build(deps): bump github.com/openclaw/crawlkit from 0.14.6 to 0.14.7

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.14.6 to 0.14.7.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.14.7 - 2026-08-14

• Update modernc.org/sqlite to v1.56.0 for the SQLite 3.53.3 journal-rollback corruption fix and regenerated platform bindings.
• Require Go 1.26.6 for the latest standard-library security fixes.
• Refresh the pinned CodeQL init and analysis actions to v4.37.6.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.14.7 - 2026-08-14

• Update modernc.org/sqlite to v1.56.0 for the SQLite 3.53.3 journal-rollback corruption fix and regenerated platform bindings.
• Require Go 1.26.6 for the latest standard-library security fixes.
• Refresh the pinned CodeQL init and analysis actions to v4.37.6.

Commits

• 00a9464 chore(release): fix changelog section for v0.14.7 (#90)
• 67e034c chore(release): prepare v0.14.7 (#89)
• 9b3fec5 build: move Go floor to 1.26.6 (#88)
• a7025e2 chore(deps): refresh SQLite runtime dependencies (#87)
• e3e8b09 chore(release): prepare v0.14.7 (#86)
• 5c1729e build(deps): bump the codeql-action group with 2 updates (#85)
• 997af07 build(deps): bump modernc.org/sqlite from 1.55.0 to 1.56.0 (#84)
• 9312460 chore: reopen changelog for v0.14.7 and record v0.14.6 publication state (#83)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 23, 2026, 11:56 AM ET / 15:56 UTC.

ClawSweeper review

What this changes

Updates Discrawl’s direct Crawlkit dependency from v0.14.6 to v0.14.7 and records the new Go module checksums.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: current main still selects Crawlkit v0.14.6, while the open consolidated refresh has not landed. This narrow Dependabot update remains a valid independent landing path.

Priority: P3
Reviewed head: eab5c2d46020f8c8646b910d3a2ee0524329bcb1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The update is cleanly scoped and CI-complete; a fresh-base comparison remains unavailable in this checkout.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored module-only update is exempt from the external-contributor real-behavior-proof gate; completed CI checks remain supplemental validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored module-only update is exempt from the external-contributor real-behavior-proof gate; completed CI checks remain supplemental validation.
Evidence reviewed	7 items	Module selection: The submitted head requires Crawlkit v0.14.7. Checksum update: The submitted head contains only the matching Crawlkit v0.14.7 module and go.mod checksums. Dependency boundary: Discrawl directly imports Crawlkit’s embedding and storage packages, so this version bump affects production code rather than an unused module entry.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl’s Go module manifest selects the shared Crawlkit library used by CLI embedding and local-store code. Go resolves that version at build time before Discrawl’s crawl, index, and query commands use those shared APIs.

flowchart LR
  A[Go module manifest] --> B[Crawlkit version selection]
  B --> C[Go module resolver]
  C --> D[Discrawl build]
  D --> E[CLI crawl and index commands]

Loading

Before merge

• Resolve merge risk (P1) - The local sparse checkout cannot resolve the current-main tree or a merge base, so a fresh-base source comparison and independent local build were not possible in this review.
• Complete next step (P2) - No repair is needed; maintainers should select this narrow update or wait for the unmerged consolidated refresh.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency delta	1 direct module updated; 2 files changed; +3/-3 lines	The supplied PR diff is limited to Crawlkit selection and its recorded hashes.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Land this clean standalone update, or land the consolidated refresh after its remaining proof gate is satisfied; close this PR only once that merged replacement contains the same Crawlkit version.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Land this clean standalone update, or land the consolidated refresh after its remaining proof gate is satisfied; close this PR only once that merged replacement contains the same Crawlkit version.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a dependency-version update, not a report of broken runtime behavior.

Is this the best way to solve the issue?

Yes: updating the direct module and its checksums is the standard Go dependency-management path; it still needs a review against a resolvable current-main base.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 938b6b279dfc.

Labels

Label justifications:

• P3: This is a routine patch-level dependency maintenance PR.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored module-only update is exempt from the external-contributor real-behavior-proof gate; completed CI checks remain supplemental validation.

Evidence

What I checked:

• Module selection: The submitted head requires Crawlkit v0.14.7. (go.mod:46, eab5c2d46020)
• Checksum update: The submitted head contains only the matching Crawlkit v0.14.7 module and go.mod checksums. (go.sum:74, eab5c2d46020)
• Dependency boundary: Discrawl directly imports Crawlkit’s embedding and storage packages, so this version bump affects production code rather than an unused module entry. (internal/cli/cli.go:15, eab5c2d46020)
• Released baseline: The checked-out changelog records Crawlkit v0.14.6 in released Discrawl v0.13.1; the supplied PR metadata identifies current main as the v0.14.6 base for this update. (CHANGELOG.md:26, eab5c2d46020)
• Recent dependency ownership: Peter Steinberger’s recent dependency-refresh commit touched go.mod and go.sum. (go.mod:46, 5519d84f81f9)
• Crawlkit history: Vincent Koc previously updated Crawlkit and changed both module files. (go.mod:46, cfe1506d5de6)

Likely related people:

• Peter Steinberger: Recent Go dependency refresh work changed both module manifest files. (role: recent dependency-file contributor; confidence: high; commits: 5519d84f81f9; files: go.mod, go.sum)
• Vincent Koc: Introduced a prior Crawlkit version update that changed the same two module files. (role: prior Crawlkit update author; confidence: high; commits: cfe1506d5de6; files: go.mod, go.sum)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Refresh the review after the local checkout can resolve the current-main base, or land the clean consolidated dependency refresh first.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-22T12:55:40.755Z sha eab5c2d :: needs maintainer review before merge. :: none

[dependabot]

Looks like github.com/openclaw/crawlkit is up-to-date now, so this is no longer needed.