chore(deps): bump github.com/openclaw/crawlkit from 0.13.1 to 0.13.3

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.13.1 to 0.13.3.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

Crawlkit v0.13.3

Changes

• Update the TOML parser to v2.4.3 for recursion, panic, and deeply nested input hardening.
• Keep paired CodeQL actions on one version during dependency updates and update TruffleHog to v3.95.8.

Verification

• Linux: module tidy, vet, dead-code scan, vulnerability scan, tests, and race tests
• Windows: full test suite
• CodeQL and secret scanning
• Downstream compatibility: gitcrawl, discrawl, notcrawl, wacrawl, telecrawl, and slacrawl test suites against the release candidate

Crawlkit v0.13.2

Changes

• Add explicit monotonic snapshot merge planning and import-impact reporting so cache consumers can apply changed shards without silently replacing local rows, while exact mirrors retain replacement semantics.

Verification

• Linux: module tidy, vet, vulnerability scan, tests, race tests
• Windows: full test suite
• CodeQL and secret scanning

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.13.3 - 2026-07-06

• Update the TOML parser to v2.4.3 for recursion, panic, and deeply nested input hardening.
• Keep paired CodeQL actions on one version during dependency updates and update TruffleHog to v3.95.8.

v0.13.2 - 2026-07-02

• Add explicit monotonic snapshot merge planning and import-impact reporting so cache consumers can apply changed shards without silently replacing local rows, while exact mirrors retain replacement semantics.

Commits

• affaed1 chore(release): prepare v0.13.3
• 8f5e50b build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 (#47)
• 06bb3ae fix(ci): keep CodeQL action updates in lockstep (#46)
• 3c1dc6d build(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8 (#44)
• 009c5f5 chore: reopen changelog after v0.13.2
• a8c08fa chore(release): prepare v0.13.2
• f4cb025 feat(snapshot): add safe merge import plans (#42)
• d9bb157 build(deps): bump github.com/pelletier/go-toml/v2 to 2.4.2
• baf4d6c build(deps): bump modernc.org/sqlite to 1.53.0
• de6c38a build(deps): bump actions/setup-go to 6.5.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​openclaw/​crawlkit@​v0.13.1 ⏵ v0.13.3	+1

View full report

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 7, 2026, 10:57 PM ET / 02:57 UTC.

Summary
The PR updates github.com/openclaw/crawlkit from v0.13.1 to v0.13.3 and refreshes the related go-toml module sums.

Reproducibility: not applicable. this is a dependency maintenance PR rather than a reported runtime bug.

Review metrics: 2 noteworthy metrics.

• Module files changed: 2 files changed, 6 additions, 6 deletions. The dependency update is confined to Go module metadata, keeping the review surface narrow.
• Observed checks: 13 passing, 1 skipped release-draft job. The relevant CI, CodeQL, secret scanning, and Socket checks were green during review.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• No ClawSweeper repair lane is needed; this is a normal dependency PR with no actionable patch defect.

Security
Cleared: The diff only updates existing Go module requirements and sums; upstream release notes, Socket output, and repository checks did not show a concrete supply-chain concern.

Review details

Best possible solution:

Merge the module-only patch release update after normal required-check and maintainer merge handling.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR rather than a reported runtime bug.

Is this the best way to solve the issue?

Yes: updating go.mod and go.sum is the narrow maintainable way to take the crawlkit patch release.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 7754b9d416df.

Label changes

Label changes:

• add P3: This is routine dependency maintenance with a narrow two-file diff and no identified product regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot is a bot dependency PR, so the external contributor real-behavior proof gate does not apply.

Label justifications:

• P3: This is routine dependency maintenance with a narrow two-file diff and no identified product regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot is a bot dependency PR, so the external contributor real-behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Current main dependency: Current main still requires github.com/openclaw/crawlkit v0.13.1, so the requested dependency update is not already implemented. (go.mod:39, 7754b9d416df)
• PR diff scope: The PR changes only go.mod and go.sum, updating crawlkit to v0.13.3 and pelletier/go-toml/v2 to v2.4.3 with matching sums. (go.mod:28, af9fa7b901a6)
• Upstream release context: Crawlkit v0.13.3 is a published non-prerelease patch release; its notes call out TOML parser hardening and downstream notcrawl compatibility testing against the release candidate.
• Observed PR checks: CodeQL, CI deps/lint/test/windows-test/release-check, secret scanning, and Socket Security checks were passing; only the release-draft update was skipped. (af9fa7b901a6)
• Feature history: The crawlkit import surface and share code trace to the release/import commit, while the current go.mod crawlkit line was last updated by Dependabot in a prior dependency bump. (go.mod:39, 5637c35da08a)

Likely related people:

• steipete: The current crawlkit imports and share integration trace to the release/import commit that introduced this dependency surface. (role: introduced behavior; confidence: high; commits: 5637c35da08a; files: go.mod, cmd/notcrawl/main.go, internal/share/share.go)
• vincentkoc: Recently changed the main CLI/export surface and is assigned on this dependency PR, making them a plausible reviewer for compatibility. (role: recent area contributor; confidence: medium; commits: ad9246b8c9dc; files: cmd/notcrawl/main.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.