build(deps): refresh dependencies

[steipete]

Summary

• update CrawlKit from 0.14.3 to 0.14.4
• update modernc SQLite from 1.54.0 to 1.55.0 and libc from the retracted 1.74.3 release to 1.74.4
• update golang.org/x/net from 0.55.0 to 0.57.0
• update actions/stale from v10 to v11 and the pinned GoReleaser action from 7.2.2 to 7.2.3

Verification

• actionlint
• make check (module verification/tidy, formatting, vet, govulncheck, deadcode, all Go tests, CLI smoke, and four-platform GoReleaser snapshot)
• govulncheck: no vulnerabilities found
• real built CLI initialized a fresh archive, returned JSON status, and queried SQLite 3.53.3 through slacrawl sql
• AutoReview: clean, no accepted/actionable findings
• public model-identifier audit: PASS; no model-bearing surfaces in the diff

The first final make check attempt hit a TLS timeout fetching the vulnerability database; the unchanged retry completed successfully.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 8:06 PM ET / August 2, 2026, 00:06 UTC.

ClawSweeper review

What this changes

The branch updates CrawlKit, SQLite-related Go modules, golang.org/x/net, and the stale and GoReleaser Action pins, with matching unreleased changelog notes.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep this PR open for normal maintainer review: it is a focused, passing dependency and workflow maintenance patch from a collaborator, and the earlier changelog objection is not supported by the checked-in contribution guidance. The contributor’s reply correctly distinguishes the release workflow opening the next Unreleased PR from exclusive ownership of all later entries in that section.

Priority: P3
Reviewed head: 3ad060d2db12cc9149c742497c8fc9be6ed34fbc

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	This is a focused maintenance patch with credible live CLI proof, passing reported checks, and no remaining actionable defect.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The PR body reports after-fix built-CLI proof: it initialized a fresh archive, returned JSON status, and queried SQLite through slacrawl sql, in addition to the passing check suite.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR body reports after-fix built-CLI proof: it initialized a fresh archive, returned JSON status, and queried SQLite through slacrawl sql, in addition to the passing check suite.
Evidence reviewed	5 items	Repository contribution guidance: The release section says the unified release workflow opens the next Unreleased changelog PR, but does not state that it exclusively owns all subsequent entries. The PR’s two concise maintenance bullets therefore do not violate the checked-in guidance. Focused current diff: The branch changes five files: two pinned Action versions, the Go module manifest and checksums, and two matching entries under the existing Unreleased section. Existing changelog convention: Current main already contains maintenance-oriented Unreleased entries for Makefile release-target work and terminal dependency refreshes, consistent with recording this PR’s maintenance sweep there.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl is a Go CLI for local Slack archives. Its module manifest selects crawler, SQLite, and network libraries, while GitHub Actions run release snapshots and stale-item automation around the CLI.

flowchart LR
  A[Go module manifest] --> B[Dependency resolver]
  B --> C[Slacrawl CLI]
  C --> D[Local Slack archive]
  D --> E[SQLite queries]
  F[CI workflow pins] --> G[Release snapshots]
  F --> H[Stale-item automation]

Loading

Before merge

• Complete next step (P2) - No repair lane is warranted: there is no remaining code defect, and this collaborator-authored PR should proceed through normal maintainer merge review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Focused maintenance surface	5 files affected; 18 added, 16 removed	The patch is limited to dependency resolution, two existing automation pins, and matching release notes.
Automation updates	2 Action pins updated	The stale workflow and snapshot-release workflow retain their existing inputs while moving to newer action versions.

Technical review

Best possible solution:

Merge the focused refresh through normal collaborator review, retaining the two Unreleased maintenance bullets and the stated live CLI validation as release context.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is routine dependency and workflow maintenance rather than a report of broken user behavior. The contributor nevertheless supplied a real built-CLI validation path in the PR body.

Is this the best way to solve the issue?

Yes. Updating the selected module versions and existing Action pins is the narrow maintainable approach, and the changelog entries match the repository’s current Unreleased maintenance convention.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 53dd8d09b584.

Labels

Label justifications:

• P3: This is routine dependency and CI maintenance with no reported user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body reports after-fix built-CLI proof: it initialized a fresh archive, returned JSON status, and queried SQLite through slacrawl sql, in addition to the passing check suite.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body reports after-fix built-CLI proof: it initialized a fresh archive, returned JSON status, and queried SQLite through slacrawl sql, in addition to the passing check suite.

Evidence

What I checked:

• Repository contribution guidance: The release section says the unified release workflow opens the next Unreleased changelog PR, but does not state that it exclusively owns all subsequent entries. The PR’s two concise maintenance bullets therefore do not violate the checked-in guidance. (CONTRIBUTING.md:28, 53dd8d09b584)
• Focused current diff: The branch changes five files: two pinned Action versions, the Go module manifest and checksums, and two matching entries under the existing Unreleased section. (go.mod:5, 3ad060d2db12)
• Existing changelog convention: Current main already contains maintenance-oriented Unreleased entries for Makefile release-target work and terminal dependency refreshes, consistent with recording this PR’s maintenance sweep there. (CHANGELOG.md:3, 53dd8d09b584)
• Current dependency-area provenance: Current main’s most recent commit is build(deps): refresh terminal dependencies, authored by Peter Steinberger, establishing recent ownership of dependency maintenance adjacent to this PR. (go.mod:1, 53dd8d09b584)
• Infrastructure limitation: A deeper history pass for older release commits could not complete because this partial checkout attempted to fetch missing promisor objects while network name resolution was unavailable. The inspected current policy, current main, branch diff, PR context, and checks are sufficient for this keep-open decision.

Likely related people:

• steipete: The collaborator authored this focused refresh and is also the identifiable author behind the immediately preceding current-main dependency refresh. (role: recent dependency-area contributor; confidence: high; commits: 53dd8d09b584, 3ad060d2db12; files: go.mod, go.sum, .github/workflows/ci.yml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-01T23:51:02.203Z sha 3ad060d :: needs changes before merge. :: [P2] Remove release-owned changelog edits

[steipete]

Keeping the two CHANGELOG.md maintenance bullets. CONTRIBUTING.md says the unified release workflow opens the next Unreleased changelog PR after a release; it does not make that workflow the exclusive author of every later entry in an already-open Unreleased section. This repository's established house style records dependency and CI maintenance there, and this maintenance sweep explicitly requires changelog reconciliation.

The substantive dependency/action diff, full validation, and live built-CLI proof are unchanged. The bot finding does not identify a code, build, or release-process defect.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30724687368
• Updated: 2026-08-02T00:09:20.016Z

[steipete]

Landed via squash as ed2cafa8746b0a6f98fe8281ec4b80edac98bc04 after orchestrator approval.

Pre-merge verification at exact head 3ad060d2db12cc9149c742497c8fc9be6ed34fbc:

• Local make check passed module verification/tidy checks, vet, govulncheck, dead-code analysis, tests, CLI smoke, and four-platform GoReleaser snapshots.
• Real built CLI initialized a fresh archive, returned zero-state status JSON, and queried SQLite 3.53.3 through slacrawl sql.
• The production stale workflow ran from the PR head in run 30724793275; all three actions/stale@v11 processing steps succeeded without changing the open queue.
• Hosted deps, lint, test, release-check, Docker, CodeQL, and secret-scanning checks were green.
• Final Codex AutoReview on the exact commit was clean: no accepted/actionable findings, overall correctness 0.98.

The normal squash merge was refused only because branch protection requires a review the author cannot self-approve, so the approved admin override was used. The remote PR branch has been deleted.