build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.0

[dependabot]

Bumps github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.0.

Release notes

Sourced from github.com/pelletier/go-toml/v2's releases.

v2.4.0

What's Changed

What's new

• Support TOML v1.1.0 by @​jcmfernandes, @​pelletier in pelletier/go-toml#1068

Performance

• Reimplementation of the parser, decoder, and encoder by @​pelletier Fable 5 in pelletier/go-toml#1067
• New benchmarks from dependent projects in pelletier/go-toml#1067

Fixed bugs

• Populate DecodeError.Key() on type mismatch errors by @​leno23 in pelletier/go-toml#1064
• Contextualize redefinition errors as DecodeError by @​leno23, @​pelletier in pelletier/go-toml#1069
• Report quoted string requirement for unquoted values by @​leno23 in pelletier/go-toml#1063

Documentation

• Explain omitempty behavior for time.Time fields by @​leno23 in pelletier/go-toml#1061
• Remove "Migrating from v1" section from README by @​pelletier in pelletier/go-toml#1070

New Contributors

• @​leno23 made their first contribution in pelletier/go-toml#1064
• @​jcmfernandes made their first contribution in pelletier/go-toml#1068

Full Changelog: pelletier/go-toml@v2.3.1...v2.4.0

Commits

• b99e8db docs: remove "Migrating from v1" section from README (#1070)
• 5a548e3 Reimplementation of the parser, decoder, and encoder (#1067)
• 3c357d6 fix: report quoted string requirement for unquoted values (#1063)
• bf5d424 Contextualize redefinition errors as DecodeError (#1069)
• eb85928 Support TOML v1.1.0 (#1068)
• a7fae34 Add CI check to enforce capability limits (#1043)
• d7225fe Fix goreleaser deprecation warnings (#1045)
• fb957cb docs: explain omitempty behavior for time.Time fields (#1061)
• 02b43a0 fix: populate DecodeError.Key() on type mismatch errors (#1064)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 19, 2026, 3:27 AM ET / 07:27 UTC.

Summary
The PR updates the direct Go module dependency github.com/pelletier/go-toml/v2 from v2.3.1 to v2.4.0 in go.mod and go.sum.

Reproducibility: not applicable. this is a dependency maintenance PR, not a bug report. The relevant verification is source inspection showing go-toml is used for config and scheduler TOML load/save paths, plus CI status for the proposed module version.

Review metrics: 2 noteworthy metrics.

• Dependency surface: 1 direct production module updated. go-toml backs config and scheduler TOML read/write paths, so this is not an unused dependency update.
• Diff size: 2 files changed, 3 additions, 3 deletions. The PR is small enough that review should focus on dependency behavior and checks rather than local implementation logic.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Maintainers should either accept the TOML compatibility risk after reviewing the upstream release or add a representative config compatibility fixture before merge.

Risk before merge

• [P1] The upstream v2.4.0 release reimplements the parser, decoder, and encoder, so edge-case parsing or marshaling of existing config.toml and crawlctl.toml files could change even though the local diff is only go.mod/go.sum.

Maintainer options:

1. Merge after dependency review (recommended)
   CI is green and the diff is limited to module metadata, but maintainers should explicitly accept the parser/encoder rewrite risk for existing config files.
2. Add compatibility fixture first
   If maintainers want stronger upgrade proof, add a focused temp-dir test that loads representative crawlkit and crawlctl TOML configs and verifies expected round-trip behavior.
3. Defer the minor bump
   If the parser rewrite is too much dependency movement for the current release window, leave the bump for Dependabot to recreate later.

Next step before merge

• [P2] The remaining action is maintainer acceptance of a parser/encoder dependency update, not an automated code repair.

Security
Cleared: No concrete security or supply-chain concern was found in the local diff; it changes only the requested module version and checksums for an existing direct dependency.

Review details

Best possible solution:

Land the dependency bump after maintainers accept the TOML compatibility risk, ideally with green GOWORK=off validation and confidence that representative existing config files still load and round-trip correctly.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR, not a bug report. The relevant verification is source inspection showing go-toml is used for config and scheduler TOML load/save paths, plus CI status for the proposed module version.

Is this the best way to solve the issue?

Yes, a go.mod/go.sum-only Dependabot bump is the normal narrow way to update this dependency. The remaining decision is whether maintainers accept the upstream parser rewrite risk as-is or want an added compatibility fixture before merge.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 94bbcd72fa6f.

Label changes

Label changes:

• add P3: This is a low-scope dependency maintenance PR with green checks and no known user-facing regression.
• add merge-risk: 🚨 compatibility: The updated TOML library parses and writes persisted config files, and the upstream release includes a parser/decoder/encoder rewrite.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real behavior proof gate does not apply; CI was green when inspected.

Label justifications:

• P3: This is a low-scope dependency maintenance PR with green checks and no known user-facing regression.
• merge-risk: 🚨 compatibility: The updated TOML library parses and writes persisted config files, and the upstream release includes a parser/decoder/encoder rewrite.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real behavior proof gate does not apply; CI was green when inspected.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its Go module validation guidance and compatibility cautions are relevant because this PR changes a direct Go dependency used by config parsing. (AGENTS.md:26, 94bbcd72fa6f)
• PR diff scope: The PR only changes go.mod and go.sum, replacing github.com/pelletier/go-toml/v2 v2.3.1 with v2.4.0 and updating the module checksums. (go.mod:13, 1a7b6d492f00)
• Production TOML usage: Current main imports go-toml in the config package and uses toml.Unmarshal/toml.Marshal for LoadTOML and WriteTOML, so the dependency affects persisted config behavior. (config/config.go:277, 94bbcd72fa6f)
• Scheduler config usage: Current main also imports go-toml in scheduler/config.go and uses it to load and save crawlctl scheduler configs. (scheduler/config.go:91, 94bbcd72fa6f)
• Focused config coverage exists: The repository has temp-dir TOML coverage for RuntimeConfig round trip and crawlctl config loading, but it is not exhaustive for edge-case parser compatibility. (config/config_test.go:280, 94bbcd72fa6f)
• Upstream release content: The upstream v2.4.0 release notes list TOML v1.1.0 support and a reimplementation of the parser, decoder, and encoder, which is the main compatibility review concern.

Likely related people:

• steipete: GitHub history shows steipete introduced the crawlctl scheduler config surface and platform-native config path policy, and local blame on the current shallow checkout points config/TOML lines at the latest release commit by Peter Steinberger. (role: feature owner and recent area contributor; confidence: high; commits: d41253c66810, ef3899c8d033, 94bbcd72fa6f; files: go.mod, config/config.go, scheduler/config.go)
• vincentkoc: GitHub path history for config/config.go shows recent hardening work in the config package, which is one of the TOML dependency consumers. (role: recent config hardening contributor; confidence: medium; commits: 2b7d5222adea; files: config/config.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Landed as 2fec54ce0a14680a30cf0ab0eea84b27286fe17c.

Proof: rebased onto current main; full go test ./... passed locally; CI test and windows-test, CodeQL, and both secret scans passed. Autoreview found no actionable issues. Upstream v2.4.0 substantially rewrites parsing/encoding; crawlkit's standard marshal/unmarshal paths are exercised by the passing config and scheduler suites.