[dependabot-agent] Dependency update review: charm.land/bubbles/v2 v2.2.0 → v2.2.1 (patch)

[github-actions]

Dependency Release Train Summary — Review Bundle

Target repository: github/gh-aw (analyzed via target/ checkout; this issue is filed in the safe-output repo per review-mode routing)

What changed

• Package/ecosystem: Go module charm.land/bubbles/v2 (gomod, direct dependency)
• Manifest(s): go.mod, go.sum (repo root)
• Old version: v2.2.0
• New version: v2.2.1
• Update type: patch

Why now

• Routine freshness update — a patch release is available for a direct, reachable dependency and no open Dependabot/agent PR currently covers it.

Risk assessment

• Runtime scope: runtime (used only in pkg/console/spinner.go and pkg/console/progress.go, CLI progress/spinner UX — not on auth/crypto/payment/db paths)
• Direct/transitive: direct
• Reachability: confirmed via source imports

Validation

• Commands run: go get charm.land/bubbles/v2@v2.2.1, go build ./pkg/console/..., go test ./pkg/console/..., go mod tidy
• Result: build succeeded; pkg/console package tests passed (ok, 0.151s); resulting go.mod/go.sum diff is minimal (3 lines changed)
• Remaining gaps: full repository test suite was not run (time-bounded validation); only the reachable package was exercised

Review bundle

A review-mode artifact bundle (patch file, changed-files list, validation notes, summary) has been published as a workflow artifact via publish_review_bundle (bundle name bubbles-v2-patch), since this run operates in review safe-output mode and cannot open a live PR directly against github/gh-aw. A human reviewer can download the artifact, apply bubbles-update.patch, and open a real PR against github/gh-aw if desired.

Smart-Dependabot-Merge-Candidate: yes

Control Plane

• Correlation ID: 32890472787-7
• Central repo: githubnext/gh-aw-central-agentic-ops
• Run URL: https://github.com/githubnext/gh-aw-central-agentic-ops/actions/runs/32890472787

Generated by Dependabot / Release Train Updater · auto · 47.8 AIC · ⌖ 8.52 AIC · ⊞ 18.9K · ◷

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/central-agentic-ops/.github/workflows/dependabot-release-train-updater.md@main

• expires on Sep 8, 2026, 7:48 PM UTC