chore(deps): refresh runtime and worker toolchains

[steipete]

Summary

• update Google API and OpenTelemetry modules to the newest compatible releases
• update the email-tracking worker's Cloudflare types, formatter, and linter
• regenerate Go and pnpm lock data and reconcile the Unreleased changelog bullet

Wrangler 4.119.0 was published during this sweep but is blocked by the repository's minimum-release-age supply-chain policy; 4.118.0 remains the newest eligible version.

Proof

• make ci
• make worker-ci
• built CLI: version/help/schema commands execute successfully
• served the Worker locally with Wrangler and fetched /health (200 ok) plus an unknown route (404)
• autoreview clean: no accepted/actionable findings

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 5, 2026, 9:17 AM ET / 13:17 UTC.

ClawSweeper review

What this changes

Refreshes the CLI's Google API and OpenTelemetry dependencies and the Gmail tracking Worker's Cloudflare types, formatter, linter, and corresponding lockfiles.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: this collaborator-authored, bounded dependency refresh is not already on current main and has no source-backed correctness finding; it should proceed through normal review once the in-progress platform checks finish.

Priority: P3
Reviewed head: a54f88bd446ab7f7adba96fe0530dae433c8b615

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent dependency refresh with declared local validation and no actionable source finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body nevertheless reports local CLI and Worker smoke validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body nevertheless reports local CLI and Worker smoke validation.
Evidence reviewed	4 items	Bounded runtime dependency diff: The PR updates the Google API module from v0.291.0 to v0.292.0 and aligned OpenTelemetry modules, with no application Go source changes. Worker lockfile matches declared tool updates: The Worker manifest updates Cloudflare types, oxfmt, and oxlint, and the lockfile changes are the matching platform binding and integrity entries. Worker CI installs the committed lockfile: The current worker workflow uses pnpm's frozen-lockfile install before lint, build, and tests, so it will validate lockfile consistency on this head.
Findings	None	None.
Security	None	None.

How this fits together

gog CLI commands use the Go Google API client layer to reach Google services, while Gmail tracking setup builds and deploys a Cloudflare Worker. This PR updates the dependency toolchains beneath both paths without changing application source behavior.

flowchart LR
  A[CLI commands] --> B[Google API client layer]
  D[Telemetry instrumentation] --> B
  B --> C[Google services]
  E[Gmail tracking setup] --> F[Worker toolchain]
  F --> G[Cloudflare tracking endpoints]

Loading

Before merge

• Resolve merge risk (P1) - The updated Google API and OpenTelemetry libraries are shared runtime dependencies, so remaining platform CI should complete before merging even though the patch contains no application-code change.
• Complete next step (P2) - This collaborator PR has no narrow repair to dispatch; it is awaiting ordinary review and completion of its existing checks.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	5 files; 208 added, 208 removed	All changes are dependency manifests, generated lock data, and one matching Unreleased note; no application source files change.
Dependency updates	1 direct Google API module, 5 OpenTelemetry modules, 3 Worker tools	This identifies the two runtime/toolchain surfaces that need the existing CLI and Worker CI gates.

Merge-risk options

Maintainer options:

1. Accept the validated dependency refresh (recommended)
   Merge after the remaining platform checks complete successfully, accepting the normal compatibility risk of the upstream runtime-library updates.

Technical review

Best possible solution:

Land the pinned, policy-eligible dependency set after the remaining platform checks confirm the CLI and Worker continue to build and test cleanly.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a report of broken behavior; its body supplies post-update CLI and Worker validation claims.

Is this the best way to solve the issue?

Yes: updating the manifests together with their deterministic Go and pnpm lock data is the narrowest maintainable approach for this toolchain refresh.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 72aa5b28aff8.

Labels

Label changes:

• add P3: This is routine dependency and toolchain maintenance with no reported user-facing regression.
• add merge-risk: 🚨 compatibility: Updating the shared Google API and telemetry runtime libraries can alter compatibility across existing CLI service calls despite no local source edits.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body nevertheless reports local CLI and Worker smoke validation.

Label justifications:

• P3: This is routine dependency and toolchain maintenance with no reported user-facing regression.
• merge-risk: 🚨 compatibility: Updating the shared Google API and telemetry runtime libraries can alter compatibility across existing CLI service calls despite no local source edits.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body nevertheless reports local CLI and Worker smoke validation.

Evidence

What I checked:

• Bounded runtime dependency diff: The PR updates the Google API module from v0.291.0 to v0.292.0 and aligned OpenTelemetry modules, with no application Go source changes. (go.mod:18, a54f88bd446a)
• Worker lockfile matches declared tool updates: The Worker manifest updates Cloudflare types, oxfmt, and oxlint, and the lockfile changes are the matching platform binding and integrity entries. (internal/tracking/worker/package.json:16, a54f88bd446a)
• Worker CI installs the committed lockfile: The current worker workflow uses pnpm's frozen-lockfile install before lint, build, and tests, so it will validate lockfile consistency on this head. (.github/workflows/ci.yml:49, 72aa5b28aff8)
• Recent dependency-refresh ownership: History shows Peter Steinberger authored the three preceding combined Go/Worker dependency refreshes, including the latest refresh commit. (go.mod:18, d4a1a6e94707)

Likely related people:

• steipete: Authored the current PR and the recent merged Go and Worker toolchain refresh series in the same manifests and lockfile. (role: recent area contributor; confidence: high; commits: d4a1a6e94707, 28c9be252994, ea6f68b487cd; files: go.mod, internal/tracking/worker/package.json, internal/tracking/worker/pnpm-lock.yaml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.