chore(deps): refresh Go dependencies and CI toolchains

[steipete]

The dependency set and CI tools have moved on since the previous refresh. This updates the compatible dependencies and toolchains without changing application code or publishing a release.

Updates

• Go 1.25.12 → 1.26.7, with the source-install requirement documented.
• Runtime dependencies: Kong 1.16.0 → 1.16.1, SweetCookie 0.0.1 → 0.0.2, go-isatty 0.0.23 → 0.0.24, and current compatible transitive dependencies. Notable transitive updates include SQLite 1.53.0 → 1.57.0, libc 1.74.1 → 1.75.6, x/crypto 0.54.0 → 0.55.0, Cobra 1.6.1 → 1.10.2, and Zap 1.24.0 → 1.28.0. SweetCookie now uses the current INI module path; go mod tidy removes the obsolete path.
• Development tools: gofumpt 0.10.0 → 0.11.0, deadcode/x/tools 0.47.0 → 0.49.0, golangci-lint 2.12.2 → 2.13.2, and test dependency refreshes.
• Actions: setup-go v6 → v7; Pages checkout pin 7.0.0 → 7.0.1 and setup-node pin 6.4.0 → 7.0.0. Other Actions/reusable-workflow references already track current releases.
• Docs build: Node.js 24 → 26, verified locally with 26.8.1. Includes Unreleased changelog entries.

Held major migrations

• Go 1.27.0: local gates and both normal CI runs passed, but GitHub default-setup CodeQL runs Go 1.26.7 with GOTOOLCHAIN=local and refuses a module requiring 1.27. Use 1.26.7 until that runner advances; preserve the existing security scanning configuration.
• posener/complete v1.2.3 → v2.1.0: the current kong-completion release imports the v1 API; this requires an upstream migration or fork, not a compatible dependency bump.
• modernc.org/libc v1 → v2.1.30: v2 is a separate module line last released in 2024, while current SQLite still imports v1. Keep the current v1.75.6 rather than rewrite upstream generated bindings.

All dependencies needed by the build, tests, and formatting tools are current within their compatible module paths. Seven older entries remain only in upstream module metadata; go mod why confirms that spogo does not need those modules, so no unused requirements are retained just to override them.

Validation

• go mod download, go mod verify, and go mod tidy -diff pass; no tidy diff.
• Coverage gate: all 8 packages pass, 90.4% aggregate coverage (minimum 90%).
• Fresh race run: 495 top-level tests and 45 subtests pass; zero failures or skips.
• golangci-lint 2.13.2: 0 issues. go vet, deadcode, and formatting pass without source changes.
• go build ./... and make spogo pass. Built CLI smoke checks: --version, --help, and completion bash.
• Cross-builds pass for Linux amd64/arm64 and Windows amd64/arm64 (CGO_ENABLED=0).
• Node.js 26.8.1 docs build generates all 15 HTML pages with link validation; both JavaScript syntax checks and actionlint pass.
• Codex autoreview passed at the default P0 threshold with no actionable findings.

Baseline main CI, CodeQL, Pages, and ClawSweeper Dispatch are green. No baseline CI repair was necessary. The initial PR CodeQL failure is addressed in a separate fix(ci) commit by holding Go 1.27.0. No open Dependabot or Renovate PRs are superseded. Release workflows were not dispatched.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 28, 2026, 3:51 AM ET / 07:51 UTC.

ClawSweeper review

What this changes

The PR refreshes Go dependencies and CI tool versions, raises the documented source-install requirement to Go 1.26.7, and moves the Pages build to Node 26.

Merge readiness

⚠️ Ready for maintainer review - 6 items remain

This collaborator-authored PR needs explicit maintainer approval of the intentional Go 1.26.7 source-build floor and a review of the direct browser-cookie dependency update; the exact-head CI and CodeQL checks are green.

Priority: P3
Reviewed head: 139f299e84cb8b26722e5024a18669d5ec4b8965
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is coherent and checks are green, but compatibility approval, sensitive-dependency review, and Pages-path confirmation remain material merge questions.
Proof confidence	🌊 off-meta tidepool	Not applicable: Not applicable: this collaborator-authored maintenance PR is exempt from the external-contributor real-behavior-proof gate; its supplied validation claims remain supplemental review context.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Not applicable: this collaborator-authored maintenance PR is exempt from the external-contributor real-behavior-proof gate; its supplied validation claims remain supplemental review context.
Evidence reviewed	6 items	Exact PR introduction: The verified base-to-head delta contains two commits: the dependency/toolchain refresh and the follow-up CodeQL compatibility fix; the change is not already on the pinned main base. Coordinated compiler floor: The module requires Go 1.26.7, CI reads that requirement through setup-go, and the source-install documentation states the same minimum. Sensitive direct dependency: SweetCookie is upgraded to v0.0.2; current application code imports it to read browser cookies, making this a security-sensitive dependency review rather than a purely transitive update.
Findings	None	None.
Security	Needs attention	Review the browser-cookie dependency upgrade: SweetCookie is updated to v0.0.2 while internal/cookies imports it for browser-cookie access; confirm the new release does not broaden credential collection or transmission behavior before merge.

How this fits together

Spogo’s Go module manifest defines the compiler floor and dependency graph for the CLI. Its CI workflows consume that manifest for build, analysis, release fallback, and documentation deployment.

flowchart LR
  Dev[Source developer] --> Mod[Go module manifest]
  Mod --> Build[CLI build and tests]
  Mod --> CI[CI and CodeQL]
  Docs[Documentation workflow] --> Pages[Published docs]
  CI --> Release[Release artifacts]

Loading

Decision needed

Question	Recommendation
Do maintainers approve ending Go 1.25.x source-build support while accepting the reviewed SweetCookie v0.0.2 and Node 26 workflow upgrades?	Approve after targeted verification: Review the SweetCookie v0.0.2 source/provenance and confirm the Pages workflow under Node 26, then accept Go 1.26.7 as the supported source-build floor.

Why: This is an intentional upgrade-policy and security-boundary choice, not a mechanical correction; it affects existing source builders and a dependency that reads browser authentication cookies.

Before merge

• Resolve security concern: Review the browser-cookie dependency upgrade - SweetCookie is updated to v0.0.2 while internal/cookies imports it for browser-cookie access; confirm the new release does not broaden credential collection or transmission behavior before merge.
• Resolve merge risk (P1) - Existing source-install users on Go 1.25.x will fail after merge unless they upgrade to Go 1.26.7.
• Resolve merge risk (P1) - The direct SweetCookie update changes code trusted to access browser authentication cookies; repository source does not establish what changed in v0.0.2.
• Resolve merge risk (P1) - The Pages workflow runs only after a push to main or manual dispatch, so the setup-node v7 and Node 26 deployment path is not covered by the listed pull-request checks.
• Complete next step (P2) - Maintainers should explicitly accept the new source-install floor and complete targeted review of the browser-cookie dependency and Pages deployment change before merge.

Findings

• [medium] Review the browser-cookie dependency upgrade — go.mod:13

Agent review details

Security

Needs attention: The direct SweetCookie upgrade warrants targeted provenance and behavior review because Spogo uses it to read browser authentication cookies.

Review metrics

Metric	Value	Why it matters
Changed surface	7 files: 3 workflows, module metadata, changelog, and install docs	The update coordinates build tooling, deployment tooling, dependency resolution, and the user-facing compiler requirement.
Source-build floor	Go 1.25.12 → 1.26.7	This is the material compatibility change for developers installing from source.

Merge-risk options

Maintainer options:

1. Verify compatibility-sensitive upgrades before merge (recommended)
   Audit SweetCookie v0.0.2 and run or inspect the Pages deployment path with Node 26 before accepting the new Go source-build floor.
2. Accept the documented upgrade boundary
   Merge with the understanding that source users must upgrade to Go 1.26.7 and that Pages validation will first occur on main.

Technical review

Best possible solution:

Land one coherent Go 1.26.7 floor only after maintainers accept the source-install compatibility change, review SweetCookie v0.0.2’s provenance and behavior, and confirm the Pages workflow under Node 26.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency and toolchain maintenance PR, not a reported runtime defect.

Is this the best way to solve the issue?

Yes for the mechanical update: the module, CI, and installation documentation use one Go floor. Maintainer approval is still needed for the compatibility and cookie-dependency trust boundaries.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 6bcee93a63c7.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The PR updates SweetCookie, which the application uses to access browser authentication cookies.
• add merge-risk: 🚨 automation: The PR changes CI setup-go plus the Pages deployment runtime and setup-node action.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Not applicable: this collaborator-authored maintenance PR is exempt from the external-contributor real-behavior-proof gate; its supplied validation claims remain supplemental review context.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

• P3: This is a bounded maintenance refresh with an intentional, documented developer-toolchain impact.
• merge-risk: 🚨 compatibility: The raised Go floor prevents source installation with previously supported Go 1.25.x toolchains.
• merge-risk: 🚨 security-boundary: The PR updates SweetCookie, which the application uses to access browser authentication cookies.
• merge-risk: 🚨 automation: The PR changes CI setup-go plus the Pages deployment runtime and setup-node action.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Not applicable: this collaborator-authored maintenance PR is exempt from the external-contributor real-behavior-proof gate; its supplied validation claims remain supplemental review context.

Evidence

Security concerns:

• [medium] Review the browser-cookie dependency upgrade — go.mod:13
  SweetCookie is updated to v0.0.2 while internal/cookies imports it for browser-cookie access; confirm the new release does not broaden credential collection or transmission behavior before merge.
  Confidence: 0.9

What I checked:

• Exact PR introduction: The verified base-to-head delta contains two commits: the dependency/toolchain refresh and the follow-up CodeQL compatibility fix; the change is not already on the pinned main base. (go.mod:3, 139f299e84cb)
• Coordinated compiler floor: The module requires Go 1.26.7, CI reads that requirement through setup-go, and the source-install documentation states the same minimum. (go.mod:3, 139f299e84cb)
• Sensitive direct dependency: SweetCookie is upgraded to v0.0.2; current application code imports it to read browser cookies, making this a security-sensitive dependency review rather than a purely transitive update. (internal/cookies/source.go:13, 139f299e84cb)
• Pages execution path: The Pages workflow changes its pinned setup-node action and Node runtime to 26, but it is configured to run only on pushes to main or manual dispatch. (.github/workflows/pages.yml:36, 139f299e84cb)
• Exact-head checks: The supplied PR state reports successful build, CodeQL, and Socket Security runs after the follow-up CI compatibility commit. (139f299e84cb)
• Area history: Dependency and toolchain maintenance in this area has repeatedly been authored by Peter Steinberger, including the prior Go toolchain requirement and dependency refreshes. (go.mod:3, 77809d9d885c)

Likely related people:

• steipete: Current and prior dependency, Go-version, CI, and release-workflow history is attributed to Peter Steinberger, corresponding to the supplied steipete account. (role: toolchain and dependency area contributor; confidence: high; commits: 139f299e84cb, 2fc31c39f388, 77809d9d885c; files: go.mod, .github/workflows/ci.yml, .github/workflows/pages.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Review SweetCookie v0.0.2’s source or release provenance for browser-cookie handling.
• Confirm the Pages deployment path with setup-node v7 and Node 26.
• Record explicit maintainer acceptance of the Go 1.26.7 source-build floor.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-28T07:38:02.177Z sha 2fc31c3 :: needs maintainer review before merge. :: none

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​alecthomas/​kong@​v1.16.0 ⏵ v1.16.1	+1
	github.com/​steipete/​sweetcookie@​v0.0.1 ⏵ v0.0.2
	mvdan.cc/​gofumpt@​v0.10.0 ⏵ v0.11.0	+1
	github.com/​mattn/​go-isatty@​v0.0.23 ⏵ v0.0.24

View full report