chore(deps): refresh dependencies

[steipete]

Summary

• Refresh Go dependencies: github.com/openclaw/crawlkit 0.14.6 → 0.14.7, github.com/stretchr/testify 1.11.1 → 1.12.1, and golang.org/x/text 0.40.0 → 0.41.0.
• Refresh GitHub Actions: github/codeql-action 4.37.6 → 4.37.7 and trufflesecurity/trufflehog 3.96.0 → 3.97.0.
• Held: none; all five pending updates passed the project’s real build and runtime checks.
• Supersedes Dependabot PRs build(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 #174, build(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 #185, build(deps): bump github.com/openclaw/crawlkit from 0.14.6 to 0.14.7 #186, build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 #187, and build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 #188; maintainers can close those after this consolidated PR lands.

Verification

• go mod tidy
• go vet ./...
• go test -count=1 ./... — every package passed, including internal/discord (39.527s).
• go build -o bin/discrawl ./cmd/discrawl
• Compiled CLI smokes: ./bin/discrawl --help, ./bin/discrawl --version, and isolated-XDG metadata --json, status --json, and tui --json all exited 0.
• go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... — no reachable vulnerabilities found; one existing module-only vulnerability is not reachable from the application.
• Structured pre-commit Codex review: clean, with no accepted/actionable findings.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 23, 2026, 11:46 AM ET / 15:46 UTC.

ClawSweeper review

What this changes

This PR updates three Go modules and two GitHub Actions used by Discrawl’s CLI build, analysis, and secret-scanning workflows.

Merge readiness

⛔ Blocked until real behavior proof is added - 4 items remain

Keep open: current main still uses the older versions, and this focused consolidation remains the viable path for the five overlapping dependency updates.

Priority: P3
Reviewed head: 293eb5a3135082e88c3aeea95697e63618134df4

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The focused version-only patch looks sound, but real after-fix CLI evidence is not yet available in the PR.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: The PR describes build and CLI smoke checks but provides no copied or attached after-fix runtime output; add redacted terminal output or logs, then update the PR body for a fresh review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR describes build and CLI smoke checks but provides no copied or attached after-fix runtime output; add redacted terminal output or logs, then update the PR body for a fresh review.
Evidence reviewed	7 items	Current main remains outdated: Current main still pins Testify 1.11.1 and x/text 0.40.0; the proposed versions are not already implemented there. Runtime dependency signal: Discrawl directly imports Crawlkit’s embed package for CLI embedding configuration, so the Crawlkit update affects a real runtime boundary. Workflow dependency signal: The changed workflow directly executes the updated CodeQL action under explicit read and security-events permissions.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl is a Go CLI that imports Crawlkit for archive, control, and terminal-browser functions; its module manifest selects those packages. GitHub workflows invoke CodeQL and TruffleHog against repository changes.

flowchart LR
  A[Go module manifest] --> B[Dependency resolution]
  B --> C[Discrawl CLI build]
  D[Workflow action pins] --> E[Code analysis]
  D --> F[Secret scanning]
  C --> G[CLI commands]
  E --> H[Pull request checks]
  F --> H

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The PR describes build and CLI smoke checks but provides no copied or attached after-fix runtime output; add redacted terminal output or logs, then update the PR body for a fresh review.
• Resolve merge risk (P1) - The updated CodeQL and TruffleHog actions execute in security workflows and may change analysis or secret-detection behavior; wait for their current jobs to pass.
• Resolve merge risk (P1) - The PR describes CLI smoke checks but does not include observable after-fix terminal output or logs for review.
• Complete next step (P2) - No repair is identified; contributor proof and the in-progress workflow results need normal merge review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	3 Go modules and 2 workflow actions across 4 files	One branch replaces five overlapping single-dependency updates with a single CI run.

Root-cause cluster

Relationship: canonical
Canonical: #189
Summary: This PR consolidates the exact version updates proposed by five open Dependabot pull requests.

Members:

• superseded: build(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 #174 - Updates golang.org/x/text to the same 0.41.0 version.
• superseded: build(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 #185 - Updates TruffleHog to the same 3.97.0 version.
• superseded: build(deps): bump github.com/openclaw/crawlkit from 0.14.6 to 0.14.7 #186 - Updates Crawlkit to the same 0.14.7 version.
• superseded: build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 #187 - Updates Testify to the same 1.12.1 version.
• superseded: build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 #188 - Updates CodeQL Action to the same 4.37.7 version.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Complete workflow and CLI evidence (recommended)
   Wait for the updated CodeQL and TruffleHog jobs to pass and add redacted compiled-CLI output before merging this dependency refresh.

Technical review

Best possible solution:

Land this consolidated refresh after required workflow checks and redacted CLI proof are available, then close the five superseded Dependabot pull requests.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR refreshes dependency versions rather than repairing a reported defect.

Is this the best way to solve the issue?

Yes: one consolidated update avoids duplicate maintenance across the five overlapping open pull requests, subject to current CI and runtime proof.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 938b6b279dfc.

Labels

Label changes:

• add P3: This is routine dependency maintenance with no identified user-facing regression.
• add merge-risk: 🚨 security-boundary: The TruffleHog version change updates a third-party secret-scanning action that runs on repository contents.
• add merge-risk: 🚨 automation: The PR changes the CodeQL and TruffleHog actions that supply repository CI checks.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR describes build and CLI smoke checks but provides no copied or attached after-fix runtime output; add redacted terminal output or logs, then update the PR body for a fresh review.

Label justifications:

• P3: This is routine dependency maintenance with no identified user-facing regression.
• merge-risk: 🚨 security-boundary: The TruffleHog version change updates a third-party secret-scanning action that runs on repository contents.
• merge-risk: 🚨 automation: The PR changes the CodeQL and TruffleHog actions that supply repository CI checks.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR describes build and CLI smoke checks but provides no copied or attached after-fix runtime output; add redacted terminal output or logs, then update the PR body for a fresh review.

Evidence

What I checked:

• Current main remains outdated: Current main still pins Testify 1.11.1 and x/text 0.40.0; the proposed versions are not already implemented there. (go.mod:9, 938b6b279dfc)
• Runtime dependency signal: Discrawl directly imports Crawlkit’s embed package for CLI embedding configuration, so the Crawlkit update affects a real runtime boundary. (internal/cli/cli.go:15, 293eb5a31350)
• Workflow dependency signal: The changed workflow directly executes the updated CodeQL action under explicit read and security-events permissions. (.github/workflows/codeql.yml:32, 293eb5a31350)
• Focused diff: The branch changes only two workflow action references and the Go module graph across four files. (go.mod:9, 293eb5a31350)
• History ownership: Recent dependency and workflow refreshes date to Peter Steinberger’s commits, including the prior consolidated Go-and-Actions refresh. (go.mod:9, 48b28c60866c)
• Patch hygiene: The direct base-to-head diff has no whitespace errors and modifies 17 lines while deleting 39 generated dependency-graph lines. (go.sum:1, 293eb5a31350)

Likely related people:

• steipete: Peter Steinberger authored the current PR plus recent release and consolidated dependency-refresh history. (role: recent dependency and workflow contributor; confidence: high; commits: 293eb5a31350, 48b28c60866c, 089c1f5b6ae4; files: go.mod, .github/workflows/codeql.yml, .github/workflows/secret-scan.yml)
• Vincent Koc: History shows Vincent Koc introduced CodeQL, verified secret scanning, and early Crawlkit integration. (role: original security-workflow and Crawlkit contributor; confidence: high; commits: abcb77e6fced, 0da02de393a7, 4ee63794946b; files: .github/workflows/codeql.yml, .github/workflows/secret-scan.yml, go.mod)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted terminal output or a recording from the compiled CLI smoke checks; if review does not rerun after updating the PR body, ask a maintainer to comment @clawsweeper re-review.
• Let the current CodeQL, lint, release-check, and test jobs complete on this head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.