v0.18.1

Build

• Built with the current Go again. Wails moved from v2.12.0 to v2.16.0,
  whose CLI reads Go 1.27, so the GOTOOLCHAIN=go1.26.10 pin in app/Makefile
  is gone. In its place, make build / make dev refuse a wails CLI other than
  the version in app/go.mod and print the install command — a stale CLI is
  what broke the build.
• The release zip no longer carries macOS file metadata. make package
  zipped the app with plain ditto -c -k, which stores each file's extended
  attributes as ._* AppleDouble entries (9 of them in the v0.18.0 build).
  It now passes --norsrc --noextattr, and make verify-release runs
  scripts/verify-app-zip.sh — the org's copy — which refuses a zip with
  metadata entries or without the app icon. The published v0.18.0 zip was
  re-zipped this way from the same notarized app before upload; v0.17.1 and
  earlier zips still carry the entries (the app inside is unaffected).

Security

• The read tools can no longer write. query_sql, quick_summary,
  analyze_data, export-sql-to-csv and the body of save_query decided
  "read-only" by checking that the SQL did not start with one of nine keywords.
  A second statement after a semicolon passed and ran (SELECT 1; DROP TABLE t
  dropped the table), as did WITH … INSERT, COPY … TO, ATTACH, SET,
  CALL and EXPLAIN ANALYZE. The engine now enforces it in three layers: the
  query must be one statement of type SELECT as DuckDB's parser classifies it;
  agent SQL runs on a throwaway in-memory instance with the session file
  attached READ_ONLY, so DuckDB refuses every write to it — a data-modifying
  CTE (WITH d AS (DELETE … RETURNING *) SELECT …), dbgen / dsdgen, and SQL
  run through json_execute_serialized_sql, which a read-only transaction did
  not stop; and the configuration is locked with extension autoinstall/autoload
  off, which refuses enable_profiling / enable_logging (both wrote files
  from a plain SELECT) and extension installs. save_query runs its body the same
  way into a staging file and copies only the result table into the session.
  DESCRIBE, SUMMARIZE, SHOW, FROM t and WITH … SELECT still work;
  EXPLAIN and dynamic PIVOT are now refused; reading local files with
  read_csv & co. remains possible. See ADR-0034.