chore(deps): refresh indirect pprof dependency

[steipete]

Refresh the only used Go dependency that has moved since #58: github.com/google/pprof from v0.0.0-20260825171938-4d453200e7d9 to v0.0.0-20260830191439-4932ad3515ea. Go regenerated go.sum; no dependencies were added or removed.

go mod why traces pprof through SweetCookie → SQLite → SQLite tests. The upstream changes fix gzip-close error propagation and Windows tool/viewer paths. This is an internal test dependency update with no spogo runtime behavior change, so no changelog entry is needed.

All direct Go modules, used transitive modules, Actions references, golangci-lint 2.13.2, deadcode 0.49.0, and the Node.js 26 docs toolchain were checked. Actions/reusable-workflow references already resolve to current release lines. Seven older entries in upstream module metadata are unused by spogo (go mod why -m confirms each); no unused requirements were added merely to override those entries.

The holds documented in #58 remain:

• Keep the Go 1.26.7 module minimum: GitHub default-setup CodeQL was proven to reject 1.27 with its GOTOOLCHAIN=local runner. Local validation uses Go 1.27.0. Recommend waiting for the managed scanner to advance.
• Keep posener/complete v1.2.3: current kong-completion imports the v1 API; v2.1.0 needs an upstream migration.
• Keep modernc.org/libc v1.75.6: current SQLite imports v1; the separate v2.1.30 line dates from 2024 and cannot replace generated v1 bindings. Recommend following SQLite's supported dependency line.

Baseline default-branch build/test CI is green: https://github.com/openclaw/spogo/actions/runs/33365190138 . CodeQL is also green: https://github.com/openclaw/spogo/actions/runs/33365189700 . Pages deployment is green: https://github.com/openclaw/spogo/actions/runs/33365190050 . ClawSweeper Dispatch and scheduled CodeQL scans are ops/security workflows, distinct from the build/test gate. No baseline CI fix was needed, no assertions/jobs were weakened, and no release workflow was dispatched.

Codex Autoreview completed at its default P0 threshold with no accepted/actionable findings. An initial reviewer invocation failed without a verdict; retrying the same engine/model succeeded.

Validation used a task-local GOCACHE and GOMAXPROCS=4. Full build (go build ./..., make spogo), the full coverage suite, module checksum verification, and tidy checks pass. ./scripts/lint.sh reports 0 issues.; the CI deadcode command reports no unreachable functions. The changed dependency's own profile tests also pass:

$ go test -mod=readonly github.com/google/pprof/profile
ok  	github.com/google/pprof/profile	11.271s

Live proof runs the actually-built Go 1.27.0 binary as a separate process on shell-completion input and a disposable synthetic-cookie profile. This exercises CLI parsing, completion, stdin parsing, TOML persistence, cookie-file loading, and JSON output; it does not claim an authenticated Spotify API check.

$ ./spogo --version
dev
$ COMP_LINE='spogo playlist ' COMP_POINT=15 ./spogo
info
create
add
remove
tracks
$ printf '%s\n' 'sp_dc=synthetic-session' 'sp_t=synthetic-device' | ./spogo --config build/deps-refresh-20260830/config.toml --profile proof --json --no-input auth paste
{
  "cookie_count": 2,
  "path": "build/deps-refresh-20260830/cookies/proof.json"
}
$ ./spogo --config build/deps-refresh-20260830/config.toml --profile proof --json --no-input auth status
{
  "cookie_count": 2,
  "has_sp_dc": true,
  "has_sp_t": true,
  "has_sp_key": false,
  "source": "file"
}

$ ./scripts/check-coverage.sh 90
ok  	github.com/steipete/spogo/cmd/spogo	2.626s	coverage: 87.0% of statements
ok  	github.com/steipete/spogo/internal/app	1.859s	coverage: 90.9% of statements
ok  	github.com/steipete/spogo/internal/cli	4.020s	coverage: 89.5% of statements
ok  	github.com/steipete/spogo/internal/config	2.410s	coverage: 89.4% of statements
ok  	github.com/steipete/spogo/internal/cookies	1.641s	coverage: 98.2% of statements
ok  	github.com/steipete/spogo/internal/output	0.968s	coverage: 95.0% of statements
ok  	github.com/steipete/spogo/internal/spotify	12.609s	coverage: 90.4% of statements
ok  	github.com/steipete/spogo/internal/testutil	0.695s	coverage: 98.2% of statements
Total coverage: 90.6%

CI for commit c62074d12f3e137e472c3c9559b9124273fcd432 is green:

• PR build/test CI: https://github.com/openclaw/spogo/actions/runs/33371463938 (1m20s).
• Push build/test CI: https://github.com/openclaw/spogo/actions/runs/33371439518 (1m25s).
• CodeQL: https://github.com/openclaw/spogo/actions/runs/33371462137 (Go, JavaScript/TypeScript, and Actions all passed).

No CI retries or repairs were needed. The PR remains open for orchestrator review and landing.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 31, 2026, 4:10 AM ET / 08:10 UTC.

ClawSweeper review

What this changes

The PR refreshes the indirect github.com/google/pprof dependency and its Go checksums.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep this collaborator-authored PR open for normal merge handling. Its verified introduced change is limited to one indirect Go module version and matching checksums, with no actionable patch defect found.

Priority: P3
Reviewed head: c62074d12f3e137e472c3c9559b9124273fcd432

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, internally consistent dependency refresh with no concrete correctness or security concern found.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored, manifest-and-checksum-only change has no introduced user-visible runtime behavior requiring the external-contributor proof gate; the submitted built-CLI trace is supplemental validation context.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This collaborator-authored, manifest-and-checksum-only change has no introduced user-visible runtime behavior requiring the external-contributor proof gate; the submitted built-CLI trace is supplemental validation context.
Evidence reviewed	4 items	Verified PR scope: The pinned merge-base-to-head delta changes only the indirect pprof version in the module manifest and its corresponding checksum records. Checksum alignment: The new pprof module and go.mod checksums match the version declared in go.mod. Dependency-area history: Recent go.mod history includes the merged broad dependency refresh commit, providing routing context for the same contributor rather than attributing a regression.
Findings	None	None.
Security	None	None.

How this fits together

spogo’s Go module manifest fixes the dependency versions used when builds and tests resolve the project graph. This change updates one indirect module input without changing the CLI’s commands, configuration, or runtime code.

flowchart LR
  A[Go module manifest] --> B[Go module resolver]
  B --> C[Indirect pprof module]
  C --> D[Build and test dependency graph]
  D --> E[spogo CLI artifacts and CI]

Loading

Before merge

• Complete next step (P2) - No discrete repair is needed; this is a normal collaborator PR awaiting routine merge gating.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency delta	1 indirect module updated; 2 checksum records refreshed; 2 files, +3/-3	The narrowly bounded manifest-only scope makes the dependency review surface easy to audit.

Technical review

Best possible solution:

Merge the exact two-file module refresh after the required checks complete, while keeping broader dependency migrations as separately reviewed changes.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR does not report or repair a user-visible bug; it changes an indirect dependency pin and checksums.

Is this the best way to solve the issue?

Yes. Updating only the affected indirect requirement and its checksums is the narrowest maintainable dependency-refresh path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against aef9a7fda7f4.

Labels

Label changes:

• add P3: This is a small maintenance refresh with no demonstrated user-facing behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored, manifest-and-checksum-only change has no introduced user-visible runtime behavior requiring the external-contributor proof gate; the submitted built-CLI trace is supplemental validation context.

Label justifications:

• P3: This is a small maintenance refresh with no demonstrated user-facing behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This collaborator-authored, manifest-and-checksum-only change has no introduced user-visible runtime behavior requiring the external-contributor proof gate; the submitted built-CLI trace is supplemental validation context.

Evidence

What I checked:

• Verified PR scope: The pinned merge-base-to-head delta changes only the indirect pprof version in the module manifest and its corresponding checksum records. (go.mod:22, c62074d12f3e)
• Checksum alignment: The new pprof module and go.mod checksums match the version declared in go.mod. (go.sum:26, c62074d12f3e)
• Dependency-area history: Recent go.mod history includes the merged broad dependency refresh commit, providing routing context for the same contributor rather than attributing a regression. (go.mod:22, 1b1906ee7544)
• Submitted validation context: The complete PR body reports module verification, build/test checks, and a built-CLI smoke trace; this is supplemental context for a manifest-only collaborator PR. (c62074d12f3e)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): refresh indirect pprof dependency This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.