chore(deps): refresh developer and worker toolchains

[steipete]

Summary

• refresh the pinned Go developer tools to gofumpt 0.11.0, x/tools 0.48.0, and golangci-lint 2.12.2
• migrate the lint policy for golangci-lint 2.12's extended goconst, govet, gosec, and nolint behavior without changing product behavior
• update pnpm to 11.18.0 and refresh the email-tracking worker's enforced PostCSS, Undici, Vite, and ws versions
• keep CI's Corepack pin synchronized and record the maintenance in the changelog

Proof

• make ci
• worker lint, Wrangler dry-run build, and 15 Vitest tests with pnpm 11.18.0
• Wrangler 4.118.0 local server: /health returned HTTP 200 ok; /missing returned HTTP 404
• built bin/gog: --version, version --json, and root help all render successfully
• pnpm outdated --format json returns {}
• all manifest-owned direct Go modules report current
• autoreview (Codex/Sol, high reasoning): clean, no accepted/actionable findings

Notes

Undici moves from 7.28.0 to 8.9.0 through Wrangler/Miniflare. The worker's lint, build, test, and served-request proofs cover that major update.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 2, 2026, 11:11 PM ET / August 3, 2026, 03:11 UTC.

ClawSweeper review

What this changes

The branch refreshes Go developer-tool pins, pnpm/Corepack setup, lint configuration, and the email-tracking worker’s locked dependency overrides.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

This collaborator-authored maintenance PR is still necessary: current main retains the older tool and worker pins, while the branch updates the coordinated CI, lint, and lockfile surfaces. The patch has no discrete correctness or security defect from review, but the in-progress cross-platform checks should finish before normal maintainer approval.

Priority: P3
Reviewed head: 89f4146a9981f6ba3fcb8c66c845c40fb1463910

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	This is a focused, coherent maintenance patch with runtime-validation claims and no actionable review finding; platform CI completion remains the merge gate.
Proof confidence	🌊 off-meta tidepool	Not applicable: The proof gate does not apply to this collaborator PR; the body nonetheless reports post-change CLI builds, worker checks, and live local HTTP responses.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The proof gate does not apply to this collaborator PR; the body nonetheless reports post-change CLI builds, worker checks, and live local HTTP responses.
Evidence reviewed	5 items	Current main still uses the older pins: Current main sets gofumpt 0.9.2, x/tools/goimports and deadcode 0.47.0, and golangci-lint 2.11.4, so the central refresh is not already implemented. CI and package-manager pins are coordinated: The branch moves the worker workflow Corepack activation and package manifest from pnpm 11.9.0 to 11.18.0, matching the package-manager declaration. Worker overrides and lockfile move together: The branch updates the enforced PostCSS, Undici, Vite, and ws override versions in both the pnpm workspace configuration and resolved lock graph, avoiding a manifest/lock mismatch.
Findings	None	None.
Security	None	None.

How this fits together

The repository builds a Go CLI and an email-tracking worker. Pinned developer tools control local and CI formatting/linting, while the worker’s pnpm manifest and lockfile determine the dependencies used to build, test, and serve tracking requests.

flowchart LR
  Dev[Developer checkout] --> ToolPins[Go and pnpm tool pins]
  ToolPins --> CI[CI formatting, lint, and tests]
  WorkerSource[Tracking worker source] --> WorkerDeps[Worker dependency lockfile]
  WorkerDeps --> WorkerBuild[Worker build and local server]
  CI --> Artifacts[Validated CLI and worker artifacts]

Loading

Before merge

• Resolve merge risk (P1) - The worker dependency graph includes Undici 8 and other resolver changes; the PR’s reported local worker proof is encouraging, but the currently running exact-head Go, Windows, and Darwin checks should complete before merge.
• Resolve merge risk (P1) - The PR changes CI-installed developer tools and Corepack activation, so any platform-specific formatting, lint, or package-manager incompatibility should be resolved before landing.
• Complete next step (P2) - This collaborator PR needs routine maintainer approval after the in-progress exact-head cross-platform checks complete; no discrete mechanical repair is identified.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	15 files affected; +153, -151 lines	The maintenance update spans Go tool installation, lint policy, CI package-manager activation, and the worker dependency graph.
Worker lock refresh	1 lockfile changed; +124, -125 lines	Most of the patch is the expected resolved dependency-graph update rather than product-code growth.

Merge-risk options

Maintainer options:

1. Complete exact-head platform validation (recommended)
   Wait for the current Go, Windows, and Darwin checks to succeed on the reviewed head before merging the coordinated dependency refresh.

Technical review

Best possible solution:

Land the synchronized tool, lint, CI, and worker-lock refresh after the exact-head cross-platform checks complete successfully; preserve the existing focused dependency-maintenance pattern rather than splitting the coupled pins.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is maintenance work rather than a report of broken existing behavior. The relevant verification path is the reported CLI/worker runtime checks plus repository CI.

Is this the best way to solve the issue?

Yes: coordinating the Makefile, lint policy, worker manifest/lockfile, and CI Corepack pin is the narrow maintainable way to refresh these toolchains without creating configuration drift.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 0a3ebe9ad788.

Labels

Label changes:

• add P3: This is routine developer-tool and dependency maintenance with no claimed end-user behavior change.
• add merge-risk: 🚨 compatibility: The worker’s locked graph moves Undici across a major version alongside Vite and PostCSS overrides.
• add merge-risk: 🚨 automation: The PR changes the Corepack pnpm activation used by the worker CI job and the Go tools installed by CI.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The proof gate does not apply to this collaborator PR; the body nonetheless reports post-change CLI builds, worker checks, and live local HTTP responses.

Label justifications:

• P3: This is routine developer-tool and dependency maintenance with no claimed end-user behavior change.
• merge-risk: 🚨 compatibility: The worker’s locked graph moves Undici across a major version alongside Vite and PostCSS overrides.
• merge-risk: 🚨 automation: The PR changes the Corepack pnpm activation used by the worker CI job and the Go tools installed by CI.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The proof gate does not apply to this collaborator PR; the body nonetheless reports post-change CLI builds, worker checks, and live local HTTP responses.

Evidence

What I checked:

• Current main still uses the older pins: Current main sets gofumpt 0.9.2, x/tools/goimports and deadcode 0.47.0, and golangci-lint 2.11.4, so the central refresh is not already implemented. (Makefile:28, 0a3ebe9ad788)
• CI and package-manager pins are coordinated: The branch moves the worker workflow Corepack activation and package manifest from pnpm 11.9.0 to 11.18.0, matching the package-manager declaration. (.github/workflows/ci.yml:47, 89f4146a9981)
• Worker overrides and lockfile move together: The branch updates the enforced PostCSS, Undici, Vite, and ws override versions in both the pnpm workspace configuration and resolved lock graph, avoiding a manifest/lock mismatch. (internal/tracking/worker/pnpm-workspace.yaml:30, 89f4146a9981)
• Established ownership and maintenance cadence: History shows Peter Steinberger authored the immediately preceding Go/worker toolchain refresh and an earlier CI/toolchain refresh; current-line blame also attributes the existing tool-pin declaration to that area’s history. (Makefile:28, 28c9be252994)
• Reported real validation and remaining gate: The PR body reports make ci, worker lint/build/tests, local Wrangler HTTP 200/404 checks, and built CLI command checks; GitHub context shows Windows and Go checks are still in progress on the current head. (.github/workflows/ci.yml:37, 89f4146a9981)

Likely related people:

• steipete: This person authored the preceding merged Go/worker toolchain refreshes and is the current-main history owner for the central tooling and worker dependency surfaces. (role: feature owner and recent area contributor; confidence: high; commits: 28c9be252994, ea6f68b487cd, 89f4146a9981; files: Makefile, .golangci.yml, .github/workflows/ci.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Let the in-progress exact-head Windows, Go, and Darwin checks finish successfully.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.