chore(deps): update dependencies

[steipete]

Summary

• refresh current Go, web, desktop, package-manager, and Cloudflare dependencies
• refresh pinned GitHub Actions and the Node 26 Alpine container digest
• align pnpm 11.19.0 across package metadata, CI, release automation, and both Dockerfiles
• regenerate the embedded production web bundle on current main

The three Fontsource packages remain on their current releases because their 5.3.0 artifacts replace tracked WOFF2 binaries, which the repository's required pre-commit review deliberately refuses to accept as unreviewable binary content.

Proof

• npx -y pnpm@11.19.0 run check
• npx -y pnpm@11.19.0 run build
• full local Playwright suite: 134 passed in 49.2s
• built the real clickclack executable, started it against SQLite with dev bootstrap, and fetched both / and /api/v1/session: HTTP 200 (6,273 and 5,989 bytes)
• served embedded entries start.CfWZRA5o.js, app.B4wbC3r8.js, and 0.DA0bPGL_.js, matching the regenerated production bundle
• exact-head CI: https://github.com/openclaw/clickclack/actions/runs/30737794589
• exact-head desktop packaging: https://github.com/openclaw/clickclack/actions/runs/30737795638

The first exact-head CI attempt had a single spreadsheet-viewer timeout while 133 tests passed. The focused viewer path passed locally, the full local suite passed, and the unchanged-head rerun passed all jobs.

No release or tag is included.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 3:30 AM ET / 07:30 UTC.

ClawSweeper review

What this changes

Refreshes Go, web, desktop, Cloudflare, package-manager, container, and GitHub Actions dependencies, then regenerates ClickClack’s embedded web bundle.

Merge readiness

⚠️ Needs maintainer review before merge - 4 items remain

This PR remains necessary: current main still uses the older pnpm, container, action, web, desktop, and Go dependency pins. The prior Docker-pnpm mismatch is resolved on the latest head, but Socket’s new warning for the SQLite dependency chain needs a maintainer-aware supply-chain decision before merge.

Priority: P2
Reviewed head: 053a171c9d237d90e3341839e2ca69174f7f1fc2
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The branch has credible live runtime proof and resolves the earlier Docker-pnpm mismatch, but the new supply-chain warning needs owner review before it is merge-ready.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The PR body reports building and starting the real ClickClack executable against SQLite, then receiving HTTP 200 responses from both the root page and session endpoint with regenerated embedded assets served.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR body reports building and starting the real ClickClack executable against SQLite, then receiving HTTP 200 responses from both the root page and session endpoint with regenerated embedded assets served.
Evidence reviewed	6 items	Current main has not implemented the refresh: Current main still pins pnpm 11.13.1 in the production Docker build, while the supplied PR head changes both Dockerfiles and workflows to pnpm 11.19.0 alongside the refreshed lockfile and web bundle. Earlier build-toolchain finding is addressed: The supplied hydrated PR diff for head 053a171 updates both Dockerfiles from pnpm 11.13.1 to 11.19.0, matching the refreshed package-manager declaration and workflow pins; this resolves the earlier Docker/CI toolchain mismatch. Generated asset delivery has existing regression coverage: The API embeds all generated web assets, including underscore-prefixed Svelte chunks, and a current-main test walks the embedded assets and verifies that one is served with HTTP 200.
Findings	None	None.
Security	Needs attention	Assess the modernc.org/libc supply-chain warning: The SQLite update moves the transitive dependency to modernc.org/libc v1.74.4, which Socket reports as likely obfuscated. The alert alone does not establish compromise, but accepting this newly introduced artifact requires an explicit supply-chain decision.

How this fits together

ClickClack compiles its Svelte web client into tracked files embedded in the Go API binary; Docker and GitHub Actions build that same client using pinned Node and pnpm versions. This PR updates those dependency inputs and the resulting browser assets delivered by the API server.

flowchart LR
  A[Dependency manifests] --> B[Package and Go resolvers]
  B --> C[Web and desktop builds]
  E[Docker and CI toolchain pins] --> C
  C --> D[Embedded web bundle]
  D --> F[Go API binary]
  F --> G[Browser and API clients]

Loading

Decision needed

Question	Recommendation
Is the newly introduced modernc.org/libc v1.74.4 dependency acceptable for ClickClack after Socket’s likely-obfuscated-code warning?	Review and accept the dependency: Confirm the modernc.org/libc warning is expected for this upstream dependency and merge after the remaining compatibility checks pass.

Why: The alert is concrete but does not prove a defect that an automated repair can safely fix; accepting, investigating, or declining the upstream dependency is a maintainer supply-chain decision.

Before merge

• Resolve security concern: Assess the modernc.org/libc supply-chain warning - The SQLite update moves the transitive dependency to modernc.org/libc v1.74.4, which Socket reports as likely obfuscated. The alert alone does not establish compromise, but accepting this newly introduced artifact requires an explicit supply-chain decision.
• Resolve merge risk (P1) - The modernc.org/sqlite upgrade introduces modernc.org/libc v1.74.4, which Socket flags as likely obfuscated; accept or investigate that new supply-chain risk explicitly before merge.
• Resolve merge risk (P1) - Independent local review could not fetch several sparse-clone PR-head blobs because GitHub DNS resolution failed, so final merge review should retain the hydrated-diff and CI evidence.

Findings

• [medium] Assess the modernc.org/libc supply-chain warning — go.mod:13

Agent review details

Security

Needs attention: The patch has no demonstrated code-level security defect, but Socket flags a newly introduced transitive SQLite dependency for likely obfuscated code and an owner should explicitly assess that warning before merge.

Review metrics

Metric	Value	Why it matters
Changed surface	71 files; 2,385 additions; 1,876 deletions	Most churn is regenerated embedded web output, but the PR also changes runtime dependencies, Docker builders, and CI workflows.
Dependency commits	5 commits	The branch separately aligns workflow pnpm and Playwright container pins after the initial dependency refresh.

Merge-risk options

Maintainer options:

1. Review and accept the SQLite dependency chain (recommended)
   Inspect the modernc.org/libc warning and merge only if an owner accepts the upstream dependency as expected and the remaining build matrix completes successfully.
2. Pause the SQLite update
   Hold this refresh and retain the previous modernc.org/sqlite version until the flagged transitive dependency is cleared or replaced.

Technical review

Best possible solution:

Keep the aligned dependency and generated-bundle refresh, but merge only after an owner reviews the modernc.org/libc warning and accepts it as expected upstream generated code or replaces the SQLite update with an acceptable version.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-refresh PR, so the relevant proof is real build and runtime validation rather than reproduction of a reported defect. The PR body provides a SQLite-backed executable run with successful root and session HTTP responses.

Is this the best way to solve the issue?

Yes, subject to the supply-chain decision: aligning the declared package-manager, Docker, and CI pins avoids split build toolchains, and regenerating the embedded assets is the repository’s established delivery path.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 3205c07468ab.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The SQLite dependency update introduces a transitive package that Socket flags for likely obfuscated code.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body reports building and starting the real ClickClack executable against SQLite, then receiving HTTP 200 responses from both the root page and session endpoint with regenerated embedded assets served.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P2: This is a broad but non-emergency dependency and build-toolchain refresh affecting production and CI paths.
• merge-risk: 🚨 compatibility: The PR changes browser, desktop, Go SQLite, package-manager, and container dependency versions used by existing deployments.
• merge-risk: 🚨 automation: The PR changes GitHub Action commit pins, CI package-manager pins, and the Playwright container image.
• merge-risk: 🚨 security-boundary: The SQLite dependency update introduces a transitive package that Socket flags for likely obfuscated code.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body reports building and starting the real ClickClack executable against SQLite, then receiving HTTP 200 responses from both the root page and session endpoint with regenerated embedded assets served.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body reports building and starting the real ClickClack executable against SQLite, then receiving HTTP 200 responses from both the root page and session endpoint with regenerated embedded assets served.

Evidence

Security concerns:

• [medium] Assess the modernc.org/libc supply-chain warning — go.mod:13
  The SQLite update moves the transitive dependency to modernc.org/libc v1.74.4, which Socket reports as likely obfuscated. The alert alone does not establish compromise, but accepting this newly introduced artifact requires an explicit supply-chain decision.
  Confidence: 0.84

What I checked:

• Current main has not implemented the refresh: Current main still pins pnpm 11.13.1 in the production Docker build, while the supplied PR head changes both Dockerfiles and workflows to pnpm 11.19.0 alongside the refreshed lockfile and web bundle. (Dockerfile:5, 3205c07468ab)
• Earlier build-toolchain finding is addressed: The supplied hydrated PR diff for head 053a171 updates both Dockerfiles from pnpm 11.13.1 to 11.19.0, matching the refreshed package-manager declaration and workflow pins; this resolves the earlier Docker/CI toolchain mismatch. (Dockerfile:5, 053a171c9d23)
• Generated asset delivery has existing regression coverage: The API embeds all generated web assets, including underscore-prefixed Svelte chunks, and a current-main test walks the embedded assets and verifies that one is served with HTTP 200. (apps/api/internal/webassets/webassets.go:13, 3205c07468ab)
• Supply-chain warning requires an explicit assessment: Socket’s PR comment flags modernc.org/libc v1.74.4, introduced through modernc.org/sqlite v1.55.0, as likely obfuscated. The report does not demonstrate compromise, but it is a concrete newly introduced dependency warning. (go.mod:13, 053a171c9d23)
• Area history and routing: The current Docker/web-asset baseline dates to Shakker’s f8215a3 commit, while Peter Steinberger previously refreshed the release toolchain in 7de5c2a and authored the latest dependency-refresh commits. (Dockerfile:1, 7de5c2ae8d2e)
• Local inspection limitation: A read-only local diff against the PR head could not retrieve several sparse-clone blobs because GitHub DNS resolution failed; branch-only file evidence above therefore uses the hydrated GitHub diff supplied in the review context. (053a171c9d23)

Likely related people:

• steipete: Peter Steinberger authored the prior release-toolchain refresh and the current PR’s dependency, workflow, and compatibility-alignment commits. (role: recent toolchain contributor; confidence: high; commits: 7de5c2ae8d2e, f56507a55a9c, 053a171c9d23; files: package.json, Dockerfile, Dockerfile.cloudflare)
• Shakker: Current Docker build and embedded-web-asset lines trace to f8215a3, which established the production bundle flow affected by this refresh. (role: embedded-web build contributor; confidence: high; commits: f8215a37d22d; files: Dockerfile, Dockerfile.cloudflare, apps/api/internal/webassets/webassets.go)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Have an owner review and explicitly accept or reject the modernc.org/libc warning.
• Let the currently running Docker, desktop, and Playwright checks complete on this head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-08-02T05:40:29.118Z sha f6ebebb :: needs changes before merge. :: [P2] Remove the release-owned changelog entry
• reviewed 2026-08-02T05:49:38.505Z sha 0efe501 :: needs changes before merge. :: [P2] Remove the release-owned changelog entry
• reviewed 2026-08-02T05:59:30.347Z sha f56507a :: found issues before merge. :: [P2] Remove the release-owned changelog entry
• reviewed 2026-08-02T07:13:26.259Z sha f56507a :: needs changes before merge. :: [P2] Align Docker pnpm with the refreshed package-manager version | [P2] Remove the release-owned changelog entry

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​marked@​18.0.7
	npm/​pdfjs-dist@​6.2.108
	golang/​modernc.org/​sqlite@​v1.54.0 ⏵ v1.55.0	-3
	npm/​@​types/​node@​26.1.2
	npm/​@​sveltejs/​kit@​2.70.2
	npm/​vite@​8.2.0
	npm/​oxfmt@​0.61.0
	npm/​svelte@​5.56.8
	npm/​sax@​1.6.1
	npm/​oxlint@​1.76.0
	npm/​wrangler@​4.116.0
	npm/​virtua@​0.50.0
	npm/​electron@​43.2.0
	npm/​@​playwright/​test@​1.62.1
	golang/​github.com/​oklog/​ulid/​v2@​v2.1.1 ⏵ v2.1.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang modernc.org/libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/modernc.org/sqlite@v1.55.0 → golang/modernc.org/libc@v1.74.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/modernc.org/libc@v1.74.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang modernc.org/libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/modernc.org/sqlite@v1.55.0 → golang/modernc.org/libc@v1.74.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/modernc.org/libc@v1.74.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report