From 86d224c905565a4628ca7e348ae0881e68ddf924 Mon Sep 17 00:00:00 2001
From: Michael Freeman <mfreeman451@gmail.com>
Date: Tue, 18 Aug 2026 22:41:20 -0500
Subject: [PATCH] chore: release v1.4.37

---
 CHANGELOG                                     | 25 +++++++++++++++++++
 VERSION                                       |  2 +-
 ....argocd-source-serviceradar-demo-prod.yaml |  2 +-
 helm/serviceradar/Chart.yaml                  |  4 +--
 4 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index a1bbead930..69d36c27fb 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,28 @@
+# ServiceRadar v1.4.37
+
+Keeps nist-nvd2 from filling the node, stops Falco Critical from
+filling the Fatal card, and force-refills the 24-hour log-severity
+rollup.
+
+## Whats New
+
+**1.4.37**
+- Advisory feeds: leftover nist-nvd2 extracts are pruned every
+  scheduler tick, a dedicated cleanup worker reaps orphans after
+  Oban `:kill`, downloads refuse to start when staging is over
+  budget, and finalize no longer statement-timeouts the generation
+  swap. Demo and farm01 can keep the CPE catalog enabled. (PR #3795)
+- Software tab: vuln matches for a device use a partial
+  `(device_uid, kev, exploit, cvss, last_seen)` index instead of
+  scanning the global priority index. (PR #3795)
+- Observability: `severity_text` `critical` (Falco/Trivy priority)
+  counts as Error, not Fatal. The 24-hour log-severity CAGG
+  force-refreshes when coverage lags. (PR #3797)
+- Hex: waive unpatched cowlib EEF-CVE-2026-43971 until a Hex
+  release exists. (PR #3797)
+- CI: the SRQL fixture CA is no longer published on the shared
+  gateway. (PR #3799)
+
 # ServiceRadar v1.4.36
 
 Dashboard layout fix on top of the published 1.4.35 artifacts.
diff --git a/VERSION b/VERSION
index f2d2f271e8..b242277136 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.4.36
+1.4.37
diff --git a/helm/serviceradar/.argocd-source-serviceradar-demo-prod.yaml b/helm/serviceradar/.argocd-source-serviceradar-demo-prod.yaml
index 2fc9bf66fc..86622efbae 100644
--- a/helm/serviceradar/.argocd-source-serviceradar-demo-prod.yaml
+++ b/helm/serviceradar/.argocd-source-serviceradar-demo-prod.yaml
@@ -1,7 +1,7 @@
 helm:
   parameters:
   - name: global.imageTag
-    value: v1.4.36
+    value: v1.4.37
     forcestring: true
   - name: image.name
     value: registry.carverauto.dev/serviceradar/serviceradar-web-ng
diff --git a/helm/serviceradar/Chart.yaml b/helm/serviceradar/Chart.yaml
index 461c8f9bf0..62eaf56653 100644
--- a/helm/serviceradar/Chart.yaml
+++ b/helm/serviceradar/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: serviceradar
 description: Helm chart for deploying the ServiceRadar 
 type: application
-version: 1.4.36
-appVersion: "1.4.36"
+version: 1.4.37
+appVersion: "1.4.37"