chore: prepare discrawl 0.15.7 release

[steipete]

Prepare Discrawl 0.15.7 with the Go 1.27.2 standard-library security fixes and gRPC xDS denial-of-service fix first in the release notes. The five existing unreleased bullets are preserved verbatim, including contributor credit, and the empty Unreleased section is retained for subsequent work.

This is a patch release: the pending changes only refresh dependencies, security fixes, CI, and review tooling; there are no new commands or flags.

Validation: default-branch CI passed at 045077f; the changelog bullet multiset and removed/re-added bullet lines match exactly; git diff --check passed; Codex autoreview found no P0–P3 issues. Publication follows docs/RELEASING.md through the unified release workflow after exact-head CI passes.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR groups five existing changelog bullets under a dated 0.15.7 release section and highlights the security fixes.

Example: A reader checks which changes belong to Discrawl 0.15.7.

• Before: Go 1.27.2 and gRPC 1.83.2 security updates appear under Unreleased.
• After: Those updates lead the 0.15.7 section dated 2026-10-11, while an empty Unreleased section remains.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct release-documentation patch supported by the release contract and prior merged precedent.
Proof confidence	🌊 off-meta tidepool	Not applicable: This docs-only PR is verified by its source diff; it changes no runtime behavior requiring live proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Docs · Worth it: Yes · Fix scope: Complete
User problem: Readers need the pending maintenance and security changes identified as the contents of release 0.15.7.
Reason: The supplied maintainer-authored direction matches the release contract and preserves the existing notes without expanding scope.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it prepares the next release as documented, preserves the existing release notes, and introduces no actionable defect; the dated section is absent from current main.

Priority: P3
Reviewed head: 6e07c7b2f6c8c1f2c56360c02a24e609c7eb5dab

Before merge

None.

Findings

None.

Agent review details

How this fits together

The changelog describes merged changes for readers and ships inside release archives; release operators prepare its dated section before publishing through the existing unified workflow.

flowchart TD
  A[Merged changes] --> B[Unreleased changelog]
  B --> C[Dated release section]
  C --> D[Protected main]
  D --> E[Unified release workflow]
  E --> F[Release archives and notes]

Loading

Technical review

Best possible solution:

Land the dated changelog section once the existing checks pass, then publish through the documented unified release workflow.

Do we have a high-confidence way to reproduce the issue?

This is release preparation rather than a bug report; the pinned diff directly establishes the requested changelog change.

Is this the best way to solve the issue?

The focused changelog change follows the documented release process and the previous release's merged preparation pattern.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against 045077fc8e6a.

Provenance checked

• Existing Unreleased dependency notes keeps the original intent (build(deps): patch gRPC and refresh workflow actions #276: Record the merged gRPC security update and workflow dependency refresh while retaining contributor credit.)
• Existing Go security note keeps the original intent (build(deps): refresh Go dependencies and patched toolchains #273: Record the patched Go toolchain and compatible dependency updates before release.)

Security

None.

Evidence

What I checked:

• Verified introduced diff: Only CHANGELOG.md changes: all five existing bullets and contributor credits remain intact, with a dated heading, a security highlight, and reordered bullets. (CHANGELOG.md:5, 6e07c7b2f6c8)
• Release preparation contract: The release documentation requires preparing a dated changelog section and landing it on protected main before dispatching the unified workflow. (docs/RELEASING.md:26, 045077fc8e6a)
• Underlying changes already merged: build(deps): refresh Go dependencies and patched toolchains #273 records the Go security updates, and build(deps): patch gRPC and refresh workflow actions #276 records the gRPC update; current go.mod selects Go 1.27.2 and gRPC 1.83.2. (go.mod:5, 045077fc8e6a)
• Established release precedent: chore: prepare discrawl 0.15.6 release #266 used the same dated-section preparation, retained an empty Unreleased section, and was merged by steipete. (CHANGELOG.md:11, cd7fa1ce5eb7)
• Current main and release state: GitHub still reports main at the pinned base, whose changelog has no 0.15.7 section; the latest published release is v0.15.6. (CHANGELOG.md:3, 045077fc8e6a)
• Discussion and checks: The full body and both comments contain no additional requested behavior; exact-head checks include successful docs validation and several checks still running, with no reported failure. (6e07c7b2f6c8)

Likely related people:

• Peter Steinberger: Raw commit cd7fa1c adds CHANGELOG.md:5 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: cd7fa1ce5eb7; files: CHANGELOG.md)

Labels

Label changes:

• add P3: The introduced change is low-risk release documentation; the security fixes themselves are already merged.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: The introduced change is low-risk release documentation; the security fixes themselves are already merged.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 11, 2026, 1:58 PM ET / 17:58 UTC.