fix: release SQLite Explorer 1.8.2

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 1.8.2
+
+### Security
+
+- Update both bundled SQLite engines to 3.54.1, from 3.49.1 (WebAssembly) and 3.51.2 (native). This fixes an FTS5 out-of-bounds access that a crafted database can trigger (CVE-2025-7709, WebAssembly engine), FTS5 heap overflows reachable through SQL while defensive mode is off, which both engines leave off (CVE-2026-11822 and CVE-2026-11824, both engines), and an integer overflow reachable through SQL (CVE-2025-6965, WebAssembly engine). 3.54.1 rather than 3.54.0 because 3.54.0 has a heap overflow on 32-bit builds, which includes WebAssembly.
+- Refuse SQL-level `ATTACH` and `DETACH` on the native engine, so SQL sent to the native worker cannot open, read or write another database file. The bundled runtime enforces the same rule in C, independent of the worker's statement check, and allows only the snapshot file of a running export.
+- Refuse SQL-level `VACUUM INTO` on the native engine, which could create a copy of the open database at any path, even from a read-only connection. Exports keep using it for their own snapshot file.
+
+### Changes
+
+- SQLite 3.54 writes some REAL values as text with up to 17 significant digits, for example `9.6529377952984946e+282` instead of `9.6529377952985e+282`. The grid and exports show SQLite's text where JavaScript would render a REAL differently.
+- The WebAssembly engine includes upstream sql.js fixes for SQL larger than the WebAssembly stack, statement iterator cleanup, error messages thrown by user-defined functions, aggregate initialization over zero rows, and isolated SQL names and function registrations.
+
+### Maintenance
+
+- Resolve all open Dependabot alerts in build tooling and website dependencies. None of the affected packages ship in the extension.
+- Package with `@vscode/vsce` 4.0.0, from 3.9.2. The six VSIX packages contain the same files as before.
+- Make the WebAssembly and query-plan runtime build reproducible with the pinned toolchain (Emscripten 5.0.0 and the official Zig 0.16.0 release): a rebuild from any directory produces identical bytes, and the builder refuses other Zig distributions, whose Linux libraries differ.
+- Link the SQLite Explorer desktop app from the README.
+
 ## 1.8.1
 
 ### Fixes

CLAUDE.md

@@ -395,7 +395,7 @@ Settings in `package.json` → `contributes.configuration`:
 ### Build
 - **WASM not found**: Run `node scripts/build.mjs` if `assets/sqlite3.wasm` is missing
 - **Browser vs Node**: Check `import.meta.env.VSCODE_BROWSER_EXT` for environment-specific code
-- **Query-plan runtime**: `src/runtime/query-plan.c` bounds plan compilation and extraction on the primary connection. `node scripts/build-query-plan.mjs` builds the five native libraries and the WASM runtime from that file and pinned sql.js commit `424163d6c9c34acec7bac07eb2cecedd86185a60`. It requires Emscripten 5.0.0 and Zig 0.16.0; use `--emcc PATH` and optionally `--sqljs-source GIT_CHECKOUT`. The source checkout is read through `git archive` at the pin. `scripts/refresh-sqljs.mjs` delegates to this builder. Native Explain uses the primary connection's signalled `Database.allAsync` so cancel RPCs remain deliverable without losing TEMP or pending transaction state. `scripts/refresh-natives.mjs` pins the tested `master` commit, Actions run, and hashes for all five native targets.
+- **Query-plan runtime**: `src/runtime/query-plan.c` bounds plan compilation and extraction on the primary connection. `node scripts/build-query-plan.mjs` builds the five native libraries and the WASM runtime from that file and pinned sql.js commit `3181cc5ee888d3251228d3995c32bf9ea03c3240` and SQLite amalgamation 3.54.1. It requires Emscripten 5.0.0 and the official Zig 0.16.0 release (`zig cc --version` must report `clang version 21.1.0`; distribution builds such as Homebrew's are refused); use `--emcc PATH` and optionally `--sqljs-source GIT_CHECKOUT`. The source checkout is read through `git archive` at the pin. `scripts/refresh-sqljs.mjs` delegates to this builder. Native Explain uses the primary connection's signalled `Database.allAsync` so cancel RPCs remain deliverable without losing TEMP or pending transaction state. `scripts/refresh-natives.mjs` pins the tested `master` commit, Actions run, and hashes for all five native targets.
 - **Runtime artifact gate**: `vendor/query-plan-manifest.json` records source and output hashes. Normal builds verify it before bundling. Regenerate runtime changes with the builder; do not edit native libraries, WASM/glue, or the manifest by hand. `node scripts/build-query-plan.mjs --check` verifies all copies.
 
 ## Extension Identifiers

README.md

@@ -2,7 +2,7 @@
 
 A powerful, open-source SQLite database viewer and editor for Visual Studio Code.
 
-**[Try it in your browser](https://sqlite-explorer.zknpr.xyz/demo)** | **[Website](https://sqlite-explorer.zknpr.xyz/)** | **[Changelog](CHANGELOG.md)**
+**[Try it in your browser](https://sqlite-explorer.zknpr.xyz/demo)** | **[Desktop app](https://github.com/zknpr/SQLite-Explorer-App)** | **[Website](https://sqlite-explorer.zknpr.xyz/)** | **[Changelog](CHANGELOG.md)**
 
 ![SQLite Explorer](media/main.png)
 
@@ -134,6 +134,12 @@ Or from the command line:
 code --install-extension zknpr.sqlite-explorer
 ```
 
+### Desktop app
+
+SQLite Explorer also runs as a standalone desktop application, no VS Code required. It uses the same viewer inside a Tauri shell and ships packages for macOS (Apple Silicon `.dmg`), Linux (x86-64 `.deb`) and Windows (x86-64 installer). Download them from the [SQLite Explorer App releases](https://github.com/zknpr/SQLite-Explorer-App/releases).
+
+The packages are not signed with a publisher identity yet, so macOS and Windows warn on first launch. The app's [install notes](https://github.com/zknpr/SQLite-Explorer-App#install) cover the first-launch steps and checksum verification.
+
 ## Usage
 
 1. Open any `.sqlite`, `.db`, or `.sqlite3` file in VS Code