chore: release 1.9.1

Security and reliability patch.

- core: bound the regex replace scan per file (CPU deadline + match cap) so
  a pathological fancy-regex pattern can no longer peg a core on a large file,
  mirroring the search hot path's existing guards
- build: pin grexa-db to release tag v1.9.1 for reproducible resolution and
  restore cargo-deny to green (allow-git source, CC0-1.0 license, explicit
  grexa-db version requirement)
- chore: drop hardcoded absolute build paths from committed config and docs;
  gitignore the repo-root peer-review scratch file

Author: visorcraft

.gitignore

@@ -27,6 +27,10 @@
 /CLAUDE.md
 /GEMINI.md
 
+# Peer-review scratch: `opencode run` diff/context must live inside the repo
+# (the build agent sandbox auto-rejects external paths). Transient — never commit.
+/_review_diff.txt
+
 # Local design/planning scratch (kept local, not committed)
 /docs/superpowers/
 

Cargo.lock

@@ -10,7 +10,7 @@ members = [
 resolver = "3"
 
 [workspace.package]
-version = "1.9.0"
+version = "1.9.1"
 edition = "2024"
 license = "GPL-3.0-only"
 repository = "https://github.com/visorcraft/grexa"

Cargo.toml

@@ -24,4 +24,6 @@ accepted = [
     "Unicode-3.0",
     "Unlicense",
     "Zlib",
+    # Mirrors deny.toml [licenses].allow.
+    "CC0-1.0",
 ]

about.toml

@@ -1,3 +1,3 @@
 [General]
-buildDir="/work/repos/visorcraft/grexa/target/cxxqt/qml_modules"
+buildDir="../../target/cxxqt/qml_modules"
 no-cmake-calls=true

apps/grexa-gui/.qmlls.ini

@@ -8,11 +8,11 @@ repository.workspace = true
 description = "Grexa Qt 6 / Kirigami GUI shell"
 
 [dependencies]
-grexa-ai = { version = "1.9.0", path = "../../crates/grexa-ai" }
-grexa-containers = { version = "1.9.0", path = "../../crates/grexa-containers" }
-grexa-core = { version = "1.9.0", path = "../../crates/grexa-core" }
-grexa-db = { git = "https://github.com/visorcraft/grexa-db" }
-grexa-i18n = { version = "1.9.0", path = "../../crates/grexa-i18n" }
+grexa-ai = { version = "1.9.1", path = "../../crates/grexa-ai" }
+grexa-containers = { version = "1.9.1", path = "../../crates/grexa-containers" }
+grexa-core = { version = "1.9.1", path = "../../crates/grexa-core" }
+grexa-db = { git = "https://github.com/visorcraft/grexa-db", tag = "v1.9.1", version = "1.9.1" }
+grexa-i18n = { version = "1.9.1", path = "../../crates/grexa-i18n" }
 notify = "6"
 regex.workspace = true
 serde_json.workspace = true

apps/grexa-gui/Cargo.toml

@@ -7,7 +7,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
-grexa-core = { version = "1.9.0", path = "../grexa-core" }
+grexa-core = { version = "1.9.1", path = "../grexa-core" }
 keyring-core.workspace = true
 zbus-secret-service-keyring-store.workspace = true
 serde.workspace = true

crates/grexa-ai/Cargo.toml

@@ -12,8 +12,8 @@ clap.workspace = true
 clap_complete.workspace = true
 clap_mangen.workspace = true
 ctrlc.workspace = true
-grexa-containers = { version = "1.9.0", path = "../grexa-containers" }
-grexa-core = { version = "1.9.0", path = "../grexa-core" }
+grexa-containers = { version = "1.9.1", path = "../grexa-containers" }
+grexa-core = { version = "1.9.1", path = "../grexa-core" }
 serde_json.workspace = true
 tracing.workspace = true
 tracing-appender.workspace = true

crates/grexa-cli/Cargo.toml

@@ -7,7 +7,7 @@ license.workspace = true
 repository.workspace = true
 
 [dependencies]
-grexa-core = { version = "1.9.0", path = "../grexa-core" }
+grexa-core = { version = "1.9.1", path = "../grexa-core" }
 libc = "0.2"
 regex.workspace = true
 serde.workspace = true

crates/grexa-containers/Cargo.toml

@@ -11,7 +11,7 @@ chardetng.workspace = true
 encoding_rs.workspace = true
 fancy-regex.workspace = true
 globset.workspace = true
-grexa-db = { git = "https://github.com/visorcraft/grexa-db" }
+grexa-db = { git = "https://github.com/visorcraft/grexa-db", tag = "v1.9.1", version = "1.9.1" }
 icu_casemap.workspace = true
 icu_locale_core.workspace = true
 icu_properties.workspace = true