build(deps): bump github.com/openclaw/crawlkit from 0.16.6 to 0.16.7

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.16.6 to 0.16.7.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

0.16.7 - 2026-10-01

• Preserve newly copied sidecar files after case-only directory renames on case-folding filesystems while pruning stale siblings; keep source spelling in manifests. Thanks @​SebTardif.

Commits

• 33d2d16 chore: prepare crawlkit 0.16.7 (#148)
• 7909366 fix(snapshot): keep sidecar files after a case-only rename (#147)
• a03fdea chore: open next unreleased section (#146)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 6, 2026, 7:28 PM ET / 23:28 UTC (Revision 3).

ClawSweeper review

What this changes

Updates Slacrawl’s shared archive library, CrawlKit, to 0.16.7 and replaces its module checksums.

Merge readiness

✅ Ready for maintainer review

The update is still needed: current main and v0.10.2 pin CrawlKit 0.16.6. The narrow dependency change introduces no identified correctness or security defect.

Priority: P3
Reviewed head: effc1a881c37470d3dfdc487a5fcb1ea6ae076f5

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with a reviewed upstream delta, passing reported checks, and no actionable defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot is exempt from ordinary contributor runtime proof. The upstream change affects snapshot sidecar pruning, which Slacrawl does not call; consumed packages and Slacrawl’s stored archive format are unchanged.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot is exempt from ordinary contributor runtime proof. The upstream change affects snapshot sidecar pruning, which Slacrawl does not call; consumed packages and Slacrawl’s stored archive format are unchanged.
Evidence reviewed	8 items	Exact introduced change: The pinned base-to-head diff changes only the CrawlKit requirement and its two checksum entries; no indirect dependency, toolchain, workflow, or application code changes. Main and release still need the update: Both the fetched main revision and release v0.10.2 require CrawlKit 0.16.6. The verified test merge contains only the same two dependency-file changes. Complete upstream release delta: The verified upstream compare openclaw/crawlkit@v0.16.6...v0.16.7 contains changelog changes, a sidecar pruning fix, and focused regression tests. It changes no exported API or module dependency declarations.
Findings	None	None.
Security	None	None.

How this fits together

Slacrawl uses CrawlKit for shared archive storage, configuration, terminal browsing, and Git operations. Slack-specific acquisition and archive sharing remain in Slacrawl.

flowchart LR
  A[Slack sources] --> B[Slacrawl acquisition]
  B --> C[Local archive]
  D[CrawlKit library] --> C
  C --> E[Search and terminal browsing]
  D --> E
  C --> F[Slacrawl archive sharing]
  D --> F

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep Slacrawl on the published CrawlKit patch release while preserving its existing archive contracts.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency update, and Slacrawl does not call the upstream sidecar function being repaired.

Is this the best way to solve the issue?

Yes: updating the existing module requirement is the narrowest way to consume the published patch without duplicating upstream implementation.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 04cfc53efaa3.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a routine patch dependency update with no identified Slacrawl regression or urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot is exempt from ordinary contributor runtime proof. The upstream change affects snapshot sidecar pruning, which Slacrawl does not call; consumed packages and Slacrawl’s stored archive format are unchanged.

Evidence

What I checked:

• Exact introduced change: The pinned base-to-head diff changes only the CrawlKit requirement and its two checksum entries; no indirect dependency, toolchain, workflow, or application code changes. (go.mod:12, effc1a881c37)
• Main and release still need the update: Both the fetched main revision and release v0.10.2 require CrawlKit 0.16.6. The verified test merge contains only the same two dependency-file changes. (go.mod:12, 04cfc53efaa3)
• Complete upstream release delta: The verified upstream compare openclaw/crawlkit@v0.16.6...v0.16.7 contains changelog changes, a sidecar pruning fix, and focused regression tests. It changes no exported API or module dependency declarations. (snapshot/sidecar.go:119, 33d2d16c9b97)
• Dependency contract and application boundary: The direct module requirement and production imports establish CrawlKit as an actual dependency. Slacrawl imports its mirror package for Git operations but has no crawlkit/snapshot import or SyncSidecarTree call; its archive manifest and export implementation remain application-owned. (internal/share/share.go:15, effc1a881c37)
• Applicable dependency guidance: Read the complete dependency AGENTS.md at v0.16.7. Its stable-package and downstream-compatibility guidance is satisfied by an internal helper change without exported API or TUI changes; no downstream stored-format change was identified. (AGENTS.md, 33d2d16c9b97)
• Current-main routing history: Current-main history shows repeated CrawlKit upgrades by steipete and archive-sharing changes by vincentkoc. GitHub identifies vincentkoc as the current assignee. A local blame attempt failed when an older promised object could not be fetched; GitHub commit metadata supplied the routing evidence instead. (go.mod:12, d96255cc35ac)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-04T20:15:24.657Z sha effc1a8 :: needs maintainer review before merge. :: none
• reviewed 2026-10-05T13:39:52.700Z sha effc1a8 :: needs maintainer review before merge. :: none

[steipete]

Consolidated into #261, which updates CrawlKit 0.16.7 and both Release Drafter 7.9.0 action pins together. The combined change satisfies the dependency cooldown, has passed the complete remote check gate and independent review, and is awaiting hosted CI and required approval. Closing this duplicate so the updates stay together. Thanks for the dependency update.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.