chore(deps): update Go dependencies and bump to 2.6.3

[jmrplens]

Summary

Updates every outdated Go module and bumps the project version to 2.6.3.

Dependency updates

Direct:

Module	From	To
charm.land/lipgloss/v2	v2.0.5	v2.0.6
golang.org/x/crypto	v0.54.0	v0.55.0

Indirect: charmbracelet/ultraviolet, charmbracelet/x/ansi v0.11.8, charmbracelet/x/exp/golden, dlclark/regexp2/v2 v2.6.0, lufia/plan9stats, power-devops/perfstat, xo/terminfo v1.0.0, golang.org/x/mod v0.39.0, golang.org/x/exp, rogpeppe/go-internal v1.16.0.

After the update, every module required by go.mod is at its latest version. The remaining entries go list -u -m all reports (protobuf, cel-go, x/net, graphql-go, goldmark, …) belong to dependencies' own test graphs and are not required by this module.

Version bump

VERSION, CLAUDE.md, .plugin/plugin.json, mcpb/manifest.json, lhm.plugin.json → 2.6.3. server.json intentionally keeps 2.6.2 until the release workflow stamps it together with the real GoReleaser checksums.

Regenerated derived artifacts: llms files, README stats, token footprint, site stats, action catalog manifest, LobeHub capability arrays.

Also

Removes an unnecessary variable declaration in a dynamic-registry test condition (SonarCloud godre:S8193).

Verification

• go build ./..., full go test ./internal/..., e2e compile-only: clean
• make govulncheck: PASS — only the accepted GO-2026-5932 advisory (openpgp via go-selfupdate), unchanged by this update
• make audit-1to1: 0 gaps
• All freshness gates green: check-llms, check-stats, check-footprint, check-action-catalog-manifest, check-lhm-manifest, check-site-stats, check-mcpb, check-server-json, check-openplugin, check-doc-links, gen-testing-docs --check
• make analyze-fix applied

Summary by Sourcery

Update Go dependencies to their latest compatible versions and bump the project version to 2.6.3, refreshing all derived manifests and stats accordingly.

Enhancements:

• Upgrade direct and indirect Go modules, including lipgloss, golang.org/x/crypto, and related charmbracelet and x/* packages to current releases.
• Regenerate derived artifacts and manifests (LLM capability lists, stats, action catalog and plugin manifests) to reflect the new version and dependency graph.
• Simplify a dynamic registry test by removing an unnecessary variable assignment.

Build:

• Update VERSION and plugin/manifest version fields from 2.6.2 to 2.6.3 while keeping server.json on 2.6.2 for release-time stamping.

Summary by Bito

• Bumped project version from 2.6.2 to 2.6.3.
• Updated several Go dependencies, including lipgloss, crypto, and various charmbracelet packages.
• Updated documentation and manifest files to reflect the new version.

[sourcery-ai]

Sorry @jmrplens, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Warning

Review limit reached

@jmrplens, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 96c592ba-60fa-411e-931d-b6b56b4a5407

📥 Commits

Reviewing files that changed from the base of the PR and between 435a4ed and 9d07aa9.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (14)

• .plugin/plugin.json
• CLAUDE.md
• VERSION
• go.mod
• internal/tools/dynamic/register_test.go
• lhm.plugin.json
• llms-full-individual-tools.txt
• llms-full-meta-tools.txt
• llms-full-resources-prompts.txt
• llms-full.txt
• llms-medium.txt
• llms.txt
• mcpb/manifest.json
• site/src/data/stats.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates all out-of-date Go dependencies to their latest versions, bumps the project version to 2.6.3 across metadata and generated artifacts, and applies a minor test cleanup to satisfy static analysis.

File-Level Changes

Change	Details	Files
Updated Go module dependencies to latest compatible versions and refreshed go.sum.	Bumped charm.land/lipgloss/v2 from v2.0.5 to v2.0.6. Bumped golang.org/x/crypto from v0.54.0 to v0.55.0. Updated multiple indirect dependencies (charmbracelet/ultraviolet, charmbracelet/x/ansi, charmbracelet/x/exp/golden, dlclark/regexp2/v2, lufia/plan9stats, power-devops/perfstat, rogpeppe/go-internal, golang.org/x/exp, golang.org/x/mod, xo/terminfo, etc.) to current versions. Regenerated go.sum to match the updated module graph.	go.mod go.sum
Bumped the project/version metadata to 2.6.3 and regenerated derived capability and stats artifacts.	Updated human-facing version references from 2.6.2 to 2.6.3 in docs and manifests. Kept server.json at 2.6.2 as intended for release workflow stamping. Regenerated LLMS configuration text files, README/site stats, token footprint, action catalog manifest, and related capability arrays to reflect the new build state.	CLAUDE.md VERSION .plugin/plugin.json mcpb/manifest.json lhm.plugin.json llms-full-individual-tools.txt llms-full-meta-tools.txt llms-full-resources-prompts.txt llms-full.txt llms-medium.txt llms.txt site/src/data/stats.json
Simplified a dynamic registry test assertion by removing an unnecessary local variable.	Inlined the scoreCompareRefsIntentValue call directly into the test condition to address SonarCloud rule godre:S8193.	internal/tools/dynamic/register_test.go

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud