fix(deps): update module github.com/charmbracelet/bubbles to v0.21.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/charmbracelet/bubbles	v0.21.1-0.20250623103423-23b8fd6302d7 → v0.21.1

---

Release Notes

charmbracelet/bubbles (github.com/charmbracelet/bubbles)

v0.21.1

Compare Source

Changelog

New!

• dff42dd: feat: update keybindings in list setSize method (@​Broderick-Westrope)

Fixed

• c376ce3: fix(cursor): fix data race on blinkTag (#​784) (@​DryHumour)
• 11d52ca: fix(table): preventing cursor from being out-of-bounds. (@​s0ders)
• 49ff5c0: fix(textinput): improve placeholder (#​768) (@​caarlos0)
• 7c44f63: v1: fix(list): ensure correct cursor positions with page/cursor methods (#​831) (@​lrstanley)

Docs

• 7fcf75d: docs(readme): update footer image and copyright date (@​meowgorithm)
• d4feefe: docs: remove Charm Cloud reference (#​785) (@​ShalokShalom)

Other stuff

• daab808: ci: sync dependabot config (#​786) (@​charmcli)
• 4b2d311: ci: sync dependabot config (#​835) (@​charmcli)
• 8562e90: ci: sync golangci-lint config (#​781) (@​github-actions[bot])
• f54a125: test(table): improve table unit tests (#​601) (@​Broderick-Westrope)

---

Thoughts? Questions? We love hearing from you. Feel free to reach out on X, Discord, Slack, The Fediverse, Bluesky.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
github.com/charmbracelet/bubbletea	v1.3.6 -> v1.3.10
github.com/charmbracelet/colorprofile	v0.2.3-0.20250311203215-f60798e515dc -> v0.4.1
github.com/charmbracelet/x/ansi	v0.9.3 -> v0.11.5
github.com/charmbracelet/x/cellbuf	v0.0.13 -> v0.0.15
github.com/charmbracelet/x/term	v0.2.1 -> v0.2.2
github.com/lucasb-eyer/go-colorful	v1.2.0 -> v1.3.0
github.com/mattn/go-runewidth	v0.0.16 -> v0.0.19
golang.org/x/sys	v0.33.0 -> v0.38.0

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​charmbracelet/​bubbles@​v0.21.1-0.20250623103423-23b8fd6302d7 ⏵ v0.21.1	+1

View full report

[claude]

Claude finished @renovate[bot]'s task in 48s —— View job

---

Code Review

• Gather context
• Review go.mod changes
• Check CI status
• Post review findings

---

Summary

This is a routine dependency update — safe to merge. Updating charmbracelet/bubbles from a pre-release pseudo-version to the stable v0.21.1 tag is a net improvement.

Dependency Analysis

Primary update (go.mod:4):

• charmbracelet/bubbles: pre-release commit snapshot → stable v0.21.1
  • Fixes a data race on cursor blink (c376ce3)
  • Fixes table cursor out-of-bounds bug
  • Fixes textinput placeholder rendering
  • Fixes list cursor positions with page/cursor methods

Transitive updates — all moving from pre-release or older stable to newer stable releases:

• bubbletea: v1.3.6 → v1.3.10
• colorprofile: pre-release → v0.4.1 (pre-release → stable, good)
• x/ansi: v0.9.3 → v0.11.5
• x/cellbuf: v0.0.13 → v0.0.15
• x/term: v0.2.1 → v0.2.2
• go-colorful: v1.2.0 → v1.3.0
• go-runewidth: v0.0.16 → v0.0.19
• golang.org/x/sys: v0.33.0 → v0.38.0

New indirect dependencies (go.mod:39-41):

• clipperhouse/displaywidth v0.9.0
• clipperhouse/stringish v0.1.1
• clipperhouse/uax29/v2 v2.5.0 — Unicode text segmentation, pulled in by the updated TUI stack

Removed (go.mod:52-53): golang.org/x/sync — no longer required by the updated dep tree.

Security

Socket Security scanned the direct dependency update and returned 100/100 across all categories (supply chain, vulnerability, quality, maintenance, license). No concerns.

CI Status

The main CI workflow is currently in progress. No failures on application code.

Verdict

No issues found. This is a clean update from a pre-release snapshot to a stable tagged release. The new clipperhouse/* transitives are well-maintained Unicode handling utilities. The data race fix in the cursor component is a meaningful improvement.