build(deps): Bump github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.16.6

[dependabot]

Bumps github.com/openclaw/crawlkit from 0.13.4-0.20260706080912-6703bbbb9d87 to 0.16.6.

Release notes

Sourced from github.com/openclaw/crawlkit's releases.

v0.16.6

0.16.6 - 2026-09-27

Highlights: Much faster embedding decoding and exact vector scoring, with opt-in portable SIMD kernels.

• Speed up 1,536-dimensional vector decode-and-score scans by 5.9× on Apple Silicon, with opt-in GOEXPERIMENT=simd kernels adding 1.7× and retaining the scalar fallback.
• Refresh automatic Gitcrawl compatibility qualification across 34 app commits, including fixture-only Git maintenance isolation, and advance its API baseline to published Crawlkit v0.16.5. Keep both complete CLI suites and the manual qualification pins unchanged.

v0.16.5

0.16.5 - 2026-09-22

Highlights: Safer sidecar paths and a faster SQLite runtime.

• Reject overlapping sidecar roots expressed with mixed relative and absolute paths, and reject nested destination directory symlinks before copying so managed files cannot be written outside the target or pruned through an alias.
• Preserve literal whitespace in sidecar directory names and reject ambiguous Windows directory aliases so sync cannot overwrite or prune a different, trimmed destination.
• Update the SQLite driver to v1.59.0 with its required libc v1.75.7 runtime for faster Linux memory operations and fewer callback allocations, retaining the Go 1.27.0 minimum.

v0.16.4

0.16.4 - 2026-09-20

• Accept reordered snapshot columns during incremental and merge planning when column names are identical and unique, preserving shard replacement and integrity checks.
• Bound scheduler output draining after command exit or cancellation so descendants cannot indefinitely block discovery or hold the refresh-run lock through inherited pipes.
• Reject path-bearing cache snapshot names before publication while preserving literal valid filenames, preventing writes outside the cache directory. Thanks @​SebTardif.

v0.16.3

0.16.3 - 2026-09-13

• Honor configured embedding request timeouts with caller-supplied HTTP clients without mutating those clients; retain shorter client and context deadlines.
• Preserve literal systemd command arguments and executable names; reject executable-path characters that systemd cannot load.
• Preserve file and SQLite capture contents when MaxFileBytes is the maximum signed 64-bit value; keep overflow-free bounded reads for growing sources.
• Read and repair long scheduler history records without blocking later runs or status checks.
• Publish changes to zero-row backup counter keys while reusing unchanged encrypted shards.
• Apply private permissions before overwriting existing controller configurations.
• Allow explicit controller configuration paths without a home directory while preserving default and tilde-path validation.
• Refresh indirect test and generator dependencies: pprof, x/exp, x/tools v0.50.0, and modernc/cc v4.29.7 while preserving SQLite's required libc version.
• Run the same validation gates locally and in Linux CI, including formatting, and cancel superseded automatic CI runs.

v0.16.2

0.16.2 - 2026-09-11

Highlights: Updated runtime dependencies and refreshed analysis tooling.

• Refresh operating-system support to x/sys v0.48.0, cryptography to x/crypto v0.57.0, Unicode text handling to x/text v0.42.0, and terminal character widths to go-runewidth v0.0.30 while retaining the Go 1.27.0 minimum. Thanks @​dependabot.
• Update deadcode to v0.50.0, govulncheck to v1.8.0, and the pinned CodeQL action to v4.38.0.

v0.16.1 - 2026-09-11

• Bound worker shutdown when cancellation arrives during retry or completion persistence. Remaining claims share one cleanup deadline instead of waiting a separate storage timeout per job; rejected batches use the same bound.

... (truncated)

Changelog

Sourced from github.com/openclaw/crawlkit's changelog.

0.16.6 - 2026-09-27

Highlights: Much faster embedding decoding and exact vector scoring, with opt-in portable SIMD kernels.

• Speed up 1,536-dimensional vector decode-and-score scans by 5.9× on Apple Silicon, with opt-in GOEXPERIMENT=simd kernels adding 1.7× and retaining the scalar fallback.
• Refresh automatic Gitcrawl compatibility qualification across 34 app commits, including fixture-only Git maintenance isolation, and advance its API baseline to published Crawlkit v0.16.5. Keep both complete CLI suites and the manual qualification pins unchanged.

0.16.5 - 2026-09-22

Highlights: Safer sidecar paths and a faster SQLite runtime.

• Reject overlapping sidecar roots expressed with mixed relative and absolute paths, and reject nested destination directory symlinks before copying so managed files cannot be written outside the target or pruned through an alias.
• Preserve literal whitespace in sidecar directory names and reject ambiguous Windows directory aliases so sync cannot overwrite or prune a different, trimmed destination.
• Update the SQLite driver to v1.59.0 with its required libc v1.75.7 runtime for faster Linux memory operations and fewer callback allocations, retaining the Go 1.27.0 minimum.

0.16.4 - 2026-09-20

• Accept reordered snapshot columns during incremental and merge planning when column names are identical and unique, preserving shard replacement and integrity checks.
• Bound scheduler output draining after command exit or cancellation so descendants cannot indefinitely block discovery or hold the refresh-run lock through inherited pipes.
• Reject path-bearing cache snapshot names before publication while preserving literal valid filenames, preventing writes outside the cache directory. Thanks @​SebTardif.

0.16.3 - 2026-09-13

• Honor configured embedding request timeouts with caller-supplied HTTP clients without mutating those clients; retain shorter client and context deadlines.
• Preserve literal systemd command arguments and executable names; reject executable-path characters that systemd cannot load.
• Preserve file and SQLite capture contents when MaxFileBytes is the maximum signed 64-bit value; keep overflow-free bounded reads for growing sources.
• Read and repair long scheduler history records without blocking later runs or status checks.
• Publish changes to zero-row backup counter keys while reusing unchanged encrypted shards.
• Apply private permissions before overwriting existing controller configurations.
• Allow explicit controller configuration paths without a home directory while preserving default and tilde-path validation.
• Refresh indirect test and generator dependencies: pprof, x/exp, x/tools v0.50.0, and modernc/cc v4.29.7 while preserving SQLite's required libc version.
• Run the same validation gates locally and in Linux CI, including formatting, and cancel superseded automatic CI runs.

0.16.2 - 2026-09-11

Highlights: Updated runtime dependencies and refreshed analysis tooling.

• Refresh operating-system support to x/sys v0.48.0, cryptography to x/crypto v0.57.0, Unicode text handling to x/text v0.42.0, and terminal character widths to go-runewidth v0.0.30 while retaining the Go 1.27.0 minimum. Thanks @​dependabot.
• Update deadcode to v0.50.0, govulncheck to v1.8.0, and the pinned CodeQL action to v4.38.0.

v0.16.1 - 2026-09-11

• Bound worker shutdown when cancellation arrives during retry or completion persistence. Remaining claims share one cleanup deadline instead of waiting a separate storage timeout per job; rejected batches use the same bound.

v0.16.0 - 2026-09-11

• Add the generic worker runtime for continuous processing over application-owned durable queues, with bounded batches, fresh-input priority, cancellation,

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 6de610e4-8945-411a-85dc-8f6c861c3592

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}