build(deps): bump github.com/openclaw/crawlkit from 0.14.3 to 0.14.4

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.14.3 to 0.14.4.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.14.4 - 2026-07-26

Breaking release asset rename

• Replace crawlctl-v0.14.3-macos-arm64.tar.gz with crawlkit_0.14.4_darwin_arm64.tar.gz and crawlctl-v0.14.3-macos-x86_64.tar.gz with crawlkit_0.14.4_darwin_amd64.tar.gz. The new fleet-standard names use the repository prefix, omit the v inside filenames, use darwin and amd64, and replace per-asset .sha256 sidecars with one checksums.txt; scripts that download the old names must be updated.
• Add fleet-standard crawlkit_0.14.4_linux_arm64.tar.gz and crawlkit_0.14.4_linux_amd64.tar.gz archives containing the crawlctl executable.

Maintenance

• Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
• Standardize local build, check, snapshot, and fail-closed release commands under the shared crawler Makefile contract.
• Move official publication to the shared signed, notarized, independently verified GitHub Actions pipeline while preserving the org.openclaw.crawlctl code-signing identifier.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.14.4 - 2026-07-26

Final attached CLI artifacts

• Publish the final GitHub release with attached crawlctl artifacts for macOS and Linux.

Maintenance

• Update Go dependencies, including go-runewidth v0.0.27 and x/crypto v0.54.0, and refresh Actions Checkout to v7.0.1 and CodeQL Action to v4.37.3.
• Standardize local build and check commands under the shared crawler Makefile contract.

Commits

• 4b80ce1 ci: allow the current release signer in crawlkit's allowlist (#67)
• a46c641 chore: prepare v0.14.4 release (#66)
• 7e1d015 ci: migrate releases to shared pipeline (#65)
• 8194635 build: unify Makefile targets across crawler repos
• e379fee build(deps): pin SQLite libc runtime
• 1989082 build(deps): update Go dependencies
• 5dcaa4d build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#64)
• e6861b9 build(deps): bump the codeql-action group with 2 updates (#63)
• aa4d5ae build(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#62)
• 8a6a2a3 ci: add ClawSweeper dispatch workflow
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 7:48 PM ET / 23:48 UTC.

ClawSweeper review

What this changes

Updates Discrawl’s direct Crawlkit Go module from v0.14.3 to v0.14.4 and refreshes the resolved indirect terminal-formatting modules and checksums.

Merge readiness

⛔ Blocked until real behavior proof is added - 2 items remain

This update is still necessary: current main and the latest v0.11.10 release retain Crawlkit v0.14.3. The two-file dependency update has no code defect found, but this external code-bearing PR still lacks after-update Discrawl runtime proof required before merge.

Priority: P3
Reviewed head: b7d38c8cc7c66bc116eb2d08516bc7d82dd4f54b

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The implementation is a clean, narrow dependency update, but real Discrawl behavior after the update has not been demonstrated.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The external PR body has upstream release notes and CI results but no after-update Discrawl runtime evidence; add a redacted terminal transcript or logs for a meaningful Crawlkit-backed command before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The external PR body has upstream release notes and CI results but no after-update Discrawl runtime evidence; add a redacted terminal transcript or logs for a meaningful Crawlkit-backed command before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	Current main and latest release retain the old module: go.mod on current main requires github.com/openclaw/crawlkit v0.14.3; that dependency block is attributed to the current release-pipeline commit, which is contained in v0.11.10. Proposed change is narrow: The proposed head changes only go.mod and go.sum, updating Crawlkit to v0.14.4 and the associated resolved indirect module versions and checksums. Direct runtime dependency surface: Current source imports Crawlkit across CLI release checks, configuration, remote control, storage/query, sync progress, embeddings, and terminal UI paths.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl delegates shared configuration, remote control, snapshot storage, progress reporting, semantic helpers, and its terminal browser to Crawlkit. Discrawl commands pass inputs into those shared libraries and return CLI, sync, search, and terminal UI results to operators.

flowchart LR
  A[Discord data and CLI commands] --> B[Discrawl application]
  B --> C[Shared Crawlkit libraries]
  C --> D[Configuration and remote control]
  C --> E[Storage sync and search]
  C --> F[Terminal browser]
  D --> G[Operator-facing CLI results]
  E --> G
  F --> G

Loading

Before merge

• Resolve merge risk (P1) - The patch updates a direct production dependency used by several operator-facing paths; green CI establishes build and test compatibility but does not demonstrate an after-update Discrawl runtime path.
• Complete next step (P2) - No mechanical repair is needed; the contributor must supply real runtime proof before a maintainer can merge this clean patch.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency diff	2 files; 9 additions, 9 deletions	The patch is constrained to module resolution and does not alter Discrawl source, workflows, or release configuration.
Runtime consumers	7+ source areas	Crawlkit is directly imported by configuration, remote control, storage, sync, semantic helpers, release checks, and the terminal UI, so a focused runtime proof is more useful than broader diff expansion.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Keep the two-file module update and add a redacted after-update transcript for one meaningful Crawlkit-backed Discrawl command, then land it if the current checks remain green.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep the two-file module update and add a redacted after-update transcript for one meaningful Crawlkit-backed Discrawl command, then land it if the current checks remain green.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency and does not report a broken product behavior. Current main and the latest release still use the prior Crawlkit version, so the update request remains applicable.

Is this the best way to solve the issue?

Yes, conditionally: a narrow Go module update is the maintainable solution, and its existing diff contains no correctness defect; the remaining gap is after-update runtime proof rather than a code change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8141387a4f95.

Labels

Label justifications:

• P3: This is a routine patch-level dependency update without a reported user-facing incident or demonstrated regression.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The external PR body has upstream release notes and CI results but no after-update Discrawl runtime evidence; add a redacted terminal transcript or logs for a meaningful Crawlkit-backed command before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current main and latest release retain the old module: go.mod on current main requires github.com/openclaw/crawlkit v0.14.3; that dependency block is attributed to the current release-pipeline commit, which is contained in v0.11.10. (go.mod:47, 4f3017c8188d)
• Proposed change is narrow: The proposed head changes only go.mod and go.sum, updating Crawlkit to v0.14.4 and the associated resolved indirect module versions and checksums. (go.mod:40, b7d38c8cc7c6)
• Direct runtime dependency surface: Current source imports Crawlkit across CLI release checks, configuration, remote control, storage/query, sync progress, embeddings, and terminal UI paths. (internal/cli/releasecheck.go:11, 8141387a4f95)
• Upstream asset rename is not a demonstrated Discrawl incompatibility: Discrawl's Crawlkit release-check use constructs options for the Discrawl GitHub module, not Crawlkit release assets; the upstream asset rename therefore does not itself establish a Discrawl break. (internal/cli/releasecheck.go:23, 8141387a4f95)
• Applicable proof policy: The fully read applicable parent-scope review policy requires current real-behavior proof for code-bearing PRs and states that CI alone does not replace it. (../AGENTS.md:48, 8141387a4f95)
• Feature-history routing: The current Crawlkit selection and related dependency block date to the release-pipeline migration commit by Peter Steinberger; available local history shows that commit as the latest central touch. (go.mod:47, 4f3017c8188d)

Likely related people:

• Peter Steinberger: The current Crawlkit version selection and resolved dependency block were introduced by the current release-pipeline migration commit. (role: recent area contributor; confidence: high; commits: 4f3017c8188d; files: go.mod, go.sum)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Post a redacted after-update terminal transcript for a Crawlkit-backed Discrawl command, such as discrawl check-update --json or another meaningful runtime path.
• Keep that evidence in the PR body; after updating it, trigger a fresh ClawSweeper review if one is not automatically started.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-08-01T12:59:46.215Z sha b7d38c8 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T14:52:25.264Z sha b7d38c8 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T16:18:26.066Z sha b7d38c8 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T18:44:24.138Z sha b7d38c8 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T22:37:18.518Z sha b7d38c8 :: needs maintainer review before merge. :: none

[steipete]

Verified the Dependabot head b7d38c8cc7c66bc116eb2d08516bc7d82dd4f54b locally on macOS arm64 with Go 1.26.5.

Validation:

GOWORK=off go test ./...
# all packages passed

GOWORK=off go vet ./...
# passed with no diagnostics

GOWORK=off go build -trimpath -o /tmp/discrawl-pr155 ./cmd/discrawl
/tmp/discrawl-pr155 --version
devel

DISCRAWL_NO_UPDATE_CHECK=1 /tmp/discrawl-pr155 --json check-update
{
  "current_version": "devel",
  "update_available": false,
  "from_cache": false,
  "skipped": true,
  "reason": "development version"
}

The live binary run exercises Discrawl's Crawlkit-backed release-check path after the v0.14.4 update. No runtime or test regression reproduced.

[steipete]

The Crawlkit v0.14.4 update is verified here: the full Go suite and vet passed, and the real built binary completed the Crawlkit-backed structured release-check path.

#158 carries the same Crawlkit update plus every other outdated dependency recorded by the repository, with full local gates, a six-platform snapshot, isolated SQLite/Crawlkit live proof, and a live actions/stale@v11 workflow run.

Recommendation: close this PR as superseded by #158, then land #158 after its CI is green.

[dependabot]

Looks like github.com/openclaw/crawlkit is up-to-date now, so this is no longer needed.

[steipete]

#158 landed as 48b28c60866c95e4c106ce998e0c227998ed185e and includes Crawlkit v0.14.4 with the broader verified dependency refresh. Closing this PR as superseded, per the earlier note and proof.