chore(deps-dev): bump code-review-graph from 2.3.6 to 2.3.7 - #174

Sourced from code-review-graph's releases.

v2.3.7

code-review-graph 2.3.7

Maintainer-reconciliation release containing the verified work merged since v2.3.6. The four client-validation drafts remain excluded. No breaking changes.

Highlights

• expanded CLI-first workflows, CommonJS parsing, quiet/JSON output, enrichment, and dead-code analysis
• broader Terraform, Ansible, VB.NET, SystemVerilog, Rust, PHP/Laravel, Julia, Python, C#, Java, Spring, and WebFlux graph coverage
• bounded transitive test coverage, churn risk, weighted impact ranking, graph provenance, documentation-aware embeddings, and safe JSON export
• safer uninstall and platform configuration, including CodeBuddy and official OpenCode contracts
• hardened MCP concurrency, daemon lifecycle, Windows process handling, Git path parsing, ignore rules, community detection, and visualization layout
• updated supported dependency and GitHub Action versions, plus secure fork-PR review handling
• closed all three open high-severity CodeQL alerts

Validation

• release PR: 15/15 checks passed
• merged main commit: 13/13 checks passed
• wheel and source distribution built successfully with version 2.3.7

See CHANGELOG.md for the detailed release notes and PR references.

Sourced from code-review-graph's changelog.

[2.3.7] - 2026-07-18

Maintainer-reconciliation release. This release packages the verified work merged since v2.3.6: broader language and framework coverage, safer graph and CLI workflows, platform-install hardening, daemon reliability, and the final CodeQL security fixes. The four client-validation drafts remain excluded. No breaking changes.

Added

• Expanded CLI-first workflows with CommonJS require() parsing, ten focused graph commands, quiet and JSON output, bounded enrichment, and dead-code analysis (PRs #95, #340, and #341).
• Added safe Java and Spring modeling for request endpoints, WebFlux routes, value-redacted application configuration, scheduled triggers, application events, Lombok constructor injection, runtime callbacks, and method references (PRs #462, #577, #589, #590, and #591).
• Added repository-bounded PHP/Laravel semantics and Julia qualified-scope parsing, plus evidence-backed typed-member resolution, Python star-import expansion, Python class decorators, and C# inheritance edges (PRs #628, #638, #639, #643, #647, and #649).
• Added bounded transitive test coverage, opt-in churn risk, weighted impact-radius ranking, and graph provenance on MCP responses (PRs #636, #640, #644, and #646).
• Added CodeBuddy Code MCP configuration and project skills using its official shared project contract (PR #633).
• Added Terraform/OpenTofu structural parsing for resources, data sources, modules, variables, outputs, locals, providers, and expression references. References resolve across sibling files in a Terraform module, and local module sources connect to parsed target files (PR #514; Terraform portion of #199).
• Added Ansible playbook, role, task, handler, notification, include, and role dependency extraction with qualified graph relationships, duplicate-task disambiguation, and ordinary-YAML false-positive guards (PR #415).
• Added bounded VB.NET structural parsing for namespaces, types, generics, multiline members, properties, calls, inheritance, and interfaces. Same-file targets resolve case-insensitively only when scope evidence is unique, and overloads share one stable graph symbol (replacing PR #517).
• Expanded SystemVerilog structure with ports, nets, parameters, packages, typedefs, modports, port references, and verification declarations. Function locals are excluded rather than promoted to module globals, and signal nodes no longer pollute function risk, flow, dead-code, or size analyses (PR #522).
• Corrected Rust trait and impl identity, preserving one concrete type across repeated implementation blocks. Nested/aliased use trees, Self and turbofish calls, and bounded cached Cargo path/workspace dependency resolution now retain their original graph targets (replacing PR #526).
• Added an explicit local JSON visualization export. The output is written atomically inside the ignored graph data directory and is documented as potentially containing absolute paths and code-structure metadata (PR #449).
• Functions and classes now retain a bounded, first-paragraph documentation

... (truncated)

• 6a1ee1c release: v2.3.7 (#659)
• 0a3bd6c fix(security): resolve open CodeQL alerts (#657)
• 996bd46 Revert "feat(platform): add safe IBM Bob MCP support"
• eb7642c Merge pull request #468 after tested maintainer reconciliation
• 38a4092 Merge pull request #540 after tested maintainer reconciliation
• 88f0523 Merge pull request #458 after tested maintainer reconciliation
• 160bcef Merge pull request #457 after tested maintainer reconciliation
• 4241c74 Merge pull request #341 after tested maintainer reconciliation
• f82078c Merge pull request #340 after tested maintainer reconciliation
• 42efb4f Merge pull request #95 after tested maintainer reconciliation
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)