chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0

[dependabot]

Bumps golang.org/x/text from 0.40.0 to 0.41.0.

Commits

• acdba66 go.mod: update golang.org/x dependencies
• 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 16, 2026, 4:15 PM ET / 20:15 UTC.

ClawSweeper review

What this changes

This pull request updates Slacrawl’s direct golang.org/x/text dependency from v0.40.0 to v0.41.0 and refreshes its Go checksums.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open: current main still pins v0.40.0, so this is a distinct, narrow dependency update. The manifest-only patch has no discrete correctness finding, but it needs after-fix real behavior proof and completion of the currently running test and release checks before merge.

Priority: P3
Reviewed head: f9a0616e49357f0a3658452e6663112de31350e9

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	4 items	Narrow dependency diff: The PR changes only the selected golang.org/x/text version and its two corresponding checksum pairs; it does not modify application source, workflows, or scripts. Direct production usage: Slacrawl directly imports golang.org/x/text/unicode/norm to apply NFKC normalization to archived message text, so this update affects the normalization runtime rather than an unused indirect dependency. Existing behavior coverage: Current tests assert normalization of malformed Unicode, combining characters, full-width punctuation, and whitespace, providing a focused validation surface for the direct dependency use.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl normalizes Slack message text before storing it for search; its Go module manifest selects the Unicode normalization library used in that path. The normalized text then feeds indexed archive search and message display queries.

flowchart LR
  A[Slack message text] --> B[Search normalization]
  B --> C[Unicode text library]
  C --> D[Normalized archive text]
  D --> E[Search and message queries]
  F[Go module manifest] --> C

Loading

Before merge

• Resolve merge risk (P1) - No after-fix real behavior proof is in the PR body or discussion; the direct Unicode-normalization path should be exercised with v0.41.0 before merge.
• Resolve merge risk (P1) - The test and release-check workflows are still in progress, so their final validation result is not yet available.
• Complete next step (P2) - No repair is indicated; a human must supply or assess real after-fix behavior proof and wait for the pending validation checks.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	2 files; +3/-3 lines	The patch is limited to the direct module version and its expected checksum updates.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Retain the minimal locked-module update, attach redacted proof of a real normalization/search flow using v0.41.0, and merge once the required checks pass.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the minimal locked-module update, attach redacted proof of a real normalization/search flow using v0.41.0, and merge once the required checks pass.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance pull request, not a report of broken existing behavior. The affected normalization path is source-identifiable and has focused existing coverage.

Is this the best way to solve the issue?

Yes, conditionally: changing the locked Go module and checksums is the narrow maintainable update path; it should be accompanied by real after-fix behavior proof rather than application-source changes.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against b793612bfa8a.

Labels

Label changes:

• add P3: This is a small, routine dependency-maintenance update with no reported active user regression.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Label justifications:

• P3: This is a small, routine dependency-maintenance update with no reported active user regression.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• Narrow dependency diff: The PR changes only the selected golang.org/x/text version and its two corresponding checksum pairs; it does not modify application source, workflows, or scripts. (go.mod:14, f9a0616e4935)
• Direct production usage: Slacrawl directly imports golang.org/x/text/unicode/norm to apply NFKC normalization to archived message text, so this update affects the normalization runtime rather than an unused indirect dependency. (internal/search/normalize.go:12, b793612bfa8a)
• Existing behavior coverage: Current tests assert normalization of malformed Unicode, combining characters, full-width punctuation, and whitespace, providing a focused validation surface for the direct dependency use. (internal/search/normalize_test.go:35, b793612bfa8a)
• Dependency maintenance history: The repository has previously merged several golang.org/x/text updates; the most recent v0.38.0-to-v0.40.0 update is commit 8d8d48f. (go.mod:14, 8d8d48f6ab54)

Likely related people:

• Peter Steinberger: Peter authored the recent Go-module refresh and the current release commit; local feature history also shows the largest visible contribution count for the search normalizer. (role: recent dependency and search-area contributor; confidence: medium; commits: 5924815eaabf, b793612bfa8a; files: go.mod, go.sum, internal/search/normalize.go)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Superseded by #157, which lands this together with the rest of the dependency refresh in one coherent branch.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.