build(deps): refresh Go toolchain and storage dependencies

[steipete]

Refresh the storage and terminal dependencies while keeping the supported Go minimum at 1.27.0. The preferred development toolchain is now Go 1.27.1; SQLite moves to v1.58.0, x/crypto to v0.56.0, and go-runewidth to v0.0.29.

SQLite v1.58.0 explicitly requires libc v1.75.6. This patch retains that exact runtime pairing and documents why libc must not be upgraded independently. The module's go line remains 1.27.0, while its toolchain line selects 1.27.1 for development and CI.

Validation:

• make check passed with Go 1.27.1: tidy, formatting, vet, deadcode, govulncheck, full unit/race suites, and all 25 release guard tests.
• GOTOOLCHAIN=go1.27.0 GOWORK=off go test -count=1 ./... passed all packages, preserving the documented floor.
• A separate consumer module built with Go 1.27.0 verified the actual linked dependency versions, SQLite 3.53.4, WAL read visibility, transactions/rollback, FTS5, read-only write rejection, snapshot export/restore, integrity, database reopen, age encryption/decryption, and terminal string width. All database and archive files were temporary.
• A built crawlctl passed a real temporary-config run/status/logs/history/lock-cleanup smoke.
• Full-candidate independent Codex P0–P2 review passed without actionable findings.

The dependency refresh is prepared for maintainer review. No release, tag, or deployment is included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	modernc.org/​sqlite@​v1.57.0 ⏵ v1.58.0	-4

View full report

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 4, 2026, 5:05 AM ET / 09:05 UTC.

ClawSweeper review

What this changes

Updates SQLite, cryptography, and terminal-width dependencies, prefers Go 1.27.1 while retaining the Go 1.27.0 minimum, and documents the SQLite/libc pairing.

Merge readiness

⛔ Blocked before merge - 2 items remain

This refresh remains useful: main and v0.14.8 retain the older dependency versions. No actionable patch defect was found, but the reported consumer runs need inspectable real-behavior evidence before merge.

Priority: P2
Reviewed head: 801950f04c696dabd6093c9b1601e0d5cfe090c2

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and has no actionable correctness finding, but runtime evidence is currently limited to a narrative validation report.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the body describes relevant temporary consumer runs through storage, snapshots, encryption, and terminal-width handling, but supplies no captured commands/results or artifact showing those outcomes. This is more than a mock-only claim, yet remains unauditable; passing CI is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the body describes relevant temporary consumer runs through storage, snapshots, encryption, and terminal-width handling, but supplies no captured commands/results or artifact showing those outcomes. This is more than a mock-only claim, yet remains unauditable; passing CI is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	10 items	Repository policy: Read the complete root AGENTS.md and applied its compatibility, temporary-data, and release-ownership guidance. No additional ancestor policy or matching maintainer notes apply to the four root-level changed files. Validation commands were not executed during this read-only review. Verified introduced scope: The complete pinned base-to-head diff changes only go.mod, go.sum, README.md, and CHANGELOG.md. It adds a toolchain preference and three module upgrades; the Go minimum and libc version remain unchanged. Still absent from main: Pinned main uses SQLite v1.57.0, x/crypto v0.55.0, and go-runewidth v0.0.28 without the proposed toolchain directive. Its available history does not establish a merged replacement for this refresh.
Findings	None	None.
Security	None	None.

How this fits together

Crawlkit supplies shared storage, snapshots, encrypted backups, and terminal browsing to downstream crawler applications. Its module dependencies provide the database engine, cryptography, and text-width handling used by those helpers.

flowchart TD
  A[Downstream crawler apps] --> B[Crawlkit shared helpers]
  C[Go module versions] --> B
  B --> D[SQLite storage and snapshots]
  B --> E[Encrypted backups]
  B --> F[Terminal text layout]
  D --> G[Local archives]
  E --> G

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the body describes relevant temporary consumer runs through storage, snapshots, encryption, and terminal-width handling, but supplies no captured commands/results or artifact showing those outcomes. This is more than a mock-only claim, yet remains unauditable; passing CI is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Attach an inspectable transcript or artifact from the reported Go 1.27.0 consumer smoke before merge.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the focused dependency refresh and existing Go minimum, with auditable consumer results supporting storage, backup, and terminal compatibility.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR refreshes dependencies rather than reporting a reproducible existing-behavior defect.

Is this the best way to solve the issue?

Yes: version and checksum updates with matching documentation are a narrow maintenance approach; no competing implementation or API expansion is introduced.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against cf646f20a726.

Labels

Label changes:

• add P2: This is bounded maintenance of shared runtime dependencies, with no established urgent regression or vulnerability.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the body describes relevant temporary consumer runs through storage, snapshots, encryption, and terminal-width handling, but supplies no captured commands/results or artifact showing those outcomes. This is more than a mock-only claim, yet remains unauditable; passing CI is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is bounded maintenance of shared runtime dependencies, with no established urgent regression or vulnerability.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Needs real behavior proof before merge: the body describes relevant temporary consumer runs through storage, snapshots, encryption, and terminal-width handling, but supplies no captured commands/results or artifact showing those outcomes. This is more than a mock-only claim, yet remains unauditable; passing CI is supplemental. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.md and applied its compatibility, temporary-data, and release-ownership guidance. No additional ancestor policy or matching maintainer notes apply to the four root-level changed files. Validation commands were not executed during this read-only review. (AGENTS.md:17, 801950f04c69)
• Verified introduced scope: The complete pinned base-to-head diff changes only go.mod, go.sum, README.md, and CHANGELOG.md. It adds a toolchain preference and three module upgrades; the Go minimum and libc version remain unchanged. (go.mod:3, 801950f04c69)
• Still absent from main: Pinned main uses SQLite v1.57.0, x/crypto v0.55.0, and go-runewidth v0.0.28 without the proposed toolchain directive. Its available history does not establish a merged replacement for this refresh. (go.mod:14, cf646f20a726)
• Latest release comparison: The v0.14.8 tag resolves to the supplied release commit and contains the same older dependency versions; it does not ship this refresh. (go.mod:14, 5cdee495743f)
• Concrete dependency boundary: The store package directly imports modernc.org/sqlite and uses it for writable and read-only connections, transactions, and WAL pragmas. Snapshot import consumes these SQL connections. This establishes why the claimed consumer storage exercises are relevant to the dependency update. (store/store.go:14, 801950f04c69)
• Reported runtime validation: The complete captured PR body at sourceRevision 134869032c54387027eeea8e106600e75f096e39a9cc04a250a2ed779914e5ae describes a Go 1.27.0 consumer checking SQLite 3.53.4, WAL visibility, rollback, FTS5, read-only rejection, snapshots, reopen, encryption, and terminal width using temporary data. These are relevant real-run claims, but the supplied body and discussion contain no consumer invocation, captured runtime output, or linked artifact to inspect. The separate crawlctl smoke does not independently demonstrate those storage paths. (801950f04c69)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach the reported consumer run's commands and results, including resolved versions and storage/backup outcomes; terminal output, screenshots, recordings, or linked logs are acceptable. Redact private paths, IP addresses, keys, phone numbers, and endpoints.
• Update the PR body with that evidence to trigger a fresh review; if it does not run, ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.