build(deps): refresh scanner runtime and toolchains

.github/workflows/codeql.yml

@@ -39,11 +39,11 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@c23de5a82f64bb08c6d9f28844551440ca298e76 # v4.38.1
         with:
           languages: ${{ matrix.language }}
 
       - name: Analyze
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@c23de5a82f64bb08c6d9f28844551440ca298e76 # v4.38.1
         with:
           category: /language:${{ matrix.language }}

.github/workflows/pages.yml

@@ -66,4 +66,4 @@ jobs:
       - name: Deploy to GitHub Pages
         if: steps.pages-site.outputs.enabled == 'true'
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/runtime-image.yml

@@ -28,10 +28,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
@@ -53,7 +53,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: docker/clawscan-runtime/Dockerfile

CHANGELOG.md

@@ -7,3 +7,4 @@
 - Add `--platform` to build smaller npm tarballs for one supported operating system and architecture while retaining the default universal package.
 - Preserve every scanner report when sanitized target, profile, or custom scanner names collide with each other or generated numeric suffixes.
 - Fix unbounded memory use when loading benchmark `--ids` from files or HTTP, including whitespace-padded IDs; document selection limits and preserve full-set JSONL support. Thanks @SebTardif (#47).
+- Refresh bundled scanner tools and Go dependencies; source builds now require Go 1.27.1, and the Docker runtime uses Node.js 24 LTS.

CONTRIBUTING.md

@@ -9,7 +9,7 @@ environments.
 
 Prerequisites:
 
-- Go 1.27.0 or newer (see `go.mod`).
+- Go 1.27.1 or newer (see `go.mod`).
 - Node.js/npm for scanner adapters that shell out through `npx`.
 - `make` for docs and release helper targets.
 - Optional scanner credentials in environment variables, never CLI flags.

docker/clawscan-runtime/Dockerfile

@@ -1,21 +1,21 @@
 FROM python:3.12-slim
 
 ARG SKILLSPECTOR_REF=69dcdfb74487d361ba4c811d088cfdea2ff3a9dc
-ARG AIG_SKILL_SCAN_VERSION=0.2.1
-ARG CISCO_AI_SKILL_SCANNER_VERSION=2.0.13
-ARG SNYK_AGENT_SCAN_VERSION=0.6.0
-ARG CLAUDE_CODE_VERSION=2.1.251
-ARG OPENAI_CODEX_VERSION=0.151.0
+ARG AIG_SKILL_SCAN_VERSION=0.2.2
+ARG CISCO_AI_SKILL_SCANNER_VERSION=2.1.0
+ARG SNYK_AGENT_SCAN_VERSION=0.6.4
+ARG CLAUDE_CODE_VERSION=2.1.278
+ARG OPENAI_CODEX_VERSION=0.155.1
 ARG AGENTVERUS_SCANNER_VERSION=0.8.1
-ARG SOCKET_CLI_VERSION=1.1.162
+ARG SOCKET_CLI_VERSION=1.1.176
 
 ENV PATH="/root/.local/bin:${PATH}" \
     PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PYTHONUNBUFFERED=1
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates curl git gnupg \
-    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && rm -rf /var/lib/apt/lists/*
 

go.mod

@@ -1,11 +1,11 @@
 module github.com/openclaw/clawscan
 
-go 1.27.0
+go 1.27.1
 
 require (
 	github.com/alchemy/json5 v0.2.0
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
 	gopkg.in/yaml.v3 v3.0.1
 )
 
-require golang.org/x/text v0.41.0 // indirect
+require golang.org/x/text v0.42.0 // indirect

go.sum

@@ -4,8 +4,8 @@ github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxK
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=