chore(deps): refresh dependencies

[steipete]

Summary

• refresh every explicit Go module requirement to its latest stable version and tidy the checksum graph
• refresh the pinned govulncheck and deadcode versions used locally and in CI
• refresh the pinned TruffleHog and CodeQL action revisions
• supersede the separate Dependabot queue in chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 #153, chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 #154, chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.7 #155, and chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.7 #156

Moved

• github.com/openclaw/crawlkit 0.14.6 to 0.14.7
• github.com/slack-go/slack 0.27.0 to 0.29.0
• github.com/stretchr/testify 1.11.1 to 1.12.0
• golang.org/x/text 0.40.0 to 0.41.0
• github.com/charmbracelet/x/ansi 0.11.7 to 0.11.8
• github.com/xo/terminfo pre-v1 pseudo-version to 1.0.0
• golang.org/x/net 0.57.0 to 0.58.0
• govulncheck 1.6.0 to 1.7.0
• deadcode from golang.org/x/tools 0.48.0 to 0.49.0
• TruffleHog action 3.96.0 to 3.97.0
• CodeQL init and analyze actions 4.37.6 to 4.37.7
• removed obsolete go-spew and go-difflib requirements after the testify refresh

Held

• Nothing. This repository has no dependency cooldown policy, every explicit go.mod requirement is current, and no UI or animation dependency is involved.
• The indirect xo/terminfo v1 transition is the only major boundary and passed the full repository gate, CLI runtime smoke, and release snapshot.

Proof

• GOWORK=off go mod download
• GOWORK=off go mod verify — all modules verified
• explicit go.mod update query — no remaining updates
• make check — tidy, formatting, vet, govulncheck, deadcode, all package tests, CLI smoke, and four-platform GoReleaser snapshot passed
• govulncheck 1.7.0 — no vulnerabilities found
• actionlint -config-file .github/actionlint.yaml
• make build
• bin/slacrawl --help — rendered the expected command surface
• bin/slacrawl --version — dev
• autoreview — clean, no accepted or actionable findings

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 17, 2026, 4:35 AM ET / 08:35 UTC.

ClawSweeper review

What this changes

This PR refreshes direct and indirect Go modules, local and CI analysis-tool versions, and pinned CodeQL and TruffleHog workflow actions.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep this collaborator-authored PR open for normal review. The six-file refresh is coherent and preserves immutable action pins, but the updated analysis, lint, test, and release checks are still running.

Priority: P3
Reviewed head: bcfb9cc8c8544ccfcd4aa81873546616d4d183b9

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, coherent maintenance patch with appropriate declared validation; the remaining CI runs are the material merge gate.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored maintenance PR is exempt from the external contributor real-behavior-proof gate; its body also records module, build, CLI-smoke, and release-snapshot validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored maintenance PR is exempt from the external contributor real-behavior-proof gate; its body also records module, build, CLI-smoke, and release-snapshot validation.
Evidence reviewed	5 items	Focused dependency scope: The PR updates four direct Go requirements and aligned indirect checksums without changing Go implementation files. Automation pins remain immutable: CodeQL init/analyze and TruffleHog remain pinned to explicit full commit IDs; workflow permissions and scan arguments are unchanged. Consistent analysis-tool update: CI and the local Makefile both move govulncheck to v1.7.0 and deadcode to v0.49.0, avoiding version drift between local and CI checks.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl’s Go module graph supplies its Slack-export CLI and package tests, while GitHub workflows install analysis tools and run security scans. This PR updates those build-time inputs and their validation path.

flowchart LR
  A[Go module versions] --> B[Dependency graph]
  B --> C[CLI and package tests]
  D[Tool and action pins] --> E[CI security checks]
  C --> F[Release validation]
  E --> F

Loading

Before merge

• Resolve merge risk (P1) - Updating CodeQL and TruffleHog changes CI execution, so the currently running analysis, lint, test, and release checks should complete successfully before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	6 files affected; 28 added, 34 removed	The patch is limited to dependency manifests, local validation commands, and CI workflow pins.
Runtime-code changes	0 Go implementation files changed	User-facing CLI behavior is not directly modified by this refresh.

Root-cause cluster

Relationship: canonical
Canonical: #157
Summary: This consolidated refresh contains the exact version changes proposed by the four related single-dependency PRs.

Members:

• superseded: chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 #153 - This PR updates the same TruffleHog action from v3.96.0 to v3.97.0.
• superseded: chore(deps): bump golang.org/x/text from 0.40.0 to 0.41.0 #154 - This PR updates the same golang.org/x/text requirement from v0.40.0 to v0.41.0.
• superseded: chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.7 #155 - This PR updates the same CodeQL analyze action from v4.37.6 to v4.37.7.
• superseded: chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.7 #156 - This PR updates the same CodeQL init action from v4.37.6 to v4.37.7.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Wait for updated workflow validation (recommended)
   Merge after the in-progress CodeQL analysis, lint, test, and release-check jobs validate the upgraded tools and actions.

Technical review

Best possible solution:

Land the consolidated refresh after the remaining checks pass, then close the fully subsumed Dependabot PRs at #153, #154, #155, and #156.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR, not a report of a reproducible product failure.

Is this the best way to solve the issue?

Yes: consolidating overlapping dependency updates keeps one coherent module graph and one set of CI action pins; the remaining CI runs are the appropriate compatibility check.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against b793612bfa8a.

Labels

Label changes:

• add P3: This is routine dependency and CI maintenance with limited direct user impact.
• add merge-risk: 🚨 automation: The patch updates security and analysis actions that execute in GitHub workflows.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored maintenance PR is exempt from the external contributor real-behavior-proof gate; its body also records module, build, CLI-smoke, and release-snapshot validation.

Label justifications:

• P3: This is routine dependency and CI maintenance with limited direct user impact.
• merge-risk: 🚨 automation: The patch updates security and analysis actions that execute in GitHub workflows.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored maintenance PR is exempt from the external contributor real-behavior-proof gate; its body also records module, build, CLI-smoke, and release-snapshot validation.

Evidence

What I checked:

• Focused dependency scope: The PR updates four direct Go requirements and aligned indirect checksums without changing Go implementation files. (go.mod:9, bcfb9cc8c854)
• Automation pins remain immutable: CodeQL init/analyze and TruffleHog remain pinned to explicit full commit IDs; workflow permissions and scan arguments are unchanged. (.github/workflows/codeql.yml:33, bcfb9cc8c854)
• Consistent analysis-tool update: CI and the local Makefile both move govulncheck to v1.7.0 and deadcode to v0.49.0, avoiding version drift between local and CI checks. (.github/workflows/ci.yml:41, bcfb9cc8c854)
• History and ownership: The current reachable history records Peter Steinberger as author of the release boundary and the proposed refresh; deeper history is unavailable in this shallow checkout, so ownership confidence is medium. (go.mod:9, b793612bfa8a)
• Pending validation: The provided PR context reports successful dependency, secret-scan, Docker, dispatch, and labeling checks; CodeQL analysis, lint, test, and release-check are still in progress. (bcfb9cc8c854)

Likely related people:

• steipete: The current reachable main-history boundary and this PR’s commit are both attributed to Peter Steinberger, matching the collaborator handle. (role: recent dependency and release-config contributor; confidence: medium; commits: b793612bfa8a, bcfb9cc8c854; files: go.mod, Makefile, .github/workflows/ci.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the in-progress CodeQL analysis, lint, test, and release-check jobs to complete successfully.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.