build(deps): Bump github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.14.3

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.14.3.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

crawlkit v0.14.3

Highlights

• Restore release readiness with Peter's current repository-pinned SSH signing key and a supported pre-tag macOS notarization preflight that rechecks online tickets and build provenance after managed keychain cleanup.
• Update the bundled SQLite engine to v3.53.3 through modernc.org/sqlite v1.54.0.

Maintenance

• Update terminal detection to go-isatty v0.0.23 and refresh CI security tooling.

v0.13.4

Changes

• Add stable Developer ID signing, verification, and atomic installation for macOS crawlctl release artifacts so Full Disk Access survives updates.
• Require Go 1.26.5 to include the standard-library TLS security fixes.

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

v0.14.3 - 2026-07-17

Highlights

• Restore release readiness with Peter's current repository-pinned SSH signing key and a supported pre-tag macOS notarization preflight that rechecks online tickets and build provenance after managed keychain cleanup.
• Update the bundled SQLite engine to v3.53.3 through modernc.org/sqlite v1.54.0.

Maintenance

• Update terminal detection to go-isatty v0.0.23 and refresh CI security tooling.

v0.14.2 - 2026-07-12

• Add a snapshot-scoped publisher status client helper so resumable publishers verify the exact immutable candidate instead of trusting an unrelated completed candidate from the unscoped status route, and reject successful responses that omit the snapshot or return a different snapshot, app, or archive.
• Add a 64 MiB mutable SQLite bundle default and preserve exact request content lengths for bounded remote uploads. The shipped DefaultSQLiteBundleChunkSize constant and immutable snapshot default remain 256 MiB for caller and retry compatibility, including explicitly configured legacy mutable bundles. Mutable bundles retain their legacy part-count and aggregate-size, chunk-size, and object-size compatibility, while immutable snapshots enforce the negotiated 256 MiB part, 4 GiB object, 512 MiB compressed, and eight-part bounds. Bundle construction now rejects empty sources, removes partial temp artifacts on failure, and rejects source identity/content drift. Immutable uploads use private validated part snapshots and verify compressed and decompressed digests before any remote write. Every file-backed read is capped at its declared size plus one byte so concurrent same-inode growth is detected without consuming an unbounded tail. Mutable uploads retain bounded sequential file handling: Size: -1 uses the statted file size for local verification while preserving unknown-length transport, and part digests remain optional but are verified when supplied. Minimal legacy manifests, index-keyed part matching, and no duplicate temporary staging are also preserved; tiny chunk sizes avoid caller-sized part-slice preallocation. Manifests use crawl-remote's deterministic two-space persisted JSON representation and are size-preflighted before full encoding: snapshots are capped at 64 KiB while legacy mutable manifests retain the service-compatible 1 MiB ceiling.

v0.14.1 - 2026-07-12

• Add a publisher-authenticated archive status route and client helper so interrupted snapshot publication can resume without reader credentials.

v0.14.0 - 2026-07-12

• Require notarized, single-architecture crawlctl release binaries bound to the repository-pinned signed tag and protected remote main commit, restore signing-keychain state before credential-free candidate probes, roll back partial artifact promotion, and keep naturally quarantined Gatekeeper execution plus Full Disk Access continuity as separate clean-VM gates because raw binaries and ZIP submission carriers cannot carry stapled tickets and raw-CLI spctl assessment is not an app-launch verdict.
• Add immutable SQLite snapshot bundle manifests with deterministic source and representation digests, digest-scoped compressed objects and chunks, and explicit snapshot publishing helpers while preserving the legacy current.* bundle layout.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)