build(deps): bump golang.org/x/text from 0.38.0 to 0.40.0

[dependabot]

Bumps golang.org/x/text from 0.38.0 to 0.40.0.

Commits

• 724af9c go.mod: update golang.org/x dependencies
• bf5b9d6 internal/export/idna: always treat Punycode encoding pure ASCII as an error
• b326f3d go.mod: update golang.org/x dependencies
• 5ae8e57 unicode/norm: avoid infinite loop on invalid input
• 0dc94a2 all: fix some comments
• See full diff in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 11, 2026, 8:59 AM ET / 12:59 UTC.

Summary
Updates the direct golang.org/x/text dependency from 0.38.0 to 0.40.0 and refreshes the resulting Go module checksums.

Reproducibility: not applicable. this pull request performs dependency maintenance rather than fixing a reported runtime defect.

Review metrics: 2 noteworthy metrics.

• Dependency files: 2 changed. The patch is confined to go.mod and go.sum, keeping the update straightforward to audit.
• Exact-head checks: 10 successful. Tests, lint, dependency validation, release, Docker, CodeQL, and secret-scanning checks all pass.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

• [P2] No repair lane or product decision is needed; ordinary merge handling can safely gate the exact green head.

Security
Cleared: The diff only updates official Go module versions and checksums, with CodeQL and secret-scanning checks successful on the exact head.

Review details

Best possible solution:

Merge the exact green Dependabot head because it is a compatible, metadata-only maintenance update with no unsupported module or supply-chain changes.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this pull request performs dependency maintenance rather than fixing a reported runtime defect.

Is this the best way to solve the issue?

Yes: updating the direct module requirement and Go-generated checksums is the narrowest maintainable approach, and both upstream compatibility and exact-head CI support it.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d91dcdb22870.

Label changes

Label changes:

• add P3: This is routine, low-risk dependency maintenance with a small metadata-only diff and successful checks.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored pull request is exempt from the external-contributor runtime-proof gate; exact-head repository CI provides the appropriate validation.

Label justifications:

• P3: This is routine, low-risk dependency maintenance with a small metadata-only diff and successful checks.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored pull request is exempt from the external-contributor runtime-proof gate; exact-head repository CI provides the appropriate validation.

Evidence reviewed

What I checked:

• Current main still uses the old version: The current default branch declares golang.org/x/text v0.38.0, so the requested update is not already implemented. (go.mod:12, d91dcdb22870)
• Runtime dependency surface: The repository directly uses golang.org/x/text/unicode/norm for NFC normalization in synchronized Discord records. (internal/syncer/records.go:12, d91dcdb22870)
• Toolchain compatibility: Both upstream v0.38.0 and v0.40.0 declare Go 1.25.0, which is compatible with the repository's Go 1.26.5 baseline. (go.mod:3, 8d6815b573d5)
• Exact-head validation: All ten reported checks succeeded on the proposed head, including tests, lint, dependency validation, release checks, Docker, CodeQL, and secret scanning. (8d6815b573d5)
• Feature history: The current direct dependency and NFC normalization path trace to the v0.11.5 release commit authored by Peter Steinberger. (internal/syncer/records.go:12, 6dbb9e2c5e8e)

Likely related people:

• Peter Steinberger: Commit 6dbb9e2c5e8eb9fc5ece02f161ffb747686594f8 introduced both the current direct x/text requirement and the NFC normalization path, and the available go.mod history points to the same owner. (role: feature introducer and recent dependency contributor; confidence: high; commits: 6dbb9e2c5e8e, d91dcdb22870; files: go.mod, go.sum, internal/syncer/records.go)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Maintainer verification on exact head 8d6815b573d5b73b52952cfe69938735c3fab8af against current origin/main:

• go mod verify passed: all modules verified.
• GOWORK=off go test ./... passed across all packages.
• Real library example: GOWORK=off go run /private/tmp/discrawl-xtext-proof.go normalized decomposed 65cc81 to NFC c3a9 and reported normalized=true using golang.org/x/text/unicode/norm v0.40.0.
• .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --stream-engine-output reported no accepted/actionable findings (0.99 confidence).
• Existing exact-head hosted checks are green; no source, CLI, or user-visible contract changed, so no changelog entry is needed.

No merge performed; land-ready.

[steipete]

@dependabot rebase