build(deps): refresh project dependencies

[steipete]

Summary

• refresh Worker runtime/tooling dependencies to current stable releases
• update the Go cryptography module and its required system dependency
• preserve the repository's pinned pnpm 10.23 lockfile format

Verification

• pnpm run check
• pnpm test (753 passed)
• pnpm run build
• pnpm exec wrangler deploy --dry-run
• pnpm audit --audit-level=high (no known vulnerabilities)
• go test ./...
• go vet ./...
• go build ./...
• govulncheck ./... (no reachable vulnerabilities)
• structured autoreview of each exact commit: clean
• Public Model Identifier Gate: PASS; no model-bearing code or artifacts

Exact-head runtime proof

• Wrangler 4.110.0 local Worker runtime on bcf155726fe67c14d3d9aaf855210145ecf61a30
  • GET /healthz -> HTTP/1.1 200 OK, body ok
  • GET /docs/spec.md -> HTTP/1.1 200 OK, 20,976-byte response
• built Go CLI from the same head
  • crabfleet --version -> dev
  • crabfleet --json --no-input doctor -> production API ok; auth failed closed because no credential was supplied
• local Worker stopped cleanly after proof; no deployment performed

No release, version bump, tag, registry publication, or deployment.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 12, 2026, 5:29 AM ET / 09:29 UTC.

Summary
Updates seven Worker JavaScript dependencies and two Go modules, then regenerates the pnpm lockfile and Go checksum metadata.

Reproducibility: not applicable. This PR performs dependency maintenance rather than reporting broken existing behavior that needs reproduction.

Review metrics: 3 noteworthy metrics.

• Dependency files: 4 files changed. The branch is limited to two manifests and their generated lock/checksum metadata.
• Direct updates: 9 versions updated. Seven JavaScript packages and two Go modules change without adding a new direct dependency.
• Automated checks: 2 of 2 successful. Both Worker and Go CLI workflows pass on the exact PR head.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• [P2] No repair task remains; the PR is ready for ordinary maintainer review and merge gating.

Security
Cleared: The focused dependency diff preserves pnpm build policy and adds no direct package source, lifecycle hook, workflow permission, secret-access path, or unexpected code-execution surface.

Review details

Best possible solution:

Keep the coordinated manifest and generated-metadata refresh intact and merge it through normal maintainer review using the successful exact-head checks and runtime proof.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR performs dependency maintenance rather than reporting broken existing behavior that needs reproduction.

Is this the best way to solve the issue?

Yes; updating the manifests together with generated lock and checksum metadata is the narrow maintainable approach, and exact-head runtime proof covers representative Worker and CLI paths.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b853216dcdf0.

Label changes

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The updated PR body records exact-head local Worker responses and a built CLI doctor call against the production API, directly exercising representative behavior after the dependency refresh.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The updated PR body records exact-head local Worker responses and a built CLI doctor call against the production API, directly exercising representative behavior after the dependency refresh.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This is low-risk routine dependency maintenance with no reported user-facing regression or urgent operational impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The updated PR body records exact-head local Worker responses and a built CLI doctor call against the production API, directly exercising representative behavior after the dependency refresh.
• proof: sufficient: Contributor real behavior proof is sufficient. The updated PR body records exact-head local Worker responses and a built CLI doctor call against the production API, directly exercising representative behavior after the dependency refresh.

Evidence reviewed

What I checked:

• Focused dependency-only diff: The branch changes only package.json, pnpm-lock.yaml, go.mod, and go.sum, with no new direct dependency or unrelated source change. (package.json:30, bcf155726fe6)
• Exact-head checks pass: GitHub reports successful Worker and Go CLI workflows on the current PR head, and the branch is cleanly mergeable against the stated main SHA. (bcf155726fe6)
• Real runtime proof supplied: After the initial proof request, the PR body was updated with exact-head Wrangler responses from /healthz and /docs/spec.md plus built CLI version and doctor output; the contributor then requested re-review. (bcf155726fe6)
• Package execution policy preserved: pnpm-workspace.yaml is unchanged between main and the PR head; workerd remains the only allowed built dependency, while esbuild and sharp remain denied. (pnpm-workspace.yaml:21, bcf155726fe6)
• Manifest history: The current dependency manifests primarily date to the v0.3.0 preparation and subsequent TypeScript 7 dependency refresh by Peter Steinberger; pnpm execution-policy metadata was introduced by Vincent Koc. (package.json:28, 30e78b4cba70)

Likely related people:

• steipete: Prior merged history shows Peter Steinberger introduced the current Go manifest and most dependency lines during v0.3.0 preparation and the recent TypeScript 7 dependency refresh. (role: manifest introducer and recent dependency contributor; confidence: high; commits: aff494247bb5, 30e78b4cba70; files: package.json, go.mod)
• vincentkoc: Vincent Koc introduced and formatted the pnpm execution policy and recently changed central Worker persistence code, making him relevant to package-policy and runtime compatibility review. (role: package policy contributor and recent Worker area contributor; confidence: high; commits: e0cf82371c89, 2d3110944f3e, 72a737f68be9; files: pnpm-workspace.yaml, package.json, src/worker/database.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-12T09:14:54.285Z sha bcf1557 :: needs real behavior proof before merge. :: none

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29187441717
• Updated: 2026-07-12T09:31:03.176Z