chore(deps): bump github.com/openclaw/crawlkit from 0.16.1 to 0.16.3

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.16.1 to 0.16.3.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.16.3

0.16.3 - 2026-09-13

• Honor configured embedding request timeouts with caller-supplied HTTP clients without mutating those clients; retain shorter client and context deadlines.
• Preserve literal systemd command arguments and executable names; reject executable-path characters that systemd cannot load.
• Preserve file and SQLite capture contents when MaxFileBytes is the maximum signed 64-bit value; keep overflow-free bounded reads for growing sources.
• Read and repair long scheduler history records without blocking later runs or status checks.
• Publish changes to zero-row backup counter keys while reusing unchanged encrypted shards.
• Apply private permissions before overwriting existing controller configurations.
• Allow explicit controller configuration paths without a home directory while preserving default and tilde-path validation.
• Refresh indirect test and generator dependencies: pprof, x/exp, x/tools v0.50.0, and modernc/cc v4.29.7 while preserving SQLite's required libc version.
• Run the same validation gates locally and in Linux CI, including formatting, and cancel superseded automatic CI runs.

v0.16.2

0.16.2 - 2026-09-11

Highlights: Updated runtime dependencies and refreshed analysis tooling.

• Refresh operating-system support to x/sys v0.48.0, cryptography to x/crypto v0.57.0, Unicode text handling to x/text v0.42.0, and terminal character widths to go-runewidth v0.0.30 while retaining the Go 1.27.0 minimum. Thanks @​dependabot.
• Update deadcode to v0.50.0, govulncheck to v1.8.0, and the pinned CodeQL action to v4.38.0.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

0.16.3 - 2026-09-13

• Honor configured embedding request timeouts with caller-supplied HTTP clients without mutating those clients; retain shorter client and context deadlines.
• Preserve literal systemd command arguments and executable names; reject executable-path characters that systemd cannot load.
• Preserve file and SQLite capture contents when MaxFileBytes is the maximum signed 64-bit value; keep overflow-free bounded reads for growing sources.
• Read and repair long scheduler history records without blocking later runs or status checks.
• Publish changes to zero-row backup counter keys while reusing unchanged encrypted shards.
• Apply private permissions before overwriting existing controller configurations.
• Allow explicit controller configuration paths without a home directory while preserving default and tilde-path validation.
• Refresh indirect test and generator dependencies: pprof, x/exp, x/tools v0.50.0, and modernc/cc v4.29.7 while preserving SQLite's required libc version.
• Run the same validation gates locally and in Linux CI, including formatting, and cancel superseded automatic CI runs.

0.16.2 - 2026-09-11

Highlights: Updated runtime dependencies and refreshed analysis tooling.

• Refresh operating-system support to x/sys v0.48.0, cryptography to x/crypto v0.57.0, Unicode text handling to x/text v0.42.0, and terminal character widths to go-runewidth v0.0.30 while retaining the Go 1.27.0 minimum. Thanks @​dependabot.
• Update deadcode to v0.50.0, govulncheck to v1.8.0, and the pinned CodeQL action to v4.38.0.

Commits

• b33f7c3 chore: release 0.16.3 (#132)
• e5e282d chore(deps): refresh indirect Go test dependencies (#131)
• 0285771 fix(scheduler): encode literal systemd command arguments (#130)
• e13ceb1 fix(scheduler): preserve explicit configs and long run history (#129)
• 41f870e fix(embed): enforce timeouts with caller-owned clients (#128)
• e49b435 fix(backup): preserve zero-valued counter identity (#127)
• 48d0eb8 fix(cache): preserve captures at maximum byte limits (#126)
• b5e6c59 ci: share local validation and cancel superseded runs (#125)
• 9fde2dd refactor: remove redundant helpers and obsolete TUI rendering (#124)
• 2da3f67 refactor: separate archive transport and persistence modules (#123)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 20, 2026, 1:46 AM ET / 05:46 UTC.

ClawSweeper review

What this changes

Updates Gitcrawl’s shared archive library to Crawlkit v0.16.3 and adjusts indirect dependency declarations and checksums.

Merge readiness

✅ Ready for maintainer review

The update remains necessary: current main and v0.10.0 still pin Crawlkit v0.16.1. No actionable correctness or security defect was found in the dependency update.

Priority: P3
Reviewed head: 3ae19231d80c571fba780b7da9f98b678905178c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with compatible inspected call sites and passing supplied validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; supplied CI is supplemental validation, not a claimed live embedding or archive demonstration.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; supplied CI is supplemental validation, not a claimed live embedding or archive demonstration.
Evidence reviewed	7 items	Update is absent from current main: Current main still requires Crawlkit v0.16.1; the introduced patch changes that requirement to v0.16.3. Latest release retains the older dependency: The v0.10.0 module manifest also pins Crawlkit v0.16.1. No merged replacement for this update was identified in the recent pull-request listing. Concrete dependency boundary: Gitcrawl directly constructs Crawlkit embedding providers with its HTTP client and API key. Its production default client has a 60-second timeout, establishing the relevant downstream compatibility contract.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl mirrors GitHub discussions into local SQLite archives for search and clustering. Crawlkit supplies shared configuration, storage, remote archive, and embedding helpers used by those workflows.

flowchart LR
  A[GitHub discussions] --> B[Gitcrawl sync]
  B --> C[Shared archive helpers]
  C --> D[Local SQLite archive]
  D --> E[Search and clustering]
  F[Embedding requests] --> G[Shared embedding client]
  G --> E

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Adopt the published patch release while preserving Gitcrawl’s existing timeout, configuration, and SQLite runtime contracts.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency rather than reporting a reproducible Gitcrawl failure.

Is this the best way to solve the issue?

Yes. Updating the existing module requirement is the narrow supported integration path, and the inspected upstream changes preserve Gitcrawl’s production timeout and SQLite pairing.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 6fc2a70c9812.

Labels

Label changes:

• add P3: This is routine dependency maintenance with passing supplied checks and no demonstrated urgent Gitcrawl regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; supplied CI is supplemental validation, not a claimed live embedding or archive demonstration.

Label justifications:

• P3: This is routine dependency maintenance with passing supplied checks and no demonstrated urgent Gitcrawl regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; supplied CI is supplemental validation, not a claimed live embedding or archive demonstration.

Evidence

What I checked:

• Update is absent from current main: Current main still requires Crawlkit v0.16.1; the introduced patch changes that requirement to v0.16.3. (go.mod:13, 6fc2a70c9812)
• Latest release retains the older dependency: The v0.10.0 module manifest also pins Crawlkit v0.16.1. No merged replacement for this update was identified in the recent pull-request listing. (go.mod:13, 9898b678a4d8)
• Concrete dependency boundary: Gitcrawl directly constructs Crawlkit embedding providers with its HTTP client and API key. Its production default client has a 60-second timeout, establishing the relevant downstream compatibility contract. (internal/openai/client.go:136, 3ae19231d80c)
• Embedding timeout compatibility: The published dependency copies caller-supplied HTTP clients and preserves shorter timeouts. Its two-minute default therefore retains Gitcrawl’s existing 60-second production timeout; API-key override and transport handling remain supported. (embed/provider.go:229, b33f7c3a313d)
• Published module and runtime pairing: Crawlkit v0.16.3 was published on 2026-09-14. Its module retains SQLite v1.58.0 and libc v1.75.6, matching Gitcrawl; the removed explicit test/compiler dependencies remain declared upstream. (go.mod, b33f7c3a313d)
• Validation and review scope: The complete introduced delta changes only go.mod and go.sum. Supplied checks passed Linux/macOS Go validation, Windows portable-filesystem validation, Docker, and secret scans. Local diff checking passed; tests and builds were not executed during this read-only review. (go.mod:13, 3ae19231d80c)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.