v0.3.1

A single security fix on top of 0.3.0.

Security

• A 409-recovery no longer records a mapping onto another resource's WorkOS
  row. When a create raced and the proxy recovered by resolving the resource
  through a userName/displayName filter, it adopted whatever row WorkOS
  returned — including one this directory already mirrors under a different id.
  A holder of a directory's proxy token could use that to make one resource's id
  alias another's, and a later DELETE would then remove the other resource's
  WorkOS row while the native side reported nothing wrong. The recovery now
  refuses to record a mapping onto a WorkOS id already claimed by a different
  resource, closing the last of the id-aliasing write paths.

Container image

# pin this: a digest is the only reference that cannot change under you
docker pull ghcr.io/workos/scim-bridge@sha256:6ac7ac4b26c5eca426fb2fe0dd5cdde021e21c38631c400cfaea6ed297b2ae12

docker pull ghcr.io/workos/scim-bridge:0.3.1

linux/amd64 and linux/arm64 under one manifest list.
:0.3 follows patch releases of 0.3; :latest follows every release
and is for trying it out, not for running it.

---

What's Changed

• proxy: Refuse a 409 recovery onto another resource's row by @jonatascastro12 in #131
• release: Document 0.3.0/0.3.1 and bump to 0.3.1 by @jonatascastro12 in #132
• ci: Exempt the rolling major.minor tag from the release overwrite guard by @jonatascastro12 in #133

Full Changelog: v0.3.0...v0.3.1