v0.9.70

- Security: the Fortran capital-F cpp step no longer allows an untrusted `.F`/`.F90` source to read arbitrary host files. `-nostdinc -I /dev/null` did not stop cpp from resolving absolute (`#include "/etc/passwd"`) or traversing (`#include "../../../secret"`) includes, which inlined host-file contents into `graph.json`/`GRAPH_REPORT.md` and the LLM context on the default offline path. Every `#include` directive is now stripped before preprocessing and the source is fed to cpp on stdin; macro expansion is preserved (GHSA-pcc4-rvhr-2pr8, CWE-22/73/200).
- Security: the Aider/Devin monolith `--watch` snippet no longer interpolates the agent-substituted `INPUT_PATH` into a shell command — it now reads the trusted `graphify-out/.graphify_root` written in Step 1, closing the last instance of the shell-injection class from #3642 (#3852, #3844, thanks @hopstreax).
- Security: Terraform secret redaction now also covers a `value` paired with a secret-named `name` in name/value pair lists (`environment = [{ name = "DB_PASSWORD", value = "…" }]`, ECS `valueFrom` included), where the sensitive signal is the sibling `name` literal rather than a key (#3870, #3787, thanks @breken-ai).
- Fix: `graphify watch` now serializes concurrent rebuilds on Windows via `msvcrt` byte-range locking instead of a no-op lock, closing a WinError 32 race between overlapping rebuilds; the POSIX `fcntl` path is unchanged (#3883, #3881, thanks @harshaygadekar).
- Fix: C# type references no longer collect a named tuple's element *names* as type references (`(int Count, string Name)` recorded a bogus ref to `Count`/`Name`); only the element types are referenced (#3877, #3796, thanks @KaiyiQuan).
- Feature: JSX component usage now produces `calls` edges — `<MyButton/>` and `<_Row/>` link to the component, while lowercase DOM tags (`<div>`) and member tags (`<Nav.Item>`) are conservatively skipped, so React component graphs capture render relationships (#3855, #3854, thanks @sinangumuskabak-sys).
- Fix: absolute Python imports that spell the scan root's own nested namespace (`from Company.Apps.Team.lib import x` when the scan root is `Team/`) now resolve to the local module by projecting the namespace prefix onto the scan-root layout (#3867, #3843, thanks @nikhilsaxena04).