chore(deps): refresh dependencies

[steipete]

Summary

• Refresh github.com/charmbracelet/x/ansi 0.11.7 → 0.11.8.
• Refresh SHA-pinned GitHub Actions: github/codeql-action 4.37.6 → 4.37.7 and trufflesecurity/trufflehog 3.96.0 → 3.97.0; immutable commit pins are preserved.
• Held: none.
• Supersedes Dependabot PRs build(deps): bump github.com/charmbracelet/x/ansi from 0.11.7 to 0.11.8 #93, build(deps): bump the codeql-action group with 2 updates #94, and build(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 #95.

Verification

• go mod tidy
• go vet ./...
• go test -count=1 ./... — all 17 packages passed.
• go build -o /private/tmp/t30-crawlctl ./cmd/crawlctl
• Real compiled CLI smokes: crawlctl --help and crawlctl --version, both exit 0.
• go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... — no reachable vulnerabilities.
• Structured pre-commit Codex review: clean.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 23, 2026, 11:50 AM ET / 15:50 UTC.

ClawSweeper review

What this changes

The PR updates the Charmbracelet ANSI module and refreshes immutable CodeQL and TruffleHog GitHub Action pins.

Merge readiness

⛔ Blocked until stronger real behavior proof is added - 5 items remain

Keep open: this is a coherent consolidation of current dependency updates that are not on main or in v0.14.7, but it needs inspectable after-fix proof for the direct TUI consumer before merge.

Priority: P3
Reviewed head: 85cf7e0d5e3066e53b652c70ffc68b429a363cb0

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is narrowly scoped and consistent with current pinning, but inspectable real behavior proof is still required.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: The PR claims successful CLI smokes but provides no redacted after-fix output or TUI evidence for the direct ANSI consumer; add such proof to the PR body to trigger re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The PR claims successful CLI smokes but provides no redacted after-fix output or TUI evidence for the direct ANSI consumer; add such proof to the PR body to trigger re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Current main and latest release still use old versions: Current main and v0.14.7 retain ansi v0.11.7, CodeQL v4.37.6, and TruffleHog v3.96.0, so the requested refresh is not already implemented. ANSI module has a concrete runtime consumer: The terminal browser imports ansi and uses it for stripping, width calculation, and terminal-safe line cutting. Workflow pins remain immutable: The PR changes all three action references to full commit SHAs without broadening workflow permissions or altering scan inputs.
Findings	None	None.
Security	None	None.

How this fits together

The Go module supplies crawlkit’s terminal browser, while GitHub workflows run static analysis and verified-secret scanning. This PR changes the dependency resolution and automation versions that feed those two surfaces.

flowchart TD
A[Go module and checksums] --> B[Dependency resolver]
B --> C[Terminal archive browser]
D[CodeQL and secret scan pins] --> E[GitHub Actions]
E --> F[Analysis and secret-scan results]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The PR claims successful CLI smokes but provides no redacted after-fix output or TUI evidence for the direct ANSI consumer; add such proof to the PR body to trigger re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The CodeQL update intentionally changes the default analysis bundle; its successful check on this head is encouraging, but accepting the scanner-version change remains an automation risk.
• Resolve merge risk (P1) - The stated crawlctl smoke has no inspectable output and crawlctl does not import the tui package, leaving the sole direct ansi consumer without after-fix real-behavior proof.
• Resolve merge risk (P1) - The structured autoreview helper could not run because the local review ref has no merge base; this review used the supplied patch and direct file comparisons instead.
• Complete next step (P2) - No narrow repair is identified; the remaining merge gate is contributor-supplied real-behavior proof plus routine workflow completion.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch size	6 added, 6 removed across 4 files	The refresh is narrowly limited to one module, its checksums, and two workflow definitions.
Pinned action updates	3 action references updated; 3 full SHA pins retained	The workflow changes update executable third-party actions without weakening immutable pinning.

Merge-risk options

Maintainer options:

1. Accept the pinned scanner update (recommended)
   Accept the upstream CodeQL bundle update after the remaining required workflows complete without a scan regression.

Technical review

Best possible solution:

Land one SHA-pinned consolidated refresh after required CI completes and a redacted terminal proof demonstrates the TUI’s ANSI-dependent rendering on the updated module.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a report of broken behavior; source inspection identifies the affected TUI consumer.

Is this the best way to solve the issue?

Yes, one consolidated update is preferable to landing three overlapping dependency PRs, provided it includes TUI-facing after-fix proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1ae588d4fad5.

Labels

Label changes:

• add P3: This is a small routine dependency and CI-maintenance update with limited product blast radius.
• add merge-risk: 🚨 automation: The PR changes CodeQL and secret-scanning action versions, including CodeQL’s analysis bundle behavior.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR claims successful CLI smokes but provides no redacted after-fix output or TUI evidence for the direct ANSI consumer; add such proof to the PR body to trigger re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a small routine dependency and CI-maintenance update with limited product blast radius.
• merge-risk: 🚨 automation: The PR changes CodeQL and secret-scanning action versions, including CodeQL’s analysis bundle behavior.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR claims successful CLI smokes but provides no redacted after-fix output or TUI evidence for the direct ANSI consumer; add such proof to the PR body to trigger re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current main and latest release still use old versions: Current main and v0.14.7 retain ansi v0.11.7, CodeQL v4.37.6, and TruffleHog v3.96.0, so the requested refresh is not already implemented. (go.mod:10, 1ae588d4fad5)
• ANSI module has a concrete runtime consumer: The terminal browser imports ansi and uses it for stripping, width calculation, and terminal-safe line cutting. (tui/tui.go:24, 85cf7e0d5e30)
• Workflow pins remain immutable: The PR changes all three action references to full commit SHAs without broadening workflow permissions or altering scan inputs. (.github/workflows/codeql.yml:25, 85cf7e0d5e30)
• Current baseline provenance: The prior module and workflow versions on main trace to the v0.14.7 release commit, authored by the same area contributor. (.github/workflows/secret-scan.yml:52, 00a94648f6f2)
• Autoreview harness limitation: The bundled review helper could not construct its branch diff because this review checkout records the PR head as a grafted commit without a local merge base; the four-file GitHub patch and direct base-to-head file comparison were reviewed manually.

Likely related people:

• steipete: Git blame and path history attribute the current released dependency and security-workflow baseline to Peter Steinberger; this PR updates that same surface. (role: recent dependency and workflow baseline contributor; confidence: high; commits: 00a94648f6f2, 85cf7e0d5e30; files: go.mod, .github/workflows/codeql.yml, .github/workflows/secret-scan.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Post a redacted terminal transcript or screenshot exercising the TUI’s ANSI-dependent rendering on the updated module.
• Let the remaining required CI workflows complete on this exact head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.