v0.18.0

Changed

• DuckDB driver moved to github.com/duckdb/duckdb-go/v2 v2.20000.0, which
  bundles DuckDB v2.0.0 LTS (was github.com/marcboeker/go-duckdb v1.8.5 with
  DuckDB v1.1.3). The old module path no longer receives releases, so the
  analysis engine could never take a DuckDB fix. The UI, the LLM's tool results
  and CSV export render every type as before: MAP now arrives as an ordered map
  and is converted to the same string-keyed form, including a MAP inside a LIST
  or STRUCT. See ADR-0033.
• Sessions created by this release do not open in older versions. DuckDB 2.0
  writes a storage format DuckDB 1.x cannot read. Session databases created
  earlier keep working here and stay readable by v0.17.x after this release has
  used them; a new session — or a .shellagent bundle exported from one — does
  not open in v0.17.x.

Security

• CVE-2026-111497 (Brotli decoder out-of-bounds write) is not fixed yet.
  DuckDB's parquet extension vendors Brotli 1.1.0, and every DuckDB release so
  far — v2.0.0 included — still does; the upstream fix (duckdb/duckdb#27791) was
  unmerged on 2026-10-25. It is reachable when the agent's SQL reads a crafted
  Brotli-compressed Parquet file (read_parquet). This release moves the
  analysis engine onto the maintained driver line so the fix lands as a
  dependency bump once DuckDB ships it.
• Go dependencies with known vulnerabilities reachable from the binary are
  updated: golang.org/x/net v0.60.0 (GO-2026-6617, -6612, -6611, -6610,
  -6603, -5026, -4918), google.golang.org/grpc v1.83.1 (GO-2026-6348,
  -6061), golang.org/x/text v0.42.0 (GO-2026-5970) and
  go.opentelemetry.io/otel v1.44.0 (GO-2026-5506), and grpc further to
  v1.83.2 (GO-2026-6443). govulncheck now reports none reachable.
• Built with Go 1.26.10. The previous release was built with Go 1.26.4,
  whose standard library has reachable vulnerabilities in net/http,
  crypto/tls and crypto/x509 (fixed by 1.26.9 / 1.26.10).

Build

• make build / make dev no longer pass -tags no_duckdb_arrow: the new
  driver's Arrow interface is opt-in, so the tag does nothing and Arrow stays
  out of the binary as before.
• make pins GOTOOLCHAIN=go1.26.10. The wails v2.12.0 CLI's static analysis
  (golang.org/x/tools v0.30.0) cannot read Go 1.27 export data, so under go1.27
  every wails build stopped with internal error: package ... without types was imported from .... Override with GOTOOLCHAIN=... on the command line.

Documentation

• Every document reference resolves again. The move into
  docs/{en,ja}/{reference,history,adr}/ left 46 links pointing at the old flat
  paths — both READMEs' feature lists, the history index, and the cross-links
  between the memory-model reference and its deep dives. Each now points at its
  own language's copy, and the two labels that spelled a different path than
  they linked were corrected with them. check-org.sh resolves these now, so
  the next move is caught rather than discovered.