build(deps): bump github.com/openclaw/crawlkit from 0.14.3 to 0.14.4

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.14.3 to 0.14.4.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.14.4 - 2026-07-26

Breaking release asset rename

• Replace crawlctl-v0.14.3-macos-arm64.tar.gz with crawlkit_0.14.4_darwin_arm64.tar.gz and crawlctl-v0.14.3-macos-x86_64.tar.gz with crawlkit_0.14.4_darwin_amd64.tar.gz. The new fleet-standard names use the repository prefix, omit the v inside filenames, use darwin and amd64, and replace per-asset .sha256 sidecars with one checksums.txt; scripts that download the old names must be updated.
• Add fleet-standard crawlkit_0.14.4_linux_arm64.tar.gz and crawlkit_0.14.4_linux_amd64.tar.gz archives containing the crawlctl executable.

Maintenance

• Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
• Standardize local build, check, snapshot, and fail-closed release commands under the shared crawler Makefile contract.
• Move official publication to the shared signed, notarized, independently verified GitHub Actions pipeline while preserving the org.openclaw.crawlctl code-signing identifier.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.14.4 - 2026-07-26

Final attached CLI artifacts

• Publish the final GitHub release with attached crawlctl artifacts for macOS and Linux.

Maintenance

• Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
• Standardize local build and check commands under the shared crawler Makefile contract.

Commits

• 4b80ce1 ci: allow the current release signer in crawlkit's allowlist (#67)
• a46c641 chore: prepare v0.14.4 release (#66)
• 7e1d015 ci: migrate releases to shared pipeline (#65)
• 8194635 build: unify Makefile targets across crawler repos
• e379fee build(deps): pin SQLite libc runtime
• 1989082 build(deps): update Go dependencies
• 5dcaa4d build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#64)
• e6861b9 build(deps): bump the codeql-action group with 2 updates (#63)
• aa4d5ae build(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#62)
• 8a6a2a3 ci: add ClawSweeper dispatch workflow
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 12:10 PM ET / 16:10 UTC.

ClawSweeper review

What this changes

Updates Gitcrawl’s direct CrawlKit Go module dependency from v0.14.3 to v0.14.4 and refreshes the corresponding Go checksums.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

Keep this PR open for a narrow runtime-proof gate. The version and checksum-only patch is clean and current main still uses CrawlKit v0.14.3, but Gitcrawl imports CrawlKit across configuration, remote/cloud, storage, vector, and release-notification paths; passing CI does not demonstrate a configured post-upgrade run.

Priority: P3
Reviewed head: 4dbd67816eba8aa3312a689bc18cd3833766c6b1
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The two-file Go module patch is clean and CI-backed, but it is not merge-ready without real runtime proof for the direct production dependency.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: No after-fix configured Gitcrawl runtime evidence is present; CI is supplemental, so add redacted terminal output, logs, or a recording from a real v0.14.4 run before merge. After updating the PR body, request a fresh review if one is not triggered automatically. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: No after-fix configured Gitcrawl runtime evidence is present; CI is supplemental, so add redacted terminal output, logs, or a recording from a real v0.14.4 run before merge. After updating the PR body, request a fresh review if one is not triggered automatically. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	Current main remains on the prior version: Current main and the shipped v0.8.7 tag both require github.com/openclaw/crawlkit v0.14.3, so the requested v0.14.4 update is not already implemented or superseded. Patch is narrowly scoped and whitespace-clean: The proposed branch changes only go.mod and go.sum: one direct-module version line plus the two corresponding checksum records; git diff --check reported no whitespace errors. Dependency is on production-critical paths: Current source imports CrawlKit packages in configuration, remote/cloud commands, storage, vector search, synchronization, OpenAI embedding, and release checking; for example, release checks directly call CrawlKit’s releasecheck package.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl is a Go CLI that uses CrawlKit for shared configuration, remote access, storage, vector operations, and release checking. User commands load Gitcrawl configuration and archive data, then delegate those cross-cutting operations to the direct CrawlKit dependency.

flowchart LR
  User[CLI user or automation] --> Config[Gitcrawl configuration]
  Config --> App[Gitcrawl command runtime]
  App --> CrawlKit[Shared CrawlKit module]
  CrawlKit --> Remote[Remote and cloud access]
  CrawlKit --> Store[Local store and vectors]
  CrawlKit --> Release[Release notification]
  Remote --> Output[CLI results] 
  Store --> Output
  Release --> Output

Loading

Decision needed

Question	Recommendation
Should this direct production dependency update receive an explicit proof-gate override, or should it wait for a redacted configured Gitcrawl runtime smoke on CrawlKit v0.14.4?	Require runtime proof: Keep the PR open until a maintainer or contributor posts redacted terminal output from a configured Gitcrawl run using v0.14.4.

Why: The patch is mechanically narrow and CI is green, but the external Dependabot PR contains no post-upgrade real-behavior evidence for the direct runtime dependency.

Before merge

• Resolve merge risk (P1) - Merging without a real configured run leaves compatibility across Gitcrawl’s shared CrawlKit configuration, remote/cloud, store, and release-check paths unobserved on v0.14.4.
• Complete next step (P2) - A maintainer must resolve the real-behavior proof gate or explicitly accept an evidence-based override; there is no discrete patch defect for a repair worker to change.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	2 files affected; 3 additions, 3 deletions	The branch is limited to the direct module pin and its checksum records, so the remaining decision is runtime compatibility rather than patch scope.

Merge-risk options

Maintainer options:

1. Capture a configured CLI smoke (recommended)
   Before merge, post redacted after-upgrade terminal output from a configured Gitcrawl command that exercises a CrawlKit-backed runtime path.
2. Accept the proof exception
   A maintainer may explicitly accept the patch-level dependency risk based on the clean two-file diff and existing CI coverage.

Technical review

Best possible solution:

Validate v0.14.4 with a redacted configured Gitcrawl CLI smoke that exercises a real CrawlKit-backed path, then retain this two-file dependency update if the observed behavior is unchanged.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: this is a dependency update. A high-confidence acceptance check is still available—run a configured Gitcrawl command after resolving CrawlKit v0.14.4 and retain redacted terminal output.

Is this the best way to solve the issue?

Yes, the dependency pin and checksum update are the narrowest maintainable implementation path. The missing part is evidence that a real configured Gitcrawl runtime remains compatible with the new direct dependency.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against dcdf94703540.

Labels

Label changes:

• add merge-risk: 🚨 compatibility: CrawlKit is a direct production dependency across Gitcrawl runtime paths, and CI alone does not establish upgrade behavior in a configured installation.

Label justifications:

• P3: This is a routine patch-level dependency maintenance update with no reported production regression.
• merge-risk: 🚨 compatibility: CrawlKit is a direct production dependency across Gitcrawl runtime paths, and CI alone does not establish upgrade behavior in a configured installation.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: No after-fix configured Gitcrawl runtime evidence is present; CI is supplemental, so add redacted terminal output, logs, or a recording from a real v0.14.4 run before merge. After updating the PR body, request a fresh review if one is not triggered automatically. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current main remains on the prior version: Current main and the shipped v0.8.7 tag both require github.com/openclaw/crawlkit v0.14.3, so the requested v0.14.4 update is not already implemented or superseded. (go.mod:12, dcdf94703540)
• Patch is narrowly scoped and whitespace-clean: The proposed branch changes only go.mod and go.sum: one direct-module version line plus the two corresponding checksum records; git diff --check reported no whitespace errors. (go.mod:12, 4dbd67816eba)
• Dependency is on production-critical paths: Current source imports CrawlKit packages in configuration, remote/cloud commands, storage, vector search, synchronization, OpenAI embedding, and release checking; for example, release checks directly call CrawlKit’s releasecheck package. (internal/cli/releasecheck.go:10, dcdf94703540)
• Current dependency provenance: The current dependency line traces by git blame to the v0.8.7 release-preparation commit, which also introduced the present release-check integration snapshot. (go.mod:12, 4f737bb846e0)
• Existing validation is supplemental only: The supplied PR context shows successful Go, Docker, and secret-scan checks, but the PR body and comments contain no after-upgrade configured Gitcrawl run, terminal output, recording, or redacted runtime logs. (4dbd67816eba)

Likely related people:

• steipete: Git blame attributes the current CrawlKit version line and the release-check source snapshot to the v0.8.7 release-preparation commit by Peter Steinberger. (role: release and dependency-history owner; confidence: high; commits: 4f737bb846e0; files: go.mod, internal/cli/releasecheck.go)
• vincentkoc: Feature-history shortlog over Gitcrawl’s central CrawlKit integration files shows Vincent Koc as the largest contributor, and merged work in this area included earlier CrawlKit upgrades. (role: major shared-integration contributor; confidence: medium; commits: bd7ef8461294; files: internal/config/config.go, internal/cli/app.go, internal/store/store.go)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Post redacted output from a configured Gitcrawl run using CrawlKit v0.14.4 that exercises a CrawlKit-backed command path.
• Update the PR body with that proof and request a fresh review if automation does not re-run.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (12 earlier review cycles; latest 8 shown)

• reviewed 2026-07-31T02:53:52.240Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T09:33:36.587Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T12:29:33.791Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T19:12:08.402Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T21:15:49.888Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T23:12:03.427Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T05:08:21.782Z sha 4dbd678 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T13:11:19.497Z sha 4dbd678 :: needs maintainer review before merge. :: none