release: v0.3.1 — first stable v0.3.x on @latest

[kokevidaurre]

Summary

Bumps to 0.3.1. Skipping 0.3.0 because that slot is reserved by a deprecated historical pre-release (Jan 2026 cleanup). npm enforces version immutability, so we cannot republish 0.3.0.

0.3.1 is the smallest available version after 0.3.0-rc.1 in the v0.3.x line.

Why this works

• Tag v0.3.1 is clean semver (no - suffix) → release.yml publishes to @latest via OIDC
• Content is identical to 0.3.0-rc.1 (already burned in on @next)
• Existing @next users on 0.3.0-rc.1 continue to work; they can move to @latest with npm i -g squads-cli@latest

Post-merge steps

git checkout main && git pull
git tag v0.3.1
git push origin v0.3.1   # release.yml publishes 0.3.1 to @latest

Test plan

• CI green
• After tag push: npm view squads-cli dist-tags shows latest: 0.3.1
• npm i -g squads-cli (no tag) installs 0.3.1
• squads --version outputs 0.3.1

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[gemini-code-assist]

Code Review

This pull request updates the version of the squads-cli package from 0.3.0 to 0.3.1 in both package.json and package-lock.json. A critical security concern was raised regarding the presence of several dependency versions (such as @anthropic-ai/sdk ^0.71.2 and vitest ^4.0.16) that do not exist on the public npm registry, which may indicate a dependency confusion or supply chain attack.

[gemini-code-assist]

The version bump is consistent, but the project's dependencies and lockfile contain several version numbers that do not exist on the public npm registry (e.g., @anthropic-ai/sdk ^0.71.2, vitest ^4.0.16, eslint ^9.39.2, and typescript resolved to 5.9.3 in package-lock.json). This is a critical security indicator of a potential dependency confusion attack or a compromised supply chain. Please verify the legitimacy of these versions and ensure they are sourced from a trusted registry before proceeding with this release.