chore(deps): bump cartog from 0.10.1 to 0.13.2

[dependabot]

Bumps cartog from 0.10.1 to 0.13.2.

Release notes

Sourced from cartog's releases.

v0.13.2

[0.13.2] - 2026-04-28

Bug Fixes

• db: Wrap index_directory Phase 3 in a single transaction (e7d854b)
• db: Tighten transaction contract docs + e2e rollback test (7cf281d)

Documentation

• architecture: Add layered incremental-indexing design doc (0494056)

Miscellaneous

• security: Bump rustls-webpki to 0.103.13 (RUSTSEC-2026-0104) (c4e0f0c)

v0.13.1

[0.13.1] - 2026-04-21

Bug Fixes

• languages: Panic on multi-byte UTF-8 in markdown extractor (5d731d6)

v0.13.0

[0.13.0] - 2026-04-17

Documentation

• Add editor-integration page (Neovim / VS Code / Emacs / Zed) (#30) (86b94de)
• Fix debounce default, add LSP recall caveat, add docs index (8a23aaa)
• Sync post-lsp-default-sweep across README, docs, site, skill (e20d523)

Features

• cli: Cartog manpage subcommand + release artifact (#19) (199f0ee)
• rag: User-tunable retrieval + rerank knobs via .cartog.toml (#20) (32beae8)
• mcp: Cap tool-response size with overflow hint (#22) (694d123)
• db: Typed DbError for the open + migration path (#23) (6ae11d6)
• rag,cli: Lazy reranker loading + [rag] section in cartog config (#25) (1208a9f)
• cli: Cartog --version prints build SHA + features (#26) (06986bb)
• watch: Cartog watch --json streams NDJSON events (#27) (9feeb02)
• lsp: Enable lsp feature by default (ca06cd8)

v0.12.2

[0.12.2] - 2026-04-15

Bug Fixes

• plugin: Remove invalid agents field from manifest (a5a6655)

... (truncated)

Changelog

Sourced from cartog's changelog.

[0.13.2] - 2026-04-28

Bug Fixes

• Remove redundant clippy-flagged test assertion and enforce fmt/clippy in AGENTS.md (203825b)
• Format error (515cd67)
• extract: Capture calls in package-level var/const initializers (3735bd6)
• search: Rank definitions above variables/imports in search results (bdfa966)
• ci: Resolve gitleaks false positive on fixture fake API key (9ef398d)
• ci: Remove deprecated os and use cross binaries (5804ed5)
• skill: Add "show me" trigger patterns to cartog skill description (fe7020f)
• Update quinn-proto 0.11.13 -> 0.11.14 (RUSTSEC-2026-0037 DoS) (68b0399)
• Do exceed limit description (ecd612d)
• Address review findings — chunking, CTE, migration logging (3970e5c)
• Embedding chunking review — UTF-8 safety, false positive filters, docs (0907fee)
• plugin: Restore marketplace.json with distinct name (c477286)
• Let llm find skill direcotry (1505530)
• site: Restore feature-card transition, fix hover border-top override, revert unauthorized padding/radius (cd99119)
• site: Remove dead stats CSS rules, remove redundant install-options grid override (5f2078a)
• workspace: Mark library crates as publish = false, fix cargo-deny policy (53ae662)
• fixtures: Add standalone workspace to Rust fixture (072bf1c)
• publish: Add version to workspace deps and fix release pipeline (4b516dd)
• publish: Publish all workspace crates in dependency order (a724b96)
• publish: Enable crates.io publishing for all workspace crates (f453017)
• publish: Increase delay between crate publishes to 60s (a260010)
• ci: Upgrade GitHub Actions to Node.js 24 compatible versions (776bb2d)
• rag: Prevent silent vector index wipe and cache providers (51aad71)
• db: Preserve stored embedding dimension when caller passes default (9667a15)
• site: Correct stale #compare nav anchor to #why (2c9576f)
• db: Correct column mapping in search() and refs() queries (8f6f7ae)
• cli: Handle --kind all in search and changes commands (83d3fab)
• db: Wrap multi-statement deletes in transactions (45aca44)
• db: Add chunking guards and reorder migration (8fef1b1)
• indexer: Prevent symlink loops and fix dedup collision bug (e5acbc4)
• lsp: Detect EOF in read_headers to avoid infinite loop (ac0ea59)
• doctor: Improve robustness of health checks (7d3931c)
• mcp: Suppress dead_code warning on tool_router field (b123928)
• plugin: Remove .mcp.json to avoid duplicate MCP server with plugin (1bee808)
• plugin: Use CLAUDE_PLUGIN_ROOT for hook script path (0f91692)
• plugin: Remove invalid agents field from manifest (a5a6655)
• languages: Panic on multi-byte UTF-8 in markdown extractor (5d731d6)
• db: Wrap index_directory Phase 3 in a single transaction (e7d854b)
• db: Tighten transaction contract docs + e2e rollback test (7cf281d)

Documentation

• skill: Document cartog search command and progressive narrowing workflow (693f47e)
• Rewrite README to lead with benchmarks and add demo GIF (01ea332)
• Consolidate documentation and add conventions (2afcb0a)
• Rewrite tech.md with comprehensive design decisions and rationale (71d5a90)

... (truncated)

Commits

• 1cb3b9a chore: bump version to 0.13.2
• 67818b8 Merge pull request #34 from jrollin/fix/indexer-atomicity
• c4e0f0c chore(security): bump rustls-webpki to 0.103.13 (RUSTSEC-2026-0104)
• 7cf281d fix(db): tighten transaction contract docs + e2e rollback test
• ddbbdcf bench(indexer): add ONNX-free indexing benchmarks
• 0494056 docs(architecture): add layered incremental-indexing design doc
• e7d854b fix(db): wrap index_directory Phase 3 in a single transaction
• 2226a04 chore: bump version to 0.13.1
• a6ff9ab Merge pull request #33 from jrollin/fix/markdown-char-boundary-panic
• 5d731d6 fix(languages): panic on multi-byte UTF-8 in markdown extractor
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #29.