Skip to content

build(deps): bump github.com/openclaw/crawlkit from 0.14.3 to 0.14.4 - #133

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/openclaw/crawlkit-0.14.4
Closed

build(deps): bump github.com/openclaw/crawlkit from 0.14.3 to 0.14.4#133
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/openclaw/crawlkit-0.14.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/openclaw/crawlkit from 0.14.3 to 0.14.4.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.14.4 - 2026-07-26

Breaking release asset rename

  • Replace crawlctl-v0.14.3-macos-arm64.tar.gz with crawlkit_0.14.4_darwin_arm64.tar.gz and crawlctl-v0.14.3-macos-x86_64.tar.gz with crawlkit_0.14.4_darwin_amd64.tar.gz. The new fleet-standard names use the repository prefix, omit the v inside filenames, use darwin and amd64, and replace per-asset .sha256 sidecars with one checksums.txt; scripts that download the old names must be updated.
  • Add fleet-standard crawlkit_0.14.4_linux_arm64.tar.gz and crawlkit_0.14.4_linux_amd64.tar.gz archives containing the crawlctl executable.

Maintenance

  • Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
  • Standardize local build, check, snapshot, and fail-closed release commands under the shared crawler Makefile contract.
  • Move official publication to the shared signed, notarized, independently verified GitHub Actions pipeline while preserving the org.openclaw.crawlctl code-signing identifier.
Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.14.4 - 2026-07-26

Final attached CLI artifacts

  • Publish the final GitHub release with attached crawlctl artifacts for macOS and Linux.

Maintenance

  • Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
  • Standardize local build and check commands under the shared crawler Makefile contract.
Commits
  • 4b80ce1 ci: allow the current release signer in crawlkit's allowlist (#67)
  • a46c641 chore: prepare v0.14.4 release (#66)
  • 7e1d015 ci: migrate releases to shared pipeline (#65)
  • 8194635 build: unify Makefile targets across crawler repos
  • e379fee build(deps): pin SQLite libc runtime
  • 1989082 build(deps): update Go dependencies
  • 5dcaa4d build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#64)
  • e6861b9 build(deps): bump the codeql-action group with 2 updates (#63)
  • aa4d5ae build(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#62)
  • 8a6a2a3 ci: add ClawSweeper dispatch workflow
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump github.com/openclaw/crawlkit from 0.14.3 to 0.14.4
4dbd678 
Bumps [github.com/openclaw/crawlkit](https://github.com/openclaw/crawlkit) from 0.14.3 to 0.14.4.
- [Release notes](https://github.com/openclaw/crawlkit/releases)
- [Changelog](https://github.com/openclaw/crawlkit/blob/main/CHANGELOG.md)
- [Commits](openclaw/crawlkit@v0.14.3...v0.14.4)

---
updated-dependencies:
- dependency-name: github.com/openclaw/crawlkit
  dependency-version: 0.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 30, 2026 18:44
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Jul 30, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. labels Jul 30, 2026
@clawsweeper

clawsweeper Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 8:16 PM ET / August 2, 2026, 00:16 UTC.

ClawSweeper review

What this changes

The PR updates Gitcrawl’s direct CrawlKit Go module requirement from v0.14.3 to v0.14.4 and refreshes the corresponding module checksums.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

This PR is still necessary: current main and the latest shipped v0.8.7 tag retain CrawlKit v0.14.3, while the branch cleanly moves the direct module to v0.14.4. No patch defect or supply-chain concern is visible, but the PR has no after-upgrade Gitcrawl behavior proof, so keep it open for a maintainer-run redacted smoke before merge. Likely related people: Peter Steinberger is the best available routing candidate from the current version-pin history (medium confidence).

Priority: P3
Reviewed head: 4dbd67816eba8aa3312a689bc18cd3833766c6b1

Review scores

Measure Result What it means
Overall readiness 🦪 silver shellfish (2/6) The implementation is focused and mechanically correct, but the required real behavior proof for a direct production dependency is absent.
Proof confidence 🧂 unranked krab (1/6) Needs real behavior proof before merge: The PR supplies completed CI but no after-fix Gitcrawl run on CrawlKit v0.14.4. Attach a redacted terminal transcript or recording, removing private paths, tokens, endpoints, IP addresses, and other sensitive details. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: The PR supplies completed CI but no after-fix Gitcrawl run on CrawlKit v0.14.4. Attach a redacted terminal transcript or recording, removing private paths, tokens, endpoints, IP addresses, and other sensitive details. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 5 items Current-main dependency pin: Current main still directly requires CrawlKit v0.14.3; the branch is therefore not obsolete or already implemented.
Narrow dependency-only patch: The PR head changes only the direct CrawlKit version and its two checksum entries; git diff --check reports no whitespace errors.
Runtime integration surface: Current main imports CrawlKit in configuration, CLI runtime and remote commands, storage, vector search, embedding client handling, control metadata, and release checks, so compile matrices alone do not demonstrate a live upgraded application path.
Findings None None.
Security None None.

How this fits together

Gitcrawl is a Go CLI that captures, stores, searches, and optionally publishes GitHub archive data. CrawlKit is its shared library for configuration, remote access, local storage and vectors, control metadata, embedding calls, and release checks.

flowchart LR
  A[Gitcrawl commands] --> B[Configuration and runtime]
  B --> C[CrawlKit shared library]
  C --> D[Local archive and search]
  C --> E[Remote and cloud operations]
  C --> F[Control and release checks]
Loading

Before merge

  • Resolve merge risk (P1) - The direct production dependency spans several runtime paths, but no redacted after-upgrade Gitcrawl smoke demonstrates that the v0.14.4 module behaves correctly in this application.
  • Resolve merge risk (P1) - The local clone is partial and unavailable network prevented a deeper historical fetch; this does not affect the current-main and PR-head evidence, but limits older ownership provenance.
  • Complete next step (P2) - A maintainer-run real behavior smoke is the remaining merge gate; there is no discrete implementation defect for an automated repair worker to change.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Patch size 2 files affected; 3 additions, 3 deletions The branch only changes the direct module pin and its integrity checksums.
CrawlKit reach 8 imported shared packages The direct dependency is used by configuration, remote, storage, vector, embedding, control, and release-check paths.

Merge-risk options

Maintainer options:

  1. Decide the mitigation before merge
    Have a maintainer run and attach a redacted Gitcrawl smoke from the v0.14.4 branch covering a read-only control command, a local archive command, and the relevant update-check path; merge the unchanged two-file bump if those observed results remain correct.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Have a maintainer run and attach a redacted Gitcrawl smoke from the v0.14.4 branch covering a read-only control command, a local archive command, and the relevant update-check path; merge the unchanged two-file bump if those observed results remain correct.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-update PR, not a report of broken behavior. The relevant verification is a real post-upgrade Gitcrawl smoke rather than bug reproduction.

Is this the best way to solve the issue?

Yes, conditionally: changing only the module version and checksums is the narrowest maintainable approach, and no Gitcrawl code refers to the upstream renamed CrawlKit release assets. A live Gitcrawl run remains necessary to validate the direct production dependency update.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against dcdf94703540.

Labels

Label justifications:

  • P3: This is a small patch-level maintenance update with successful CI and a remaining proof gap rather than an observed user regression.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR supplies completed CI but no after-fix Gitcrawl run on CrawlKit v0.14.4. Attach a redacted terminal transcript or recording, removing private paths, tokens, endpoints, IP addresses, and other sensitive details. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

  • Current-main dependency pin: Current main still directly requires CrawlKit v0.14.3; the branch is therefore not obsolete or already implemented. (go.mod:12, dcdf94703540)
  • Narrow dependency-only patch: The PR head changes only the direct CrawlKit version and its two checksum entries; git diff --check reports no whitespace errors. (go.sum:64, 4dbd67816eba)
  • Runtime integration surface: Current main imports CrawlKit in configuration, CLI runtime and remote commands, storage, vector search, embedding client handling, control metadata, and release checks, so compile matrices alone do not demonstrate a live upgraded application path. (internal/cli/releasecheck.go:10, dcdf94703540)
  • Version-pin provenance: The current v0.14.3 requirement dates to the v0.8.7 release-preparation commit by Peter Steinberger; local tag inspection confirms v0.8.7 contains that commit, while current main is ahead of the tag. (go.mod:12, 4f737bb846e0)
  • Release-script boundary: Gitcrawl’s release scripts and docs use gitcrawl_* archives and their own checksums.txt; no current source reference to the renamed CrawlKit CLI release assets was found. (scripts/verify-release.sh:23, dcdf94703540)

Likely related people:

  • Peter Steinberger: The reachable version-pin history and blame attribute the current CrawlKit v0.14.3 line to the v0.8.7 release-preparation commit. (role: current version introducer; confidence: medium; commits: 4f737bb846e0; files: go.mod)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Attach a redacted terminal transcript from the v0.14.4 branch showing a supported control command, a local archive command, and the applicable update-check path.
  • After adding proof, update the PR body for automatic re-review or ask a maintainer to comment @clawsweeper re-review if needed.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (15 earlier review cycles; latest 8 shown)
  • reviewed 2026-07-31T19:12:08.402Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-31T21:15:49.888Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-31T23:12:03.427Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T05:08:21.782Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T13:11:19.497Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T16:10:15.842Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T21:23:09.341Z sha 4dbd678 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T22:57:28.986Z sha 4dbd678 :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. and removed merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 30, 2026
@steipete steipete mentioned this pull request Aug 2, 2026
Merged
@steipete

steipete commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Superseded by #136, which includes CrawlKit v0.14.4 in a complete dependency refresh. The upgraded real CLI passed the full Go suite, build, lint/vulnerability/dead-code gates, release-script tests, and source-blind status/configuration smoke runs. Recommend closing this narrow Dependabot PR after #136 lands.

@steipete

steipete commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Superseded by the verified fix and dependency refresh landed in #136. The reproduction and proof are recorded in #133 (comment).

@steipete steipete closed this Aug 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 2, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/openclaw/crawlkit-0.14.4 branch August 2, 2026 03:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete