v3.7.0

• 3 fresh CVE rules from the daily intel pipeline — June 2026 advisories for mainstream libraries: DOMPurify XSS (CVE-2026-47423), React Router 7 cluster (XSS / deserialization RCE / DoS), and Better Auth device-authorization bypass (CVE-2026-45337)
• Precise semver matching: a caret/tilde range that resolves to the fixed patch is not flagged; validated 0 false positives across the corpus, 22 new version-range tests
• 441 rules / 37 tools; gate green (PASS/A/0)