build(deps): bump github.com/openclaw/crawlkit from 0.13.0 to 0.13.1

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.13.0 to 0.13.1.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.13.1 - 2026-06-23

• Harden crawlkit scheduler, output, release-check, vector ranking, and CI workflow edges found by clawpatch.
• Expose remote ingest reset progress so crawl publishers can drain large Cloudflare D1 table replacements before sending row batches.

Commits

• 5ebd0de fix(remote): expose ingest reset progress
• 232aef3 fix: harden crawlkit clawpatch findings
• b2a3797 chore: reopen changelog after 0.13.0
• See full diff in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 30, 2026, 7:43 PM ET / 23:43 UTC.

Summary
The PR updates github.com/openclaw/crawlkit from v0.13.0 to v0.13.1 in go.mod and refreshes the matching go.sum checksums.

Reproducibility: not applicable. this is a bot dependency maintenance PR, not a reported runtime bug. The relevant verification path is the PR check suite on the refreshed head plus dependency-owner review.

Review metrics: 3 noteworthy metrics.

• Local files changed: 2 modified, 3 insertions, 3 deletions. The repository diff is limited to Go module metadata with no local source, workflow, script, or vendored-code changes.
• Upstream dependency delta: 3 commits, 16 upstream files. The direct production dependency update pulls a small first-party patch release rather than a broad version jump.
• Current check state: deps/lint/test passed; CodeQL and release-check in progress. The refreshed head has useful validation signal, but required pre-merge checks are still settling.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Wait for the in-progress CodeQL analyze and CI release-check jobs on the refreshed head to complete successfully before merge.
• Confirm dependency owners are comfortable with crawlkit v0.13.1 tag and changelog provenance while no GitHub release entry exists.

Risk before merge

• [P1] The current head still has CodeQL analyze and CI release-check in progress, so merge should wait for required checks to finish.
• [P1] crawlkit v0.13.1 has an annotated tag and changelog entry but no GitHub release entry yet, so dependency owners should be comfortable relying on tag, changelog, and Go checksum provenance for this first-party patch.

Maintainer options:

1. Decide the mitigation before merge
   Let the refreshed Dependabot head finish required checks, then merge if release-integrity owners accept the crawlkit v0.13.1 tag and changelog provenance.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] This is ready for normal dependency-owner review after pending checks; there is no narrow code repair for ClawSweeper to make.

Security
Cleared: The local diff only updates a first-party Go module version and checksums; no local workflow, secret, package-source, lifecycle-script, or publishing surface changes are introduced.

Review details

Best possible solution:

Let the refreshed Dependabot head finish required checks, then merge if release-integrity owners accept the crawlkit v0.13.1 tag and changelog provenance.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a bot dependency maintenance PR, not a reported runtime bug. The relevant verification path is the PR check suite on the refreshed head plus dependency-owner review.

Is this the best way to solve the issue?

Yes: the module-only Dependabot bump is the narrow maintainable path for taking crawlkit v0.13.1. The safe merge path is to wait for the refreshed checks to finish and keep the diff limited to go.mod/go.sum.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 9343c18d6bb1.

Label changes

Label justifications:

• P3: This is low-risk dependency maintenance with a small module-only diff and no confirmed user-facing regression from the patch.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so contributor real-behavior proof is not required; CI and dependency-owner review are the relevant checks.

Evidence reviewed

What I checked:

• Target AGENTS.md check: No AGENTS.md exists inside the target graincrawl checkout, so no target-specific AGENTS policy applied. (9343c18d6bb1)
• Current main still uses v0.13.0: Current main requires github.com/openclaw/crawlkit v0.13.0, so the requested dependency bump is not already implemented. (go.mod:6, 9343c18d6bb1)
• PR diff is module-only: The PR changes only go.mod and go.sum, replacing crawlkit v0.13.0 with v0.13.1 and its checksums. (go.mod:6, e0d0e5f8ab82)
• Refreshed PR state: The current head is mergeable; deps, lint, and test have passed, while CodeQL analyze and CI release-check are still in progress. (e0d0e5f8ab82)
• Upstream crawlkit delta: The v0.13.0...v0.13.1 compare is ahead by 3 commits and 16 files, covering runtime packages plus upstream tests/workflows. (5ebd0de44689)
• Upstream tag and release provenance: crawlkit v0.13.1 has an annotated tag pointing at 5ebd0de, while GitHub releases currently list v0.13.0 as the latest release entry. (5ebd0de44689)

Likely related people:

• openclaw/openclaw-secops: CODEOWNERS explicitly owns go.mod and go.sum, which are the only files changed by this dependency bump. (role: CODEOWNERS release integrity owner; confidence: high; commits: 2cc577b8ebf4; files: .github/CODEOWNERS, go.mod, go.sum)
• steipete: The current crawlkit v0.13.0 requirement in go.mod is blamed to the release-prep commit authored by Peter Steinberger. (role: current dependency baseline author; confidence: medium; commits: 2cc577b8ebf4; files: go.mod, go.sum)
• vincentkoc: Vincent Koc authored the crawlkit v0.13.1 tag target and hardening commits, and also authored the recent graincrawl CI smoke assertion fix on main. (role: upstream crawlkit patch author and recent adjacent contributor; confidence: high; commits: 5ebd0de44689, 232aef3d30b8, 9343c18d6bb1; files: remote/remote.go, releasecheck/releasecheck.go, .github/workflows/ci.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

@dependabot rebase