chore(deps): refresh SQLite runtime dependencies

[steipete]

Summary

• update modernc.org/libc from v1.74.4 to v1.75.3
• update modernc.org/memory from v1.11.0 to v1.12.0
• refresh the selected transitive compiler/runtime checksums

Validation

• make check
• make build
• ./bin/crawlctl --help
• ./bin/crawlctl --version
• external consumer smoke test using store.Open, schema creation, insert, and query
• autoreview clean with no accepted/actionable findings

govulncheck reports zero affected vulnerabilities and zero vulnerabilities in imported packages. It also reports GO-2026-5932 for the unmaintained golang.org/x/crypto/openpgp package, which crawlkit does not import; that advisory has no fixed version.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 10, 2026, 2:28 AM ET / 06:28 UTC.

ClawSweeper review

What this changes

The PR updates two indirect modernc SQLite runtime dependencies and refreshes the corresponding transitive Go module checksums.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

Keep open: this is a compact, coherent SQLite runtime refresh, but it needs recorded after-fix external-consumer proof before merge. The PR body lists validation commands without supplying observable output or an artifact.

Priority: P3
Reviewed head: 913e09fae4f86ddace8101f87dc446dc280652ec

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The dependency-only patch is focused, but missing recorded real behavior proof leaves the SQLite upgrade path as a merge gate.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR body names an external-consumer smoke test but provides no after-fix terminal output, log, screenshot, or linked artifact showing that run; please redact private paths or data in the added proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR body names an external-consumer smoke test but provides no after-fix terminal output, log, screenshot, or linked artifact showing that run; please redact private paths or data in the added proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	5 items	SQLite runtime integration: The shared store package imports modernc SQLite and opens the driver through database/sql, so the refreshed modules sit on the local archive database path. Focused patch: The PR changes only the selected indirect libc and memory versions in go.mod, with matching checksum substitutions for their resolved compiler/runtime graph. Existing compatibility coverage: Current tests already exercise store opening, schema creation, insertion, and querying with temporary SQLite files; that is the appropriate focused runtime behavior to demonstrate on the updated graph.
Findings	None	None.
Security	None	None.

How this fits together

crawlkit’s store package opens local archive databases through the pure-Go modernc SQLite driver. Its selected Go-module dependency graph affects archive creation, schema setup, and queries for downstream crawl apps.

flowchart LR
  A[Downstream crawl apps] --> B[crawlkit store]
  B --> C[modernc SQLite driver]
  C --> D[Selected runtime modules]
  D --> E[Go module checksums]
  E --> F[Local archive database]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: The PR body names an external-consumer smoke test but provides no after-fix terminal output, log, screenshot, or linked artifact showing that run; please redact private paths or data in the added proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - Updating the SQLite runtime graph can affect how existing local archive databases open or query; the PR has no recorded external-consumer result demonstrating that upgrade path.
• Complete next step (P2) - The remaining gate is contributor-supplied runtime proof, not a discrete automated repair.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency graph scope	2 manifest entries changed; 7 checksum-version substitutions	The patch is narrowly limited to the existing modernc SQLite runtime dependency chain.

Merge-risk options

Maintainer options:

1. Record archive compatibility proof (recommended)
   Add redacted external-consumer output showing the updated SQLite graph opens, writes, and queries a temporary archive database before merge.

Technical review

Best possible solution:

Add a redacted terminal transcript or linked artifact from an external consumer using the PR graph to open an archive, create schema, insert, query, and close successfully, then merge the narrow module refresh.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR does not report a bug. Existing temporary-database tests define the relevant compatibility scenario, but no failing regression requires reproduction.

Is this the best way to solve the issue?

Yes, conditionally: updating the selected existing runtime modules is the narrow maintainable path, provided an external consumer demonstrates the updated graph against SQLite archive operations.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e3e8b09d8f73.

Labels

Label changes:

• add P3: This is a small dependency-maintenance update with no reported user-facing regression.
• add merge-risk: 🚨 compatibility: The selected runtime modules underpin SQLite access for existing local archive databases, so upgrade behavior needs direct proof.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body names an external-consumer smoke test but provides no after-fix terminal output, log, screenshot, or linked artifact showing that run; please redact private paths or data in the added proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a small dependency-maintenance update with no reported user-facing regression.
• merge-risk: 🚨 compatibility: The selected runtime modules underpin SQLite access for existing local archive databases, so upgrade behavior needs direct proof.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body names an external-consumer smoke test but provides no after-fix terminal output, log, screenshot, or linked artifact showing that run; please redact private paths or data in the added proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• SQLite runtime integration: The shared store package imports modernc SQLite and opens the driver through database/sql, so the refreshed modules sit on the local archive database path. (store/store.go:14, e3e8b09d8f73)
• Focused patch: The PR changes only the selected indirect libc and memory versions in go.mod, with matching checksum substitutions for their resolved compiler/runtime graph. (go.mod:40, 913e09fae4f8)
• Existing compatibility coverage: Current tests already exercise store opening, schema creation, insertion, and querying with temporary SQLite files; that is the appropriate focused runtime behavior to demonstrate on the updated graph. (store/store_test.go:13, e3e8b09d8f73)
• Area provenance: History shows steipete authored the recent Go dependency refresh, and blame attributes the modernc SQLite import to the checkout’s initial store implementation boundary. (store/store.go:14, 6436040da11b)
• Current-main and release check: The PR head is not an ancestor of current main and is not contained by a local release tag, so its dependency selection is neither implemented on main nor shipped. (go.mod:40, 913e09fae4f8)

Likely related people:

• steipete: Authored the recent Go dependency refresh, and current source attribution places the modernc SQLite import in the store implementation associated with this history. (role: recent dependency contributor and SQLite integration owner; confidence: medium; commits: 6436040da11b, 4b80ce12b866; files: go.mod, store/store.go)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add a redacted external-consumer transcript showing store opening, schema creation, insert, query, and close on the PR dependency graph.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.