build(deps): bump golang.org/x/text from 0.40.0 to 0.41.0

[dependabot]

Bumps golang.org/x/text from 0.40.0 to 0.41.0.

Commits

• acdba66 go.mod: update golang.org/x dependencies
• 02aa981 secure/precis: fix short destination buffer handling in Nickname profile
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 15, 2026, 5:56 PM ET / 21:56 UTC.

ClawSweeper review

What this changes

Updates Discrawl’s direct golang.org/x/text dependency from v0.40.0 to v0.41.0 and refreshes its Go module checksums.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open: current main and release v0.13.2 still pin golang.org/x/text v0.40.0, while this clean two-file Dependabot patch updates the direct Unicode-normalization dependency to v0.41.0 and all reported checks pass.

Priority: P3
Reviewed head: 20ed926d7c24f50efab6f48d846664692484f153

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A normal, focused dependency update with a clean diff and successful reported validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is exempt from the external-contributor real-behavior-proof gate; its reported CI checks provide supplemental validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot maintenance PR is exempt from the external-contributor real-behavior-proof gate; its reported CI checks provide supplemental validation.
Evidence reviewed	5 items	Narrow dependency diff: The branch changes only the direct golang.org/x/text requirement and its two matching checksum entries from v0.40.0 to v0.41.0. Concrete production consumer: The syncer imports golang.org/x/text/unicode/norm and uses NFKC normalization before writing normalized message content, so this is a real direct production dependency update. Current main remains behind the requested version: Current main’s go.mod still requires v0.40.0; it is the v0.13.2 release commit, so the requested v0.41.0 bump is not already implemented.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl syncs Discord messages into a local archive, normalizing text before it is stored for search and embeddings. The updated Go module supplies the Unicode normalization used by that ingestion path.

flowchart LR
  A[Discord messages] --> B[Sync and normalization]
  C[Go text module pin] --> B
  B --> D[Archived message records]
  D --> E[Search and embeddings]

Loading

Before merge

• Complete next step (P2) - No repair lane is needed: this is a clean bot-authored dependency bump with no actionable patch defect; normal maintainer merge review is the next step.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	2 files affected; 3 additions, 3 deletions	The patch is confined to one direct production module pin and its checksum records.

Technical review

Best possible solution:

Land the isolated v0.41.0 module and checksum update through normal maintainer review, retaining the existing normalization tests as regression coverage.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a dependency-version maintenance update, not a report of broken behavior.

Is this the best way to solve the issue?

Yes: updating the existing direct module pin and its verified checksums is the narrowest maintainable way to adopt the upstream v0.41.0 release.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 54eb70cfb320.

Labels

Label justifications:

• P3: This is a routine, clean semver-minor dependency maintenance update with successful reported checks.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot maintenance PR is exempt from the external-contributor real-behavior-proof gate; its reported CI checks provide supplemental validation.

Evidence

What I checked:

• Narrow dependency diff: The branch changes only the direct golang.org/x/text requirement and its two matching checksum entries from v0.40.0 to v0.41.0. (go.mod:12, 20ed926d7c24)
• Concrete production consumer: The syncer imports golang.org/x/text/unicode/norm and uses NFKC normalization before writing normalized message content, so this is a real direct production dependency update. (internal/syncer/records.go:12, 54eb70cfb320)
• Current main remains behind the requested version: Current main’s go.mod still requires v0.40.0; it is the v0.13.2 release commit, so the requested v0.41.0 bump is not already implemented. (go.mod:12, 54eb70cfb320)
• Area provenance: Blame attributes the current module declaration and Unicode-normalization import to the current release commit by Peter Steinberger; this is the available current-main ownership signal for the dependency surface. (internal/syncer/records.go:12, 54eb70cfb320)
• Validation and security checks: The supplied PR context reports successful dependency, test, lint, Docker, release-check, secret-scan, and CodeQL checks on the reviewed head. (20ed926d7c24)

Likely related people:

• Peter Steinberger: Current-main blame assigns both the module declaration and the Unicode normalization import to the v0.13.2 release commit. (role: recent dependency and release contributor; confidence: medium; commits: 54eb70cfb320; files: go.mod, internal/syncer/records.go)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-15T12:55:03.223Z sha 20ed926 :: needs maintainer review before merge. :: none