chore(deps): refresh compatible Go dependencies and tooling

[steipete]

This maintenance candidate has been incorporated into #170 through normal merges. Keep #171 open until the integrated #170 is reviewed and merged; it should not be merged separately.

Refresh the supported Go 1.26 toolchain and compatible dependencies without changing the Go release series. Source builds, Docker, and installation documentation now agree on Go 1.26.8.

Update SQLite to 1.58.0, go-runewidth to 0.0.29, and the current pprof/golden snapshots. Update the Dockerfile frontend from 1.26 to 1.27 and the secret-scanning Action from TruffleHog 3.97.1 to 3.97.4. Other Actions and pinned development tools were checked against upstream metadata and are current.

CrawlKit remains at 0.14.7: #170 requires Go 1.27 and needs a separate decision about the supported build baseline. This change keeps that migration separate from compatible maintenance updates.

SQLite's generated runtime explicitly requires libc 1.75.6. Keep that exact version, with a short comment explaining the constraint. Upstream dependency requirement.

Validation:

• Built the real CLI with Go 1.26.8 and the final dependency versions. Reopened an archive seeded by the main-branch binary, resynced a synthetic pull request through a local HTTP API, found it through full-text search, and passed SQLite integrity_check.
• make check passes with Go 1.26.8 and its matching formatter: tidy, format, vet, govulncheck, deadcode, full suite (85.1% coverage), CLI smoke, release-script tests, and all six snapshot targets. No vulnerabilities found.
• Autoreview at P2 is clean after retaining SQLite's required libc version.

The final Dockerfile frontend update was independently reviewed at P2 with no findings. The Go source and dependency set retain the complete local proof above; Docker CI validates the updated frontend.

Final-head CI for 97885c502493631916983a60a6bdad963e9b3029 is green: Linux/macOS CI, Docker build and runtime smoke, secret scanning, and managed CodeQL. The docs site also builds successfully with node scripts/build-docs-site.mjs.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 4, 2026, 4:30 AM ET / 08:30 UTC.

ClawSweeper review

What this changes

Updates the Go 1.26 patch baseline, SQLite and three indirect dependencies, Docker build tooling, secret scanning, and matching installation documentation.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep open: the updates are absent from current main and v0.9.4, and both PR descriptions explicitly defer this branch to the still-open integrated candidate. No actionable patch defect was found; the earlier runtime-proof gap remains.

Priority: P3
Reviewed head: 97885c502493631916983a60a6bdad963e9b3029

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and internally consistent, but its reported runtime validation remains insufficiently observable.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The captured body describes the updated CLI exercising archive reopening, HTTP sync, search, and integrity checking through Gitcrawl's SQLite storage, but supplies no observable results or fresh-initialization output. Successful recorded CI is supplemental; inaccessible linked logs are a reviewer limitation, not failed validation. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The captured body describes the updated CLI exercising archive reopening, HTTP sync, search, and integrity checking through Gitcrawl's SQLite storage, but supplies no observable results or fresh-initialization output. Successful recorded CI is supplemental; inaccessible linked logs are a reviewer limitation, not failed validation. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	12 items	Verified introduced scope: The local merge-base-to-head diff matches the supplied seven-file introduction evidence. It changes dependency versions, build tooling, documentation, and the changelog; no application source or schema migration is introduced. Current main still uses the previous dependencies: Fetched main retains Go 1.26.7, SQLite 1.57.0, and the previous indirect dependency versions; its Dockerfile retains frontend 1.26. Latest release does not contain the update: The supplied latest release, v0.9.4, also declares Go 1.26.7 and SQLite 1.57.0.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl mirrors GitHub issues and pull requests into a local SQLite archive for search and triage. These dependency and build-tool updates affect the CLI, its archive operations, Docker builds, and repository secret scanning.

flowchart LR
  A[Go dependencies and build tools] --> B[Gitcrawl CLI and Docker image]
  C[GitHub responses] --> B
  D[Existing archive] --> E[SQLite storage]
  B --> E
  E --> F[Search and triage results]
  G[Repository changes] --> H[Secret scanning]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The captured body describes the updated CLI exercising archive reopening, HTTP sync, search, and integrity checking through Gitcrawl's SQLite storage, but supplies no observable results or fresh-initialization output. Successful recorded CI is supplemental; inaccessible linked logs are a reviewer limitation, not failed validation. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - Source builds pinned to Go 1.26.7 with automatic toolchain updates disabled will require an upgrade to 1.26.8; the documentation states the new minimum.
• Resolve merge risk (P1) - The SQLite runtime update affects existing archives, but the supplied evidence does not expose the reported preservation, search, and integrity results.
• Resolve merge risk (P1) - The supplied merge state is dirty and no pinned test merge is available; standalone landing would require renewed merge review, without evidence that this branch removes current-main behavior.
• Complete next step (P2) - Keep this branch unmerged pending chore(deps): update CrawlKit and build with Go 1.27.1 #170; before any standalone merge, resolve its merge state and supply the outstanding redacted runtime evidence.

Agent review details

Security

None.

Review metrics

None.

Root-cause cluster

Relationship: partial_overlap
Canonical: #170
Summary: Both descriptions designate the related PR as the integrated landing candidate, but it also changes CrawlKit and the Go release series and remains unmerged.

Members:

• canonical: chore(deps): update CrawlKit and build with Go 1.27.1 #170 - The explicitly designated integration candidate includes these maintenance updates alongside the separate Go 1.27 baseline change.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Keep the integrated landing path (recommended)
   Leave this branch unmerged while the integrated candidate establishes its build baseline and archive compatibility.
2. Revalidate a standalone candidate if needed
   If the integrated candidate is withdrawn, refresh this branch and provide observable fresh-install and existing-archive results before considering it separately.

Technical review

Best possible solution:

Land one validated dependency set through the integrated candidate, with visible archive-compatibility results and a documented build baseline.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this maintenance PR does not report a specific existing-behavior bug, and source inspection found no concrete introduced defect.

Is this the best way to solve the issue?

Yes, the coordinated version updates are a bounded maintenance approach; the explicit integrated landing path avoids independently landing competing toolchain baselines.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 3c9e6d58548f.

Labels

Label justifications:

• P3: This is routine dependency and tooling maintenance with no demonstrated urgent user regression.
• merge-risk: 🚨 compatibility: The source-build minimum rises and the SQLite runtime changes beneath existing archives, whose upgrade results remain unobserved.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The captured body describes the updated CLI exercising archive reopening, HTTP sync, search, and integrity checking through Gitcrawl's SQLite storage, but supplies no observable results or fresh-initialization output. Successful recorded CI is supplemental; inaccessible linked logs are a reviewer limitation, not failed validation. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Verified introduced scope: The local merge-base-to-head diff matches the supplied seven-file introduction evidence. It changes dependency versions, build tooling, documentation, and the changelog; no application source or schema migration is introduced. (go.mod:3, 97885c502493)
• Current main still uses the previous dependencies: Fetched main retains Go 1.26.7, SQLite 1.57.0, and the previous indirect dependency versions; its Dockerfile retains frontend 1.26. (go.mod:3, 3c9e6d58548f)
• Latest release does not contain the update: The supplied latest release, v0.9.4, also declares Go 1.26.7 and SQLite 1.57.0. (go.mod:3, 274881750869)
• Explicit integrated landing candidate: Both captured PR bodies say the maintenance commits were incorporated into chore(deps): update CrawlKit and build with Go 1.27.1 #170 and that this PR should remain open without merging separately until that candidate lands. The supplied GitHub metadata identifies the integrated candidate as open and unmerged.
• Runtime proof and review continuity: Captured sourceRevision d305817298d8838b5e5e1205f9012a0bcb39e8ac6153274e1b9609a0306d0866 reports a Go 1.26.8 CLI reopening a main-seeded archive, syncing through local HTTP, finding a result, and passing integrity_check. It supplies no terminal output for that scenario or fresh initialization. The previous completed review examined this same head, had no findings, and requested observable runtime results. Supplemental checks are recorded as successful. (97885c502493)
• Concrete storage dependency boundary: Gitcrawl opens archives through CrawlKit's store and directly registers a SQLite scalar function in internal/store/sqlite_timestamp.go. The changed SQLite requirement therefore affects real archive operations. The libc pin remains 1.75.6; its exact-version rationale is supplied by the PR, whose upstream link could not be inspected here. (internal/store/store.go:63, 97885c502493)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach terminal output or terminal screenshots identifying the tested build and showing fresh initialization, existing-archive reopening, sync, search, and integrity results.
• Redact credentials, IP addresses, private endpoints, and other private details; updating the PR body should trigger re-review, or a maintainer can comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-04T08:05:16.563Z sha 1eebb3d :: needs real behavior proof before merge. :: none
• reviewed 2026-09-04T08:18:23.498Z sha 97885c5 :: needs real behavior proof before merge. :: none

[steipete]

Absorbed into #170, now merged as 3413039cbab09f778dbbc486f275eaa5e9b3bfb1.

Both commits from this branch—1eebb3d75243f471f7bb22d80b4ecce8c4416f69 and 97885c5—were incorporated through normal merges into the reviewed #170 head, bec2e08. The actual squash merge tree exactly matches that reviewed candidate. The integrated version uses the approved Go 1.27.1 baseline and retains SQLite's exact libc 1.75.6 constraint.

The integrated candidate passed full checks at 85.6% coverage and actual CLI old-archive reopening, HTTP sync, full-text search, integrity checking, and malformed-cursor preservation tests. Post-merge Linux/macOS CI, Docker build/runtime, managed CodeQL, secret scanning, and docs all passed on the actual merge commit.

Closing this PR as absorbed; it has not been merged separately.