release: prepare 0.3.0

[KARTIKrocks]

Summary

Closes the [Unreleased] section as [0.3.0] and cuts the matching docs snapshot. No code changes.

0.3 gets a snapshot rather than just version markers because it changes documented behaviour three times over, not merely adds to it:

Change	Why /docs/ must keep describing 0.2
Redaction over-redacts around an ambiguous backslash	The fingerprint a query groups under moves, splitting N+1 counts
explain refuses input it used to accept	A single statement with ; inside a dollar-quoted body is now rejected
--format json moved from stderr to stdout	> out.json produced an empty file in 0.2

Type of change

• Bug fix
• New detection rule
• New integration / parser
• Feature / enhancement
• Docs only
• Refactor / chore

Checklist

• make ci passes (fmt-check, vet, lint, vuln, test-race, lint-docs) across all modules
• Added/updated tests (and, where practical, a failure-mode check)
• Updated docs under website/docs/ with a version marker for anything new — never website/versioned_docs/
• Updated AGENTS.md / .sqlguard.example.yml if a convention or config key changed
• Added an entry under ## [Unreleased] in CHANGELOG.md
• No new third-party deps in analyzer / middleware / reporter
• Findings stay redaction-safe (no raw literals leak into a Result)

No tests and no AGENTS.md change: this adds no behaviour. versioned_docs/ is written here, which is the one time that is correct — cut-version.mjs creates the snapshot; no existing snapshot was edited.

What is deliberately not here

The satellite pinning. CONTRIBUTING.md has the root tag going first and the satellites pinned to it afterwards, so the eight go.mod files still require v0.2.0 — they cannot point at v0.3.0 until it exists. Sequence after this merges:

1. git tag v0.3.0 && git push origin v0.3.0
2. go mod edit -require …@v0.3.0 across the eight satellites, make tidy && make test
3. Commit that, tag each satellite, push

Verification

• GOWORK=off make test — all 14 packages pass. This is the check that matters for a release: go.work normally hides a satellite compiling against a core version it does not actually require, so this is the only run that sees what a consumer's build sees.
• Full Docusaurus production build across both live snapshots, clean under onBrokenLinks: 'throw'.
• make ci green apart from lint-docs on an untracked local scratch file outside this branch.
• No hardcoded version constant anywhere in Go, so nothing else needed bumping.
• maxLiveVersions is 4 and versions.json now holds ["0.3", "0.2"], so 0.2 stays live and nothing was pushed out of the served set.

Version markers were left in place: the rule in VERSIONING.md drops a marker only once it names a version older than the oldest live snapshot, and 0.2 is still live.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: KARTIKrocks/sqlguard/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 09e07d7d-76d0-4dac-b6cd-ec661aee549e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}