[housejester]

Bumps every @malloydata/* dependency from 0.0.435 to 0.0.436. @malloydata/malloy-explorer stays at 0.0.338-dev260215172810, as in the previous upgrade.

Why

0.0.436 carries malloydata/malloy#3173, which makes Runtime.getBuildTargets usable by a builder: a source whose SQL cannot be generated is reported in unbuildable instead of failing the whole plan, and the call takes a build's own givens and virtualMap. That is what Publisher needs to plan materialization builds from getBuildTargets rather than the deprecated Model.getBuildPlan; that port follows as its own PR. This one changes no Publisher code, so the upgrade's behavior changes can be reviewed on their own.

Breaking-change review

The upstream range is v0.0.435..v0.0.436, eleven commits. What changed in the API, and why none of it breaks Publisher:

Upstream change	Publisher impact
Model.getBuildPlan, PersistSource.getSQL and PersistSource.makeBuildId deprecated for builders; getSQL binds the model's givens before generating SQL (malloydata/malloy#3173)	Publisher still calls all three; they work as before. getSQL returns the same SQL for a source that reads no given, and Publisher refuses to persist one that does. build_targets_address_equality.spec.ts pins that every address is unchanged.
Importing a persisted source whose SQL reads a given the importer cannot supply is a translate error (malloydata/malloy#3173)	Behavior change, described in the release note.
qtz export renamed queryZone; every dialect does time through one civil-time contract (malloydata/malloy#3145)	No reference to qtz, and Publisher implements no dialect. The result changes are described in the release note.
A boolean is a condition, never a value, on a dialect without boolean values (malloydata/malloy#3147); datetimeoffset is a timestamptz (malloydata/malloy#3138)	SQL Server only; generated SQL on every other dialect is unchanged. Behavior change, described in the release note.
A refinement keeps the view's written order_by (malloydata/malloy#3136)	Behavior change, described in the release note.
Snowflake defaults authenticator to SNOWFLAKE_JWT when given a private key without one (malloydata/malloy#3172)	None. Publisher sets authenticator: "SNOWFLAKE_JWT" itself whenever it passes a key.
BigQuery dbmeta connection option (malloydata/malloy#3117)	None. Off unless set, and Publisher's BigQuery connection schema has no such field.
Tag.toString() quotes a string value that would read back as a number (malloydata/malloy#3141)	The SDK's dropValueUrlTags re-serializes a tag through toString(); such a value now round-trips as a string.
@malloydata/render/format entry (malloydata/malloy#3140)	Additive.

Changes

• @malloydata/* pins go from ^0.0.435 to ^0.0.436 in the root package.json resolutions, packages/server, packages/sdk and packages/create-malloy-package. bun.lock is relocked and holds no 0.0.435 entry.
• The @malloydata/render tooltip patch is regenerated for 0.0.436. Render 0.0.436 still opens a tooltip where the previous one was until the mouse moves, and the 0.0.435 patch does not apply to it: the bundle's minified names changed, so the old UMD hunk would splice 0.0.435 identifiers into it and leave a bundle that does not parse. The new patch makes the same edit against 0.0.436's names.
• examples/storefront/public/vendor/malloy-filter.js is regenerated. Only the version line in its header changed.
• RELEASE_NOTES.md gains an [Unreleased] section for the behavior changes above.

Testing

• bun install --frozen-lockfile: no changes.
• bun run typecheck, bun run build: pass.
• test:server (unit, component, integration), test:sdk, test:app, test:examples: pass.
• The patched render bundle parses (node --check), and both bundles carry the patched tooltip.
• node scripts/release-notes.mjs extract reads the new heading, and prettier --check RELEASE_NOTES.md passes.

Not verified

The SQL Server changes are covered by upstream tests against SQL Server 2017 and 2022; I did not run a SQL Server model through Publisher. The tooltip patch was checked by inspecting the patched bundle, not in a browser.