chore: release v1.4.37

CHANGELOG

@@ -1,3 +1,28 @@
+# ServiceRadar v1.4.37
+
+Keeps nist-nvd2 from filling the node, stops Falco Critical from
+filling the Fatal card, and force-refills the 24-hour log-severity
+rollup.
+
+## Whats New
+
+**1.4.37**
+- Advisory feeds: leftover nist-nvd2 extracts are pruned every
+  scheduler tick, a dedicated cleanup worker reaps orphans after
+  Oban `:kill`, downloads refuse to start when staging is over
+  budget, and finalize no longer statement-timeouts the generation
+  swap. Demo and farm01 can keep the CPE catalog enabled. (PR #3795)
+- Software tab: vuln matches for a device use a partial
+  `(device_uid, kev, exploit, cvss, last_seen)` index instead of
+  scanning the global priority index. (PR #3795)
+- Observability: `severity_text` `critical` (Falco/Trivy priority)
+  counts as Error, not Fatal. The 24-hour log-severity CAGG
+  force-refreshes when coverage lags. (PR #3797)
+- Hex: waive unpatched cowlib EEF-CVE-2026-43971 until a Hex
+  release exists. (PR #3797)
+- CI: the SRQL fixture CA is no longer published on the shared
+  gateway. (PR #3799)
+
 # ServiceRadar v1.4.36
 
 Dashboard layout fix on top of the published 1.4.35 artifacts.

VERSION

@@ -1 +1 @@
-1.4.36
+1.4.37

helm/serviceradar/.argocd-source-serviceradar-demo-prod.yaml

@@ -1,7 +1,7 @@
 helm:
   parameters:
   - name: global.imageTag
-    value: v1.4.36
+    value: v1.4.37
     forcestring: true
   - name: image.name
     value: registry.carverauto.dev/serviceradar/serviceradar-web-ng

helm/serviceradar/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: serviceradar
 description: Helm chart for deploying the ServiceRadar 
 type: application
-version: 1.4.36
-appVersion: "1.4.36"
+version: 1.4.37
+appVersion: "1.4.37"