chore(deps): refresh Go toolchain and archive dependencies

[steipete]

Refresh the archive and build dependencies to Go 1.27.1, Dockerfile frontend 1.27, CrawlKit 0.14.9, go-runewidth 0.0.29, SQLite driver 1.58.0 (SQLite 3.53.4), and TruffleHog 3.97.4. The Docker builder uses the matching official tag and digest. Complete the Unreleased notes, including the Cloudsmith CLI 1.26.0 update already on main.

The supported Go minimum stays at 1.27.0; a toolchain directive prefers 1.27.1. SQLite's required libc stays at 1.75.6 and its Linux OFD locking remains opt-in. Slacrawl owns its snapshot decoder, so the CrawlKit refresh is recorded as maintenance rather than claiming the upstream decoder fixes as new Slacrawl behavior.

Validation on final head 711934d63b4aa49cc0f0afee4452e7f5faa21a31:

• Full local GOWORK=off GOMAXPROCS=2 GOFLAGS=-p=2 make check: module verification/tidy, formatting, vet, vulnerability and dead-code checks, full tests, stock CLI smoke, and four-target GoReleaser snapshot.
• Built the normal CLI and imported/re-imported a synthetic Slack export: exactly two rows, Unicode FTS and message output preserved, SQLite 3.53.4 asserted, status and TUI JSON checked.
• Drove the interactive TUI through a 100x30 PTY: synthetic messages rendered and q exited successfully.
• Published a local git snapshot and updated a separate subscriber archive; subscriber FTS returned the Unicode message.
• Independent Codex branch review against origin/main: scoped-clean at P0–P2.
• CI: https://github.com/openclaw/slacrawl/actions/runs/33986883755

The earlier candidate also passed Go 1.27.0 store/CLI tests and real CLI import/search/re-import proof, plus AWS/Linux full checks and a Docker build/container smoke. CI validates the Docker build again on the final head. No real Slack data or credentials were used in this session's proof.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 5, 2026, 3:32 PM ET / 19:32 UTC.

ClawSweeper review

What this changes

Updates Slacrawl’s preferred Go toolchain, container build, archive dependencies, and secret scanner, with matching contributor documentation and release notes.

Merge readiness

✅ Ready for maintainer review

Keep open: this is a focused maintenance update that current main does not contain. No actionable patch defect was found, and the earlier Go minimum-version concern does not apply to the current head.

Likely related people: steipete and Vincent Koc are routing candidates based on prior dependency and workflow work; exact source-line attribution remains unverified.

Priority: P3
Reviewed head: 711934d63b4aa49cc0f0afee4452e7f5faa21a31

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with relevant maintainer-reported validation and no supported blocking findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its captured verification nevertheless reports real CLI import/search/re-import, PTY rendering, and Git snapshot round-trip success on the reviewed head, covering the storage, terminal and sharing consumers.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its captured verification nevertheless reports real CLI import/search/re-import, PTY rendering, and Git snapshot round-trip success on the reviewed head, covering the storage, terminal and sharing consumers.
Evidence reviewed	10 items	Complete introduced change inspected: The local comparison matches the host’s complete introduced patch: seven files, 23 additions and 14 deletions, with no application-source changes. Repository origin identifies openclaw/slacrawl, and the checkout remained clean. Update remains distinct from main: Pinned main still selects CrawlKit 0.14.8, go-runewidth 0.0.28 and SQLite 1.57.0, without the preferred-toolchain directive. The supplied latest release is v0.8.6; its go.mod blob could not be retrieved, so no shipped-version equivalence is claimed. Earlier compatibility concern checked: The current file retains go 1.27.0 and adds toolchain go1.27.1; CONTRIBUTING.md explicitly explains automatic selection and the unchanged minimum. The previous completed review lists no remaining findings. Historical blob retrieval prevented independently comparing the earlier head.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl imports Slack data into a local SQLite archive and exposes it through search, terminal views, and Git-backed sharing. These dependency and build updates affect the executable supporting those existing workflows.

flowchart LR
  A[Go toolchain and dependencies] --> B[Slacrawl executable]
  C[Slack export] --> B
  B --> D[Local SQLite archive]
  D --> E[Search and terminal views]
  D --> F[Git archive sharing]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the focused dependency refresh while preserving the documented Go minimum and existing archive formats.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this maintenance PR does not report a remaining application bug; supplied verification exercises the affected archive and terminal workflows.

Is this the best way to solve the issue?

Yes: updating existing dependency selections and matching documentation is a narrow approach, and the current patch preserves the supported Go minimum.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against b9ff7d91485f.

Labels

Label justifications:

• P3: This is routine dependency and build maintenance without an established urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its captured verification nevertheless reports real CLI import/search/re-import, PTY rendering, and Git snapshot round-trip success on the reviewed head, covering the storage, terminal and sharing consumers.

Evidence

What I checked:

• Complete introduced change inspected: The local comparison matches the host’s complete introduced patch: seven files, 23 additions and 14 deletions, with no application-source changes. Repository origin identifies openclaw/slacrawl, and the checkout remained clean. (go.mod:3, 711934d63b4a)
• Update remains distinct from main: Pinned main still selects CrawlKit 0.14.8, go-runewidth 0.0.28 and SQLite 1.57.0, without the preferred-toolchain directive. The supplied latest release is v0.8.6; its go.mod blob could not be retrieved, so no shipped-version equivalence is claimed. (go.mod:3, b9ff7d91485f)
• Earlier compatibility concern checked: The current file retains go 1.27.0 and adds toolchain go1.27.1; CONTRIBUTING.md explicitly explains automatic selection and the unchanged minimum. The previous completed review lists no remaining findings. Historical blob retrieval prevented independently comparing the earlier head. (CONTRIBUTING.md:18, 711934d63b4a)
• Go toolchain contract: The official Go toolchain documentation distinguishes the minimum go directive from the preferred toolchain directive and documents automatic switching and explicit toolchain overrides.
• Dependency ownership and storage boundary: Store.Open delegates connection creation to CrawlKit while Slacrawl owns schema versioning and migrations. Slacrawl also owns its JSON snapshot decoder in internal/share/share.go. Existing tests cover fresh schema creation, legacy migration and FTS repair; this patch changes none of those schemas or implementations. (internal/store/store.go:669, 711934d63b4a)
• SQLite compatibility requirements: The upstream v1.58.0 module file requires libc 1.75.6, matching this PR. Its versioned package documentation identifies cznic/sqlite as the canonical repository, lists SQLite 3.53.4, and states that Linux OFD locking is disabled by default. (go.mod:9)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (7 earlier review cycles)

• reviewed 2026-09-04T10:31:08.211Z sha 03655f2 :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T10:35:48.817Z sha 03655f2 :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T18:59:59.262Z sha 03655f2 :: blocked before merge. :: [P1] Avoid forcing Go 1.27.1 on existing builds
• reviewed 2026-09-05T01:15:09.077Z sha 03655f2 :: needs maintainer review before merge. :: none
• reviewed 2026-09-05T06:55:04.427Z sha 03655f2 :: needs maintainer review before merge. :: none
• reviewed 2026-09-05T15:59:42.650Z sha 03655f2 :: needs maintainer review before merge. :: none
• reviewed 2026-09-05T19:25:38.210Z sha 711934d :: needs maintainer review before merge. :: none

[steipete]

Maintainer verification at 711934d63b4aa49cc0f0afee4452e7f5faa21a31:

• Full local GOWORK=off GOMAXPROCS=2 GOFLAGS=-p=2 make check passed: module verification/tidy, formatting, vet, vulnerability/dead-code checks, full tests, stock CLI smoke, and all four release-snapshot targets.
• Built the normal CLI and imported/re-imported a synthetic Slack export. Exactly two rows remained; Unicode search/messages, SQLite 3.53.4, status, and TUI JSON assertions passed.
• Interactive TUI proof used a 100x30 PTY: synthetic messages rendered and q exited successfully.
• Local git snapshot publish/update round trip passed; subscriber FTS returned the Unicode message.
• Independent Codex branch autoreview against origin/main: scoped-clean at P0–P2.
• Exact-head CI passed: https://github.com/openclaw/slacrawl/actions/runs/33986883755
• Exact-head Docker build/smoke passed: https://github.com/openclaw/slacrawl/actions/runs/33986883474

The fresh dependency audit found no stale module in the built CLI except libc 1.75.6, intentionally retained as SQLite requires. Other available module upgrades are outside the built CLI. Action pins and Cloudsmith CLI are current. Prepared for squash merge; no release, tag, or publication was performed.