chore(deps): update CrawlKit and build with Go 1.27.1

[dependabot]

CrawlKit v0.14.8 requires Go 1.27. The original dependency bump raised go.mod while Docker and the source-build documentation still used Go 1.26.7; Docker could not download the module, and Go 1.27's formatter rejected one existing indentation block.

This candidate aligns go.mod, the Docker builder, and source-build documentation on Go 1.27.1. The source-build minimum rises from Go 1.26.7 to Go 1.27.1, and newly built macOS binaries require macOS 13 Ventura or newer. These requirements follow CrawlKit's Go 1.27 dependency and the Go toolchain's supported platforms. The application-code change is limited to the formatting required by Go 1.27.

The compatible updates from #171 are incorporated through normal merge commits: SQLite 1.58.0, go-runewidth 0.0.29, current pprof/golden snapshots, TruffleHog 3.97.4, and Dockerfile frontend 1.27. SQLite retains its exact required libc version, 1.75.6. The original Dependabot commit and #171's maintenance commits remain in the ancestry; no history was rewritten. Main's landed #169 cursor fix and @SebTardif's changelog credit are preserved.

#171 remains open until this integrated PR lands; it should not be merged separately.

Validation completed locally:

• Full-candidate P2 autoreview against main 3c9e6d58548fa2655189b268a04e25f0ff586c0e: no actionable findings.
• A real CLI built with Go 1.27.1 reopens an archive seeded by the previous Go 1.26.7/CrawlKit 0.14.7 binary, syncs a synthetic PR through HTTP, finds it via full-text search, and passes SQLite integrity checking.
• The same candidate exits after one or two GraphQL requests for empty, repeated, and nested repeated cursors, preserving prior review rows.
• make check passes with Go 1.27.1: tidy, formatting, vet, vulnerability scan, deadcode, full suite (85.6% coverage), CLI smoke, release-script tests, and all six snapshot targets. No vulnerabilities found.
• Docs site builds successfully.

The named Go 1.27 hold is resolved by managed CodeQL on this candidate: CodeQL CLI 2.26.4 configured Go 1.27.1 with GOTOOLCHAIN=local, then completed Go autobuild and analysis successfully. No CodeQL configuration or gate was bypassed.

The macOS minimum follows the Go 1.27 platform requirement; the arm64 snapshot also reports LC_BUILD_VERSION minos 13.0.

Final prepared head: bec2e085087e9e43c3db9eaf64e07643495a0de9, based on main 3c9e6d58548fa2655189b268a04e25f0ff586c0e. All exact-head checks pass: Linux/macOS CI, Docker build/runtime smoke, managed CodeQL, and secret scanning. This PR remains open for maintainer review; #171 stays open until this candidate actually lands.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 4, 2026, 4:29 AM ET / 08:29 UTC.

ClawSweeper review

What this changes

Updates CrawlKit, SQLite, supporting dependencies and build tools, aligns source and Docker builds on Go 1.27.1, and documents the new macOS 13 minimum.

Merge readiness

⛔ Blocked before merge - 4 items remain

The dependency update remains absent from main and v0.9.4. The revised branch addresses the previous Docker/documentation mismatch, and captured managed CodeQL checks pass; no concrete patch defect remains.

Priority: P2
Reviewed head: bec2e085087e9e43c3db9eaf64e07643495a0de9
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with the earlier correctness concern resolved; the remaining platform-support decision does not reduce patch quality.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor-proof gate is exempt for this bot-authored maintenance PR. Supplemental evidence in the captured body reports the Go 1.27.1 CLI exercising CrawlKit/SQLite through archive reopening, HTTP sync, search and integrity checking; raw execution output was not supplied.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor-proof gate is exempt for this bot-authored maintenance PR. Supplemental evidence in the captured body reports the Go 1.27.1 CLI exercising CrawlKit/SQLite through archive reopening, HTTP sync, search and integrity checking; raw execution output was not supplied.
Evidence reviewed	11 items	Verified introduced scope: The local delta matches the eight-file host introduction evidence. The verified test merge records main followed by the exact PR head, and its tree equals the reviewed head. Still necessary on main: The fetched main still specifies Go 1.26.7, CrawlKit v0.14.7 and SQLite v1.57.0. Released baseline: The v0.9.4 tag resolves to this commit and contains the same older toolchain and dependency versions.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl mirrors GitHub issues and pull requests into a local SQLite archive for search and maintainer workflows. CrawlKit supplies shared storage helpers, while the Go toolchain builds the distributed CLI.

flowchart LR
  A[GitHub responses] --> B[Gitcrawl sync]
  B --> C[CrawlKit storage helpers]
  C --> D[SQLite archive]
  D --> E[Search and terminal interface]
  F[Go toolchain and dependencies] --> B

Loading

Decision needed

Question	Recommendation
Should this release adopt Go 1.27.1 and end support for newly built binaries on macOS versions below 13?	Accept the documented baseline: Adopt the integrated upgrade with the published platform requirements and normal required-check gating.

Why: The compatibility change is explicit and the previous CodeQL concern has positive check evidence, but successful builds cannot decide the supported-platform policy.

Before merge

• Resolve merge risk (P1) - Adopting the documented baseline requires source builders to obtain Go 1.27.1 and prevents users below macOS 13 from running newly built binaries; acceptance of that support cutoff remains a maintainer choice.
• Resolve merge risk (P1) - Network failures prevented independent inspection of upstream dependency releases and Action changes; this limits the supply-chain review without invalidating the supplied runtime results.
• Complete next step (P2) - Confirm acceptance of the documented Go 1.27.1 source-build and macOS 13 runtime minimums before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Application-code delta	Production +10/-10, whitespace only; tests +0/-0	The application source has no semantic growth; the substantive changes are dependency, build and documentation updates.

Root-cause cluster

Relationship: canonical
Canonical: #170
Summary: The discussion identifies this PR as the integrated dependency candidate; the cursor fix is separate merged work.

Members:

• partial_overlap: chore(deps): refresh compatible Go dependencies and tooling #171 - Its compatible dependency updates are incorporated here, but it remains open pending this candidate and is not a separate landing target.
• adjacent_distinct: fix(github): reject empty or repeated review-thread cursors #169 - The merged pagination repair is preserved through the base merge and does not replace the dependency upgrade.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Approve the platform cutoff (recommended)
   Accept the documented Go and macOS minimums with the supplied archive-upgrade evidence.
2. Defer the Go release-series upgrade
   Pause this candidate if older macOS support must continue, preserving compatible dependency updates separately.

Technical review

Best possible solution:

Ship a maintainer-approved Go 1.27.1 baseline with explicit macOS 13 requirements and preserved access to existing archives.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the remaining maintenance proposal. Current source resolves the previously reported build-version mismatch; no failing current-main scenario was executed.

Is this the best way to solve the issue?

Yes, aligning the module, Docker builder and installation requirements is a focused solution; the supported-platform cutoff needs explicit acceptance.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 3c9e6d58548f.

Labels

Label changes:

• add P2: This is a bounded dependency and toolchain upgrade with platform compatibility implications, without an established urgent user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate is exempt for this bot-authored maintenance PR. Supplemental evidence in the captured body reports the Go 1.27.1 CLI exercising CrawlKit/SQLite through archive reopening, HTTP sync, search and integrity checking; raw execution output was not supplied.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.
• remove merge-risk: 🚨 automation: Current PR review merge-risk labels are merge-risk: 🚨 compatibility.
• remove P1: Current review triage priority is P2, so this older priority label is no longer current.

Label justifications:

• P2: This is a bounded dependency and toolchain upgrade with platform compatibility implications, without an established urgent user-facing regression.
• merge-risk: 🚨 compatibility: The upgrade raises the required Go version and drops older macOS versions from newly built binary support.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate is exempt for this bot-authored maintenance PR. Supplemental evidence in the captured body reports the Go 1.27.1 CLI exercising CrawlKit/SQLite through archive reopening, HTTP sync, search and integrity checking; raw execution output was not supplied.

Evidence

What I checked:

• Verified introduced scope: The local delta matches the eight-file host introduction evidence. The verified test merge records main followed by the exact PR head, and its tree equals the reviewed head. (38c35d6d2dda)
• Still necessary on main: The fetched main still specifies Go 1.26.7, CrawlKit v0.14.7 and SQLite v1.57.0. (go.mod:3, 3c9e6d58548f)
• Released baseline: The v0.9.4 tag resolves to this commit and contains the same older toolchain and dependency versions. (go.mod:3, 274881750869)
• Previous finding addressed: The current module directive, Docker builder, README and installation requirements agree on Go 1.27.1. Installation documentation explicitly describes the macOS 13 cutoff. The supplied previous review identified the older mismatch; direct comparison with that earlier head was unavailable because historical blobs were missing. (docs/installation.md:15, bec2e085087e)
• Compatibility validation in captured discussion: The supplied PR body reports a Go 1.27.1 CLI reopening an archive created by the previous binary, syncing a synthetic PR through HTTP, finding it through full-text search and passing SQLite integrity checking. Captured checks show managed CodeQL, Analyze (go), Docker and secret scanning successful; Linux/macOS CI was still running. These are supplied results, not reviewer-executed validation. (bec2e085087e)
• Concrete dependency boundary: The store opens archives through crawlkit/store, and search delegates FTS query construction to the same dependency. This directly connects the changed CrawlKit and SQLite versions to the reported archive-upgrade exercise; dependency compatibility inspection is relevant. (internal/store/store.go:64, bec2e085087e)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-03T18:47:56.081Z sha 9982e4a :: blocked before merge. :: [P1] Preserve the supported Go baseline
• reviewed 2026-09-03T20:37:40.050Z sha 9982e4a :: blocked before merge. :: [P1] Preserve the supported Go baseline

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): update CrawlKit and build with Go 1.27.1 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.