chore(deps): refresh Go toolchain and cookie dependencies

[steipete]

Refresh the Go 1.26 build toolchain and compatible indirect dependencies used by browser-cookie import. The module keeps Go 1.26.7 as its minimum and selects Go 1.26.8 for repository builds; installation documentation and the existing Unreleased entry now describe that distinction.

• Update modernc.org/sqlite from 1.57.0 to 1.58.0, golang.org/x/crypto from 0.55.0 to 0.56.0, and github.com/google/pprof from 4932ad3515ea to d6c3cb2f37ec.
• Retain modernc.org/libc 1.75.6, matching SQLite's explicitly required companion version.
• Update the SHA-pinned actions/deploy-pages action from 5.0.0 to 5.0.1 for its deployment-polling backoff improvements.

Validation passed with Go 1.26.8:

• ./scripts/check-coverage.sh 90 — 90.4% total coverage.
• go test -race ./... — passed.
• ./scripts/lint.sh — golangci-lint 2.13.2, zero issues.
• go run golang.org/x/tools/cmd/deadcode@v0.49.0 -test ./... — no findings.
• go mod verify and git diff --check — passed.
• Native CLI builds with Go 1.26.7 and Go 1.26.8, plus Linux/Windows amd64 cross-builds — passed.
• node scripts/build-docs-site.mjs — passed.

Built-CLI integration proof used an isolated Firefox SQLite database containing three synthetic Spotify cookies. auth import read the database through SweetCookie/SQLite, saved all three cookies with mode 0600, and auth status read the persisted file and reported all expected cookie flags. auth clear removed the cache and cleared its config entry; the source database remained unchanged and all commands produced empty stderr. Bash, zsh, and fish completion also passed. This proof used no real account credentials or Spotify requests. The Pages action was checked against upstream source and its release tag; no deployment was triggered.

The built-CLI proof was repeated with a binary built from the clean committed worktree at 3026c4440773677947afe177d080bd06af5d0d50. Isolated Codex autoreview completed successfully through P2 with no actionable findings.

The documentation follow-up scopes Go 1.26.8 selection to checkout builds with automatic toolchain selection enabled. Versioned go install ...@latest retains the Go 1.26.7 minimum without promising the downloaded module's preferred toolchain. The docs site was regenerated and its rendered install page checked; production code and dependency pins are unchanged by this follow-up.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 4, 2026, 4:23 AM ET / 08:23 UTC.

ClawSweeper review

What this changes

The PR selects Go 1.26.8 while retaining the Go 1.26.7 minimum, updates three indirect dependencies and the Pages deployment action, and adjusts installation documentation and release notes.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep open: this useful maintenance update is absent from main. Review found one minor installation-documentation error and no demonstrated runtime regression.

Priority: P3
Reviewed head: 3026c4440773677947afe177d080bd06af5d0d50

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with reported built-CLI validation and one minor installation-documentation error.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR is exempt from the external proof gate. Its captured body nevertheless reports the reviewed CLI exercising SweetCookie/SQLite import, local persistence, status and clearing with synthetic Firefox cookies; no Spotify-service behavior changed.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR is exempt from the external proof gate. Its captured body nevertheless reports the reviewed CLI exercising SweetCookie/SQLite import, local persistence, status and clearing with synthetic Firefox cookies; no Spotify-service behavior changed.
Evidence reviewed	10 items	Verified introduced patch: The local comparison matches the host-pinned introduction evidence: five files, 14 added lines and 12 removed lines, with no application-source changes. Still distinct from main: Fetched main has no toolchain directive and retains the previous pprof, crypto and SQLite versions. The supplied GitHub context identifies the proposal as open and collaborator-authored. Release boundary: The supplied latest release, v0.10.7, is an ancestor of fetched main; no local release tag contains the proposed head.
Findings	1 actionable finding	[P3] Scope preferred-toolchain selection to checkout builds
Security	None	None.

How this fits together

spogo is a Spotify command-line client whose cookie importer reads browser databases into a local credential cache. Go dependencies support that importer, while a separate Pages workflow publishes the installation documentation.

flowchart LR
  A[Go toolchain and dependency pins] --> B[Built spogo CLI]
  B --> D[Browser cookie import]
  C[Browser cookie database] --> D
  D --> E[Local cookie cache]
  E --> F[Spotify commands]
  G[Documentation build] --> H[Pages deployment]

Loading

Before merge

• Scope preferred-toolchain selection to checkout builds (P3) - Running the documented go install …@latest outside a checkout does not honor the downloaded module's toolchain suggestion, so a compatible Go 1.26.7 installation can build it without selecting 1.26.8. The new sentence directly beneath that command promises otherwise. Move this explanation to the checkout-build section and qualify it with automatic toolchain selection.
• Complete next step (P2) - Correct docs/install.md so Go 1.26.8 selection is described as a checkout-build preference under automatic toolchain selection.

Findings

• [P3] Scope preferred-toolchain selection to checkout builds — docs/install.md:24

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the compatible dependency refresh and distinguish versioned installation from checkout-specific toolchain selection in the installation guide.

Do we have a high-confidence way to reproduce the issue?

Yes, for the documentation mismatch: Go's source shows that versioned installation outside a checkout does not enforce the downloaded module's preferred toolchain. No runtime regression was reproduced.

Is this the best way to solve the issue?

Yes, the dependency refresh is focused and preserves the declared minimum; its installation explanation needs to distinguish the two build paths.

Full review comments:

• [P3] Scope preferred-toolchain selection to checkout builds — docs/install.md:24
  Running the documented go install …@latest outside a checkout does not honor the downloaded module's toolchain suggestion, so a compatible Go 1.26.7 installation can build it without selecting 1.26.8. The new sentence directly beneath that command promises otherwise. Move this explanation to the checkout-build section and qualify it with automatic toolchain selection.
  Confidence: 0.96

Overall correctness: patch is correct
Overall confidence: 0.87

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 87a990da7e29.

Labels

Label changes:

• add P3: This is routine dependency maintenance with a minor documentation correction and no demonstrated urgent user-facing failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from the external proof gate. Its captured body nevertheless reports the reviewed CLI exercising SweetCookie/SQLite import, local persistence, status and clearing with synthetic Firefox cookies; no Spotify-service behavior changed.

Label justifications:

• P3: This is routine dependency maintenance with a minor documentation correction and no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from the external proof gate. Its captured body nevertheless reports the reviewed CLI exercising SweetCookie/SQLite import, local persistence, status and clearing with synthetic Firefox cookies; no Spotify-service behavior changed.

Evidence

Acceptance criteria:

• [P1] git diff --check.
• [P1] node scripts/build-docs-site.mjs.

What I checked:

• Verified introduced patch: The local comparison matches the host-pinned introduction evidence: five files, 14 added lines and 12 removed lines, with no application-source changes. (go.mod:5, 3026c4440773)
• Still distinct from main: Fetched main has no toolchain directive and retains the previous pprof, crypto and SQLite versions. The supplied GitHub context identifies the proposal as open and collaborator-authored. (go.mod:3, 87a990da7e29)
• Release boundary: The supplied latest release, v0.10.7, is an ancestor of fetched main; no local release tag contains the proposed head. (dc83047dfa53)
• Installation wording introduces an inaccurate promise: The new preferred-toolchain statement appears immediately under the versioned go install command without limiting it to checkout builds or automatic toolchain selection. (docs/install.md:24, 3026c4440773)
• Go toolchain contract: The installed Go 1.26.7 source reads preferred toolchains from the enclosing workspace/module. Versioned installation resolves the downloaded module without a main module and switches for its required Go version. Its toolchain suggestion therefore does not guarantee Go 1.26.8 for installation outside a checkout. The distribution README explicitly identifies golang/go as its repository mirror; no source commit SHA was available. (src/cmd/go/internal/toolchain/select.go:696)
• Production dependency boundary: BrowserSource invokes SweetCookie, and auth import persists its returned cookies through the existing JSON store. These callers, cookie selection rules and stored format are unchanged; existing tests cover import, status and persistence. (internal/cookies/source.go:16, 3026c4440773)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Correct the installation guide's distinction between versioned go install and automatic toolchain selection in a checkout.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): refresh Go toolchain and cookie dependencies This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[steipete]

Squash-merged as e89c46f. The merge tree matches the reviewed candidate exactly, with the original main commit as its single parent.

Validation passed: 90.4% coverage, race tests, lint, deadcode, Go 1.26.7/1.26.8 native builds, Linux/Windows cross-builds, and built-CLI import/status/clear against a synthetic Firefox cookie database. The docs-only follow-up rebuilt the site and checked its rendered installation text. Full-candidate isolated P2 review passed before commit and landing.

Postmerge CI, CodeQL, Pages, and the dependency graph update passed. The published install page returns HTTP 200 and correctly scopes the Go 1.26.8 preference to checkout builds. No CI reruns were needed.

The minimum remains Go 1.26.7, and libc remains pinned to SQLite's required 1.75.6. Cookie integration proof used synthetic data and made no Spotify service requests.