build(deps): update crawlkit to v0.14.5

[vincentkoc]

Summary

• update Crawlkit from v0.14.4 to v0.14.5
• refresh the transitive go-colorful dependency to v1.4.1
• record the maintenance update in the Unreleased changelog

Upstream validation

• the published github.com/openclaw/crawlkit@v0.14.5 module and tag resolve successfully
• GOWORK=off go test -count=1 ./... passes across the Crawlkit v0.14.5 module
• Crawlkit has no open issue or pull request requiring an upstream fix for this update

Discrawl validation

• make check
• autoreview: clean, no actionable findings
• lint, vet, staticcheck, gosec, and govulncheck pass with zero reachable vulnerabilities
• coverage: 85.1%
• race tests pass
• six-platform GoReleaser snapshot passes
• rebuilt binary passes read-only local metadata, status, diagnostics, and SQL validation
• local archive reports SQLite integrity ok, catalog state consistent, and zero orphaned messages/channel IDs

No archive data, credentials, or private paths are included in this PR.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 3, 2026, 5:11 AM ET / 09:11 UTC.

ClawSweeper review

What this changes

Updates Discrawl’s direct Crawlkit dependency from v0.14.4 to v0.14.5, refreshes the resolved go-colorful transitive version, and records the maintenance update in the changelog.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this member-authored draft open for normal review: it makes a narrow, internally consistent Crawlkit patch update, while the remaining lint, test, and release-check workflows should complete before merge.

Priority: P3
Reviewed head: aad4f8181669ce96673531b0757263e26577bc80

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent dependency update with no actionable patch defect found; completion of the current CI checks remains the normal merge gate.
Proof confidence	🌊 off-meta tidepool	Not applicable: Not applicable: this is a member-authored maintenance PR, so the external-contributor real-behavior-proof gate does not apply; its stated validation is supplemented by the repository checks still in progress.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Not applicable: this is a member-authored maintenance PR, so the external-contributor real-behavior-proof gate does not apply; its stated validation is supplemented by the repository checks still in progress.
Evidence reviewed	4 items	Focused dependency diff: The branch changes only the changelog, go.mod, and go.sum; it advances the existing Crawlkit requirement to v0.14.5 and updates matching module checksums without changing application code, workflows, or permissions. Shared dependency surface: Current main imports Crawlkit across release checking, configuration, storage, embeddings, remote control, and archive sharing, so the pending repository checks are relevant compatibility coverage for this otherwise narrow module update. Dependency provenance: The present v0.14.4 requirement was last attributed to the v0.12.0 release commit, establishing Peter Steinberger as the most recent current-main owner of this dependency-file state.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl relies on Crawlkit for shared CLI support, configuration paths, read-only SQLite access, embeddings, release checks, and archive merge operations. Go module resolution selects those shared library implementations before Discrawl’s commands and storage workflows run.

flowchart LR
  A[Discrawl commands] --> B[Crawlkit module]
  B --> C[Configuration and remote access]
  B --> D[SQLite archive and search]
  B --> E[Shared archive operations]
  C --> F[Discrawl CLI output]
  D --> F
  E --> F

Loading

Before merge

• Resolve merge risk (P1) - Crawlkit is used across configuration, archive storage, embeddings, remote operations, and release checking; pending lint, test, and release-check workflows should complete successfully before this dependency update lands.
• Complete next step (P2) - No repair lane is needed: this clean member-authored dependency update awaits normal CI completion and maintainer review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Module update scope	3 files affected; +10, -6	The patch is confined to the Go dependency manifest, checksums, and the established maintenance changelog section.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Merge the focused module update after the current checks confirm the existing Discrawl workflows remain compatible with Crawlkit v0.14.5.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Merge the focused module update after the current checks confirm the existing Discrawl workflows remain compatible with Crawlkit v0.14.5.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates an existing dependency rather than reporting a user-visible defect. The relevant verification path is the repository’s compatibility checks, which are still running.

Is this the best way to solve the issue?

Yes. Updating the existing direct Go module requirement and its resolved checksums is the narrowest maintainable path; no duplicate implementation or new configuration surface is introduced.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 3cae6351db7c.

Labels

Label changes:

• add P3: This is a routine dependency maintenance update with no reported user-facing regression or concrete merge defect.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this is a member-authored maintenance PR, so the external-contributor real-behavior-proof gate does not apply; its stated validation is supplemented by the repository checks still in progress.

Label justifications:

• P3: This is a routine dependency maintenance update with no reported user-facing regression or concrete merge defect.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this is a member-authored maintenance PR, so the external-contributor real-behavior-proof gate does not apply; its stated validation is supplemented by the repository checks still in progress.

Evidence

What I checked:

• Focused dependency diff: The branch changes only the changelog, go.mod, and go.sum; it advances the existing Crawlkit requirement to v0.14.5 and updates matching module checksums without changing application code, workflows, or permissions. (go.mod:47, aad4f8181669)
• Shared dependency surface: Current main imports Crawlkit across release checking, configuration, storage, embeddings, remote control, and archive sharing, so the pending repository checks are relevant compatibility coverage for this otherwise narrow module update. (internal/cli/releasecheck.go:11, 3cae6351db7c)
• Dependency provenance: The present v0.14.4 requirement was last attributed to the v0.12.0 release commit, establishing Peter Steinberger as the most recent current-main owner of this dependency-file state. (go.mod:47, 762f10c51f83)
• Release and branch state: The latest shipped tag v0.12.0 is an ancestor of current main and still contains Crawlkit v0.14.4; the proposed v0.14.5 commit has no containing release tag because this PR is unmerged. (go.mod:47, 762f10c51f83)

Likely related people:

• Peter Steinberger: Current go.mod blame attributes the existing Crawlkit v0.14.4 requirement to the v0.12.0 release commit. (role: recent dependency-file author; confidence: high; commits: 762f10c51f83; files: go.mod, go.sum, CHANGELOG.md)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the pending lint, test, and release-check workflows to finish successfully.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.