build(deps): update go-strftime to v1.1.0

[steipete]

Update the indirect github.com/ncruces/go-strftime dependency from v1.0.0 to v1.1.0. Its Go 1.24 minimum fits the existing Go 1.27.1 floor, and its September 29 Go proxy timestamp is older than the repository's three-day cooldown. Keep the project version unchanged and record the update under Unreleased.

Validation on Hetzner: go mod tidy leaves the proposed module files unchanged, go mod verify succeeds, and the upstream package tests pass. Full make check passes on the combined tree containing #233 and #231, including 85.6% coverage and six snapshot targets. Independent Codex P0–P3 review found no actionable issues.

Exact-head CI, Docker, secret scanning, and CodeQL passed at 37311bb45b8b3e2006a01e43e2fbfc7aa6d4ff1c before merge.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 6, 2026, 9:51 PM ET / October 7, 2026, 01:51 UTC.

ClawSweeper review

What this changes

Updates the indirect go-strftime dependency to v1.1.0, replaces its checksums, and records the update under Unreleased.

Merge readiness

✅ Ready for maintainer review

The update remains necessary: current main and v0.15.0 still pin v1.0.0. The introduced diff is focused, and no actionable correctness or security defect was found.

Priority: P3
Reviewed head: 37311bb45b8b3e2006a01e43e2fbfc7aa6d4ff1c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, compatible dependency update with reported validation and no actionable introduced defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The repository-state context identifies the author as MEMBER, exempting this maintenance PR from contributor runtime proof. Reported Hetzner checks are supplemental validation; the inspected update changes time formatting without introducing an authority boundary or stored-data contract.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The repository-state context identifies the author as MEMBER, exempting this maintenance PR from contributor runtime proof. Reported Hetzner checks are supplemental validation; the inspected update changes time formatting without introducing an authority boundary or stored-data contract.
Evidence reviewed	7 items	Pinned introduced change: The exact merge-base-to-head diff changes only the dependency version, its two checksum entries, and an Unreleased changelog entry; the Go floor stays at 1.27.1. Still necessary on main: The pinned main branch still requires go-strftime v1.0.0, so this dependency update is not already implemented. Latest release comparison: The v0.15.0 module file also pins go-strftime v1.0.0. Its local historical blob was unavailable, so the file was inspected through GitHub's read-only contents API.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl mirrors GitHub discussions into a local SQLite archive for search and analysis. Its Go module pins select the dependency code compiled into the CLI, including this time-formatting library.

flowchart LR
  A[Go module pins] --> B[Dependency resolution]
  B --> C[Time formatting library]
  C --> D[Compiled Gitcrawl CLI]
  E[GitHub discussions] --> D
  D --> F[Local archive and search]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the focused module update with the existing toolchain floor and unchanged application configuration and archive schema.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency rather than reporting a Gitcrawl failure; the exact version delta and upstream behavior change were inspected.

Is this the best way to solve the issue?

Yes: updating the existing module pin and checksums is a narrow way to consume the upstream fix without adding another implementation.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against c731775a9ab6.

Labels

Label changes:

• add P3: This is a focused dependency maintenance update with no demonstrated urgent user-facing failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The repository-state context identifies the author as MEMBER, exempting this maintenance PR from contributor runtime proof. Reported Hetzner checks are supplemental validation; the inspected update changes time formatting without introducing an authority boundary or stored-data contract.

Label justifications:

• P3: This is a focused dependency maintenance update with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The repository-state context identifies the author as MEMBER, exempting this maintenance PR from contributor runtime proof. Reported Hetzner checks are supplemental validation; the inspected update changes time formatting without introducing an authority boundary or stored-data contract.

Evidence

What I checked:

• Pinned introduced change: The exact merge-base-to-head diff changes only the dependency version, its two checksum entries, and an Unreleased changelog entry; the Go floor stays at 1.27.1. (go.mod:39, 37311bb45b8b)
• Still necessary on main: The pinned main branch still requires go-strftime v1.0.0, so this dependency update is not already implemented. (go.mod:39, c731775a9ab6)
• Latest release comparison: The v0.15.0 module file also pins go-strftime v1.0.0. Its local historical blob was unavailable, so the file was inspected through GitHub's read-only contents API. (go.mod:39, e8448c176044)
• Upstream compatibility and supply-chain inspection: The target explicitly pins this module, establishing the dependency contract. The v1.1.0 tag resolves to fa91ab7a1dcba7937c8d408d1a4477d2a348581d. Compared with v1.0.0, runtime changes correct century formatting for negative and extended years; upstream adds focused tests and raises its minimum Go version to 1.24. No new module dependencies or runtime execution hooks appear. Upstream workflow edits do not change Gitcrawl's workflows. (strftime.go:82, fa91ab7a1dcb)
• Dependency cooldown: Dependabot uses a three-day cooldown. The inspected upstream commits are dated September 29, more than three days before this October 7 submission. (.github/dependabot.yml:8, 37311bb45b8b)
• Validation and related work: The captured PR body reports Hetzner module verification, upstream tests, and full make check on the combined tree. fix(analytics): read the discovery receipt beside the resolved config #231 and fix(embed): seek indexed candidates on large archives #233 are merged and form the current base; their analytics and embedding fixes do not replace this dependency update. These reported checks were not rerun during this read-only review. (37311bb45b8b)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.