into
 `~/.local/bin` without sudo. Pin a version or change the directory with
-`sh -s -- --version v0.3.0 --dir ~/bin`. See [docs/INSTALL.md](docs/INSTALL.md).
+`sh -s -- --version v0.3.1 --dir ~/bin`. See [docs/INSTALL.md](docs/INSTALL.md).
 
 ### npm / npx
 

docs/INSTALL.md

@@ -11,7 +11,7 @@ Each release also carries a copy of the script as a release asset, so a
 versioned URL stays stable:
 
 ```bash
-curl -fsSL https://github.com/0xrsydn/idx-cli/releases/download/v0.3.0/install.sh | sh
+curl -fsSL https://github.com/0xrsydn/idx-cli/releases/download/v0.3.1/install.sh | sh
 ```
 
 ## What it does
@@ -45,7 +45,7 @@ them yourself.
 Pass flags through the pipe with `sh -s --`:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/0xrsydn/idx-cli/main/install.sh | sh -s -- --version v0.3.0 --dir ~/bin
+curl -fsSL https://raw.githubusercontent.com/0xrsydn/idx-cli/main/install.sh | sh -s -- --version v0.3.1 --dir ~/bin
 ```
 
 ## Supported platforms

docs/NPM_DISTRIBUTION.md

@@ -38,7 +38,7 @@ npx idx-cli --help
 ```
 
 The package version and the release tag must match. For example, package
-version `0.3.0` downloads assets from the `v0.3.0` GitHub Release.
+version `0.3.1` downloads assets from the `v0.3.1` GitHub Release.
 
 The postinstall script downloads `SHA256SUMS` from the same release and
 refuses to install a binary whose checksum does not match.
@@ -88,7 +88,7 @@ URLs must stay aligned with `scripts/install.js`.
 To attach binaries to a tag that already exists, run the workflow manually:
 
 ```bash
-gh workflow run release.yml -f tag=v0.3.0
+gh workflow run release.yml -f tag=v0.3.1
 ```
 
 Pull requests that touch the workflow or the installer run the build jobs

npm/idx-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "idx-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "MCP server for Indonesian stock market (IDX) market, financial, and ownership data",
   "license": "MIT",
   "repository": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "idx-cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "CLI tool for Indonesian stock market (IDX) analysis",
   "license": "MIT",
   "repository": {