[debba]

Update DuckDB and its build dependencies, QUIC/TLS, tar, rand and Tokio. The DuckDB update removes the vulnerable zip/rkyv dependency entries rather than ignoring their advisories. Remove the obsolete lucide_icon manifest field rejected by the live schema.

Prepare patch release 0.1.2, keeping the plugin RPC and capability contract unchanged. Release builds use --locked. Add build/test and scheduled security-audit CI so dependency regressions are caught before release.

Validation: cargo audit reports zero vulnerabilities and no warnings, without ignores; the manifest passes the live registry schema. cargo test --locked --all-targets builds successfully (this repository has no unit tests); runtime SQL smoke is being checked before release.

GitNexus pre-commit scope check found only dependency, version, documentation and workflow changes; no existing Rust functions were edited.

[kilo-code-bot]

Kilo Code Review could not run — your account is out of credits.

Add credits or switch to a free model to enable reviews on this change.

[debba]

Validation update: the built plugin successfully fetched one real story over HTTPS and executed both a table query and SELECT 42 through DuckDB over the real JSON-RPC boundary. The security audit is clean without ignores.