build(deps): refresh 0.8.1 dependencies

[steipete]

Summary

• update CrawlKit first from v0.14.2 to its latest stable release, v0.14.3
• update the remaining stale direct tooling pins: Alpine 3.24, actions/setup-node v7, govulncheck v1.6.0, and deadcode/x-tools v0.48.0
• retain current pins already at latest stable: all other direct Go modules, Go 1.26.5, sqlc v1.31.1, GitHub Actions, GoReleaser Action v7.2.3, and TruffleHog v3.95.9

Proof

• go test ./... immediately after the CrawlKit update: pass
• go mod tidy; clean go.mod/go.sum diff; gofmt; go vet ./...: pass
• GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...: no vulnerabilities
• go run golang.org/x/tools/cmd/deadcode@v0.48.0 -test ./...: clean
• go test ./... -covermode=atomic: pass, 85.1% total coverage
• real CLI build plus version, metadata, status, and TUI-help smoke: pass
• ./scripts/test-release.sh: pass
• credential-free GoReleaser snapshot: pass for all six targets
• node scripts/build-docs-site.mjs: pass
• Alpine 3.24 Docker build plus CLI and bundled-Git smoke: pass
• AutoReview on each pre-commit diff and the final branch: clean

No dependency was deferred.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 17, 2026, 7:15 PM ET / 23:15 UTC.

Summary
The branch updates CrawlKit to v0.14.3, Alpine to 3.24, actions/setup-node to v7, govulncheck and deadcode tool pins, plus the matching Go module checksums and release notes.

Reproducibility: not applicable. this is a dependency-maintenance PR rather than a report of broken behavior. The relevant verification is an after-fix build, release, Docker, and CLI smoke run on the proposed branch.

Review metrics: 2 noteworthy metrics.

• Patch size: 6 files affected; 8 added, 7 removed. The small, pin-focused diff limits implementation churn but still changes build, CI, container, and release-adjacent surfaces.
• Pending Go validation: 3 Go-related checks in progress. Those checks cover the principal runtime and analysis paths affected by the upgraded Go tooling and module dependency.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add a redacted terminal transcript or linked artifact showing the real CLI, release snapshot, and Docker smoke results after the upgrades.
• Wait for the in-progress Go analysis and platform jobs to complete successfully.
• After adding proof, update the PR body to trigger a fresh ClawSweeper review; if that does not occur, ask a maintainer to comment @clawsweeper re-review.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body lists extensive successful validation, but no inspectable redacted output, linked artifact, recording, screenshot, or runtime log demonstrates the after-fix CLI, release, or Docker behavior; please add evidence with private values redacted, then update the PR body for a fresh review.

Risk before merge

• [P1] The PR changes build and release dependencies; pending Go jobs and independently inspectable after-fix runtime proof are still needed to reduce upgrade and release-path uncertainty.

Maintainer options:

1. Verify the updated toolchain before merging (recommended)
   Require a redacted after-fix terminal transcript or linked artifact for the CLI/release/Docker paths and wait for the in-progress Go jobs to finish successfully.
2. Accept the remaining validation risk
   Merge based on the stated local validation and currently successful checks, accepting that the supplied review context does not independently demonstrate the upgraded runtime paths.

Next step before merge

• [P1] The remaining blocker is contributor-supplied real-behavior evidence and completion of existing checks, not a concrete mechanical repair for an automated worker.

Security
Cleared: The supplied diff only advances existing dependency, container, CI-action, and Go-tool pins; it adds no new execution path, permission, secret access, dependency source, or lifecycle hook.

Review details

Best possible solution:

Keep the version refresh narrow, publish a redacted terminal transcript or linked artifact showing the claimed CLI, release-snapshot, and Docker smoke results, then merge once the remaining Go checks are green.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a report of broken behavior. The relevant verification is an after-fix build, release, Docker, and CLI smoke run on the proposed branch.

Is this the best way to solve the issue?

Yes, with a small caveat: updating the direct pins and matching module checksums is the narrow maintainable path, provided the claimed upgraded runtime and release checks are supplied as inspectable proof.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against afaefcbeca18.

Label changes

Label changes:

• add P3: This is routine dependency and tooling maintenance with no demonstrated user-facing regression.
• add merge-risk: 🚨 compatibility: Updating the CrawlKit module and Alpine base image can change build or runtime behavior for existing environments.
• add merge-risk: 🚨 automation: The PR changes CI action and analysis-tool versions, so workflow behavior must be confirmed on the updated pins.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists extensive successful validation, but no inspectable redacted output, linked artifact, recording, screenshot, or runtime log demonstrates the after-fix CLI, release, or Docker behavior; please add evidence with private values redacted, then update the PR body for a fresh review.

Label justifications:

• P3: This is routine dependency and tooling maintenance with no demonstrated user-facing regression.
• merge-risk: 🚨 compatibility: Updating the CrawlKit module and Alpine base image can change build or runtime behavior for existing environments.
• merge-risk: 🚨 automation: The PR changes CI action and analysis-tool versions, so workflow behavior must be confirmed on the updated pins.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists extensive successful validation, but no inspectable redacted output, linked artifact, recording, screenshot, or runtime log demonstrates the after-fix CLI, release, or Docker behavior; please add evidence with private values redacted, then update the PR body for a fresh review.

Evidence reviewed

What I checked:

• Narrow dependency surface: The supplied PR diff changes six files with 8 additions and 7 deletions: one direct Go dependency, its checksums, an Alpine base-image argument, two CI tool/action pins, and a changelog entry. (go.mod:12, 119bc05d1830)
• Declared validation: The PR body reports unit, vet, vulnerability, dead-code, release, documentation, Docker, CLI, and GoReleaser snapshot validation, but includes no linked artifact, terminal output, recording, or redacted runtime log that can be independently inspected as after-fix proof. (119bc05d1830)
• Check state: Docker, secret scanning, and static-analysis checks have completed successfully; Go analysis and the macOS and Ubuntu Go jobs were still in progress in the supplied check snapshot. (.github/workflows/ci.yml:58, 119bc05d1830)
• Repository-policy inspection unavailable: The read-only command runner could not execute even basic repository reads because its sandbox failed before command execution, so repository-local AGENTS.md, current-main source, and feature-history provenance could not be independently inspected in this review.

Likely related people:

• steipete: The supplied PR metadata identifies this person as author of both commits updating CrawlKit and the release toolchain; repository history could not be read to identify longer-term owners. (role: recent dependency-refresh contributor; confidence: low; commits: 52a91927dc57, 119bc05d1830; files: go.mod, .github/workflows/ci.yml, Dockerfile)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.