build(deps): Bump github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.16.4

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.16.4.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.16.4

0.16.4 - 2026-09-20

• Accept reordered snapshot columns during incremental and merge planning when column names are identical and unique, preserving shard replacement and integrity checks.
• Bound scheduler output draining after command exit or cancellation so descendants cannot indefinitely block discovery or hold the refresh-run lock through inherited pipes.
• Reject path-bearing cache snapshot names before publication while preserving literal valid filenames, preventing writes outside the cache directory. Thanks @​SebTardif.

v0.16.3

0.16.3 - 2026-09-13

• Honor configured embedding request timeouts with caller-supplied HTTP clients without mutating those clients; retain shorter client and context deadlines.
• Preserve literal systemd command arguments and executable names; reject executable-path characters that systemd cannot load.
• Preserve file and SQLite capture contents when MaxFileBytes is the maximum signed 64-bit value; keep overflow-free bounded reads for growing sources.
• Read and repair long scheduler history records without blocking later runs or status checks.
• Publish changes to zero-row backup counter keys while reusing unchanged encrypted shards.
• Apply private permissions before overwriting existing controller configurations.
• Allow explicit controller configuration paths without a home directory while preserving default and tilde-path validation.
• Refresh indirect test and generator dependencies: pprof, x/exp, x/tools v0.50.0, and modernc/cc v4.29.7 while preserving SQLite's required libc version.
• Run the same validation gates locally and in Linux CI, including formatting, and cancel superseded automatic CI runs.

v0.16.2

0.16.2 - 2026-09-11

Highlights: Updated runtime dependencies and refreshed analysis tooling.

• Refresh operating-system support to x/sys v0.48.0, cryptography to x/crypto v0.57.0, Unicode text handling to x/text v0.42.0, and terminal character widths to go-runewidth v0.0.30 while retaining the Go 1.27.0 minimum. Thanks @​dependabot.
• Update deadcode to v0.50.0, govulncheck to v1.8.0, and the pinned CodeQL action to v4.38.0.

v0.16.1 - 2026-09-11

• Bound worker shutdown when cancellation arrives during retry or completion persistence. Remaining claims share one cleanup deadline instead of waiting a separate storage timeout per job; rejected batches use the same bound.

v0.16.0 - 2026-09-11

• Add the generic worker runtime for continuous processing over application-owned durable queues, with bounded batches, fresh-input priority, cancellation, retry/backoff, and safe status snapshots.
• Define revision and lease fencing contracts so background results cannot overwrite newer input; applications retain their schemas, eligibility rules, transactions, and result persistence.
• Budget leases for slow storage failure cleanup and bound shutdown cleanup for the entire batch. SQLite-backed recovery tests and controlled-clock regressions cover edits, deletes, expired ownership, duplicate completion, and slow cleanup.

v0.15.1 - 2026-09-09

• Preserve optional caller-owned warnings in remote ingest manifests and archive snapshot metadata without changing the v1 protocol or legacy JSON payloads.

... (truncated)

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

0.16.4 - 2026-09-20

• Accept reordered snapshot columns during incremental and merge planning when column names are identical and unique, preserving shard replacement and integrity checks.
• Bound scheduler output draining after command exit or cancellation so descendants cannot indefinitely block discovery or hold the refresh-run lock through inherited pipes.
• Reject path-bearing cache snapshot names before publication while preserving literal valid filenames, preventing writes outside the cache directory. Thanks @​SebTardif.

0.16.3 - 2026-09-13

• Honor configured embedding request timeouts with caller-supplied HTTP clients without mutating those clients; retain shorter client and context deadlines.
• Preserve literal systemd command arguments and executable names; reject executable-path characters that systemd cannot load.
• Preserve file and SQLite capture contents when MaxFileBytes is the maximum signed 64-bit value; keep overflow-free bounded reads for growing sources.
• Read and repair long scheduler history records without blocking later runs or status checks.
• Publish changes to zero-row backup counter keys while reusing unchanged encrypted shards.
• Apply private permissions before overwriting existing controller configurations.
• Allow explicit controller configuration paths without a home directory while preserving default and tilde-path validation.
• Refresh indirect test and generator dependencies: pprof, x/exp, x/tools v0.50.0, and modernc/cc v4.29.7 while preserving SQLite's required libc version.
• Run the same validation gates locally and in Linux CI, including formatting, and cancel superseded automatic CI runs.

0.16.2 - 2026-09-11

Highlights: Updated runtime dependencies and refreshed analysis tooling.

• Refresh operating-system support to x/sys v0.48.0, cryptography to x/crypto v0.57.0, Unicode text handling to x/text v0.42.0, and terminal character widths to go-runewidth v0.0.30 while retaining the Go 1.27.0 minimum. Thanks @​dependabot.
• Update deadcode to v0.50.0, govulncheck to v1.8.0, and the pinned CodeQL action to v4.38.0.

v0.16.1 - 2026-09-11

• Bound worker shutdown when cancellation arrives during retry or completion persistence. Remaining claims share one cleanup deadline instead of waiting a separate storage timeout per job; rejected batches use the same bound.

v0.16.0 - 2026-09-11

• Add the generic worker runtime for continuous processing over application-owned durable queues, with bounded batches, fresh-input priority, cancellation, retry/backoff, and safe status snapshots.
• Define revision and lease fencing contracts so background results cannot overwrite newer input; applications retain their schemas, eligibility rules, transactions, and result persistence.
• Budget leases for slow storage failure cleanup and bound shutdown cleanup for the entire batch. SQLite-backed recovery tests and controlled-clock regressions cover edits, deletes, expired ownership, duplicate completion, and slow cleanup.

v0.15.1 - 2026-09-09

• Preserve optional caller-owned warnings in remote ingest manifests and archive snapshot metadata without changing the v1 protocol or legacy JSON payloads.

v0.15.0 - 2026-09-08

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 80463c64-319e-4bf3-8f79-bd2a68ada2b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #16.