Bump richard-burhans/galaxy-tool-refactor from 0.3.3 to 0.3.7

[dependabot]

Bumps richard-burhans/galaxy-tool-refactor from 0.3.3 to 0.3.7.

Changelog

Sourced from richard-burhans/galaxy-tool-refactor's changelog.

[0.3.7] — 2026-07-04

Added

• upgrade --block-consider: the opt-in strict behaviour gate (registry docs/decisions.md D28, cli D22, mcp D8). The --modernize / --target-profile walk can now also stop at applicable consider-level Galaxy behaviour changes, not only must_fix — a review-everything mode for users who want no unreviewed behaviour-adjacent change at all (Galaxy emits one consider code unconditionally at 16.04, so most low-baseline tools stop immediately; that is why it is opt-in, never the default). Requires a walk mode, cannot be combined with --allow-behavior-change (the new typed UpgradeFlagConflict), threads through the imported-@PROFILE@ token bump, and is exposed over MCP as upgrade_tool(block_consider=…). The stop report additionally offers dropping the flag when it is what stopped the walk.

Changed

• Malformed-XML refusals now explain the way forward (issue #303; fmt docs/decisions.md §D23). Every command that declines a file the XML parser rejects now prints the parser's per-location detail plus a note saying the toolchain works only on well-formed XML (it never guesses at intended structure), what to do next, and a link to the new "What the toolchain can and cannot fix" guide section. One shared renderer (cli_support.report_malformed_xml) replaces the six per-command copies of the old one-line message.

[0.3.6] — 2026-06-25

Changed

• The 24.2 test-case checker now models <repeat> (codemod docs/decisions.md §54). all_test_cases_provably_clean — the toolchain's own port of Galaxy's strict 24.2 test-case validator, which tightens the 24_2_fix_test_case_validation detector — previously bailed on any <repeat>. It now validates repeat instances against the inner scope with Galaxy's min/max and pad-to-min semantics, proving more tools clean so upgrade (the behaviour gate) and check no longer flag them for 24.2. Across the public corpus the provably-clean count rises by 79 tools, with zero unsound suppressions (the test-case-validation-truth parity oracle holds at 0).

Fixed

• 24.2 test-case checker: an uppercase hex color value is no longer treated as valid (codemod §54). Galaxy's ensure_color_valid accepts only lowercase #rrggbb; the checker's _COLOR pattern allowed uppercase, which the new <repeat> coverage exposed as a reachable unsound case. Tightened to match Galaxy exactly.
• GTR032 (lone-& advisory): the classifier now applies bash backslash-escaping (lint docs/decisions.md D39). Outside single quotes a \ escapes the next character, so an escaped \" / \' no longer toggles quote state and a literal \& is not counted as a shell-join operator; inside single quotes \ stays literal. A precision fix to a detect-only check — corpus-neutral (the class distribution is unchanged), no behaviour change.

[0.3.5] — 2026-06-21

... (truncated)

Commits

• 01d437b release: 0.3.7 (#311)
• c1afcb6 docs(mcp): Goal 2 design proposal — agent-authored rules (#310)
• 0beb813 docs: galaxy-dependency audit — inventory verified complete + CI guard (#309)
• 5e7e4be feat(scripts): scheduled deployment-ceiling re-poll, fail-closed (#308)
• 4acc83f corpus: scheduled stats refresh (#304)
• b5d923a docs(coverage): 2nd tools-iuc datapoint + monthly scheduled snapshot (#307)
• 0103122 feat(upgrade): --block-consider, the opt-in strict behaviour gate (#306)
• 1e8145a fix(cli): malformed-XML refusals explain the way forward (#305)
• bdcda84 docs(guide): align the audience pages with the shipped repo-scale auto-fix sy...
• 5e01291 release: 0.3.6 (#301)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[richard-burhans]

Deployment status: skipped

https://github.com/richard-burhans/galaxytools/actions/runs/35263075733