build(deps): Bump github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.14.5

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.14.5.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.14.4 - 2026-07-26

Breaking release asset rename

• Replace crawlctl-v0.14.3-macos-arm64.tar.gz with crawlkit_0.14.4_darwin_arm64.tar.gz and crawlctl-v0.14.3-macos-x86_64.tar.gz with crawlkit_0.14.4_darwin_amd64.tar.gz. The new fleet-standard names use the repository prefix, omit the v inside filenames, use darwin and amd64, and replace per-asset .sha256 sidecars with one checksums.txt; scripts that download the old names must be updated.
• Add fleet-standard crawlkit_0.14.4_linux_arm64.tar.gz and crawlkit_0.14.4_linux_amd64.tar.gz archives containing the crawlctl executable.

Maintenance

• Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
• Standardize local build, check, snapshot, and fail-closed release commands under the shared crawler Makefile contract.
• Move official publication to the shared signed, notarized, independently verified GitHub Actions pipeline while preserving the org.openclaw.crawlctl code-signing identifier.

crawlkit v0.14.3

Highlights

• Restore release readiness with Peter's current repository-pinned SSH signing key and a supported pre-tag macOS notarization preflight that rechecks online tickets and build provenance after managed keychain cleanup.
• Update the bundled SQLite engine to v3.53.3 through modernc.org/sqlite v1.54.0.

Maintenance

• Update terminal detection to go-isatty v0.0.23 and refresh CI security tooling.

v0.13.4

Changes

• Add stable Developer ID signing, verification, and atomic installation for macOS crawlctl release artifacts so Full Disk Access survives updates.
• Require Go 1.26.5 to include the standard-library TLS security fixes.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.14.5 - 2026-08-02

• Publish the module as an SSH-signed tag without a GitHub Release or attached crawlctl artifacts; v0.14.4 remains the latest release with binary assets.
• Update Go dependencies and validation tools, including SQLite v1.55.0, modernc.org/libc v1.74.4, go-colorful v1.4.1, deadcode v0.48.0, and govulncheck v1.6.0; document caller-provided file: URI parameter pass-through.
• Refresh the pinned TruffleHog and CodeQL security actions to v3.96.0 and v4.37.4.
• Update the stale repository automation to the immutable v11.0.0 action revision.
• Raise the brokered AWS Crabbox root volume to 400 GB to match the current developer snapshot minimum.

v0.14.4 - 2026-07-26

Final attached CLI artifacts

• Publish the final GitHub release with attached crawlctl artifacts for macOS and Linux.

Maintenance

• Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
• Standardize local build and check commands under the shared crawler Makefile contract.

v0.14.3 - 2026-07-17

Highlights

• Update the bundled SQLite engine to v3.53.3 through modernc.org/sqlite v1.54.0.

Maintenance

• Update terminal detection to go-isatty v0.0.23 and refresh CI security tooling.

v0.14.2 - 2026-07-12

• Add a snapshot-scoped publisher status client helper so resumable publishers verify the exact immutable candidate instead of trusting an unrelated completed candidate from the unscoped status route, and reject successful responses that omit the snapshot or return a different snapshot, app, or archive.
• Add a 64 MiB mutable SQLite bundle default and preserve exact request content lengths for bounded remote uploads. The shipped DefaultSQLiteBundleChunkSize constant and immutable snapshot default remain 256 MiB for caller and retry compatibility, including explicitly configured legacy mutable bundles. Mutable bundles retain their legacy part-count and aggregate-size, chunk-size, and object-size compatibility, while immutable snapshots enforce the negotiated 256 MiB part, 4 GiB object, 512 MiB compressed, and eight-part bounds. Bundle construction now rejects empty sources, removes partial temp artifacts on failure, and rejects source identity/content drift. Immutable uploads use private validated part snapshots and verify compressed and decompressed digests before any remote write. Every file-backed read is capped at its declared size plus one byte so concurrent same-inode growth is detected without consuming an unbounded tail.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)