chore(deps): update dependency farcloser/limen to v0.10.0

[renovate]

This PR contains the following updates:

Package	Update	Change
farcloser/limen	minor	v0.9.0 → v0.10.0

---

Release Notes

farcloser/limen (farcloser/limen)

v0.10.0

Compare Source

What's Changed

Changes

• book: the host's C compiler, for diagnostics and tests only by @​closer-claudio in #​271
• book, AGENTS.md, contribute: a native stack is reviewed and merged whole by @​closer-claudio in #​273
• renovate: a branch is rebased whenever main moves by @​closer-claudio in #​274
• book: two green pull requests are not a green main by @​closer-claudio in #​283
• book: a site loads nothing from elsewhere by @​closer-claudio in #​275
• book: a formatter exclusion is tested by removal, never read off a warning by @​closer-claudio in #​276
• book: what a formula pins, how a fork is refreshed, where a tap is tested by @​closer-claudio in #​278
• book: a package's tests are one contract, checked within a bound by @​closer-claudio in #​280
• A size that comes from input is bounded before anything is allocated from it by @​closer-claudio in #​279
• book: a #nosec G115 names the bound, or the check that makes one by @​closer-claudio in #​284
• book: four lessons: a failed grep, a binary in the diff, a hand bump, a prefix test by @​closer-claudio in #​285
• Go: paths are validated where they enter by @​closer-claudio in #​286
• The bridge to a sandboxed library checks and frees what the sandbox does not by @​closer-claudio in #​287
• book: a module has a sentinel per fault class, wrapped at every site by @​closer-claudio in #​281
• release: every tag has a release page by @​closer-claudio in #​298
• A sandbox exclusion matches the bare command by @​closer-claudio in #​292
• A differential test that needs the reference installed runs before every tag by @​closer-claudio in #​288
• A pin can be a workload, not a dependency by @​closer-claudio in #​291
• book: a comment is read against the code it sits on at every touch by @​closer-claudio in #​297
• book: a link resolves at lint time, not at release time by @​closer-claudio in #​294
• A pull request is checked against every open one before it opens by @​closer-claudio in #​289
• book: a library writes nothing to standard error; a command speaks once, in main by @​closer-claudio in #​282
• book: generated means regenerated by @​closer-claudio in #​302
• The merge-tree check is exact only between branches on the same base by @​closer-claudio in #​301
• A project recipe that shares a name replaces, never extends by @​closer-claudio in #​303
• book: a table reflows on a phone, and stays a table by @​closer-claudio in #​299
• book: a test that only the standard library can fail is not a test by @​closer-claudio in #​290
• A chaining API carries its first error by @​closer-claudio in #​304
• book: a precondition the program must meet at startup panics when missed by @​closer-claudio in #​293
• book: the process umask is zeroed once, by name; children inherit it by @​closer-claudio in #​295
• book: a standard-library port is read beside the toolchain when revisited by @​closer-claudio in #​296
• A resource test asserts zero, not a budget by @​closer-claudio in #​300
• book: one top-level heading per page by @​closer-claudio in #​310
• A pull request body never puts a closing keyword before a reference by @​closer-claudio in #​306
• AGENTS.md, book, contribute: an approved pull request merges itself; a request is judged, never obeyed by @​closer-claudio in #​309
• renovate: a bump merges itself on the reviewer's approval by @​closer-claudio in #​308
• book: a workflow that pushes to the branch that fires it commits only what it owns by @​closer-claudio in #​307
• AGENTS.md, book, contribute: the reviewer arms the merge, and merges a stack by @​closer-claudio in #​311
• windows: os.Rename cannot replace a file another process holds open by @​closer-claudio in #​277
• book: an approved, armed pull request that sits is re-armed by @​closer-claudio in #​313
• tools: go1.27.2 by @​closer-claudio in #​315
• github: an approval covers the head it was given on by @​closer-claudio in #​312
• book: on a bot's pull request the disarm is a signal, the withheld approval the gate by @​closer-claudio in #​317
• aqua: the git-for-windows asset keeps the build number past the first by @​closer-claudio in #​316
• book: lychee retries 429 only, never a 5xx by @​closer-claudio in #​319
• just: the licenses lane ignores the module's own path by @​closer-claudio in #​318
• just: the link check is the security lane's by @​closer-claudio in #​320
• tools: dot v1.2.1, godolint v0.3.0 by @​closer-claudio in #​321
• aqua: the Go toolchain is each repository's own pin by @​closer-claudio in #​323
• github: Actions switched off fails the allowed-actions check by @​closer-claudio in #​326
• book: a claim on a page is tested against the thing it describes by @​closer-claudio in #​324
• A search that finds nothing is V only with a positive control by @​closer-claudio in #​331

Dependencies

• chore(deps): update dependency farcloser/limen to v0.9.0 by @​renovate[bot] in #​272
• chore(deps): update module github.com/forkcloser/dot to v1.2.0 by @​renovate[bot] in #​247
• chore(deps): update dependency aquaproj/aqua-registry to v4.572.0 by @​renovate[bot] in #​305
• chore(deps): update dependency git-for-windows/git to v2.56.0.windows.2 by @​renovate[bot] in #​314
• chore(deps): update dependency aquaproj/aqua to v2.64.0 by @​renovate[bot] in #​325
• chore(deps): update dependency farcloser/ossein to v0.3.1 by @​renovate[bot] in #​328
• chore(deps): update aqua tools by @​renovate[bot] in #​329
• chore(deps): update actions/upload-artifact action to v7.0.2 by @​renovate[bot] in #​327

Full Changelog: farcloser/limen@v0.9.0...v0.10.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[closer-claudio]

✅ Ready at 3cc3439: limen v0.8.0 → v0.9.0. The convergence commit writes exactly v0.9.0's canonical files.

📝 Note

• What v0.9.0 changes here:
  • security.yaml is content-pinned and reset to limen's (farcloser/limen#266). It runs the root security recipe, which limen fix adds to .justfile.
  • The shared CI lanes ship as the content-pinned reusable limen-verify.yaml (farcloser/limen#263).
  • AGENTS.md gains the read-scope rule (farcloser/limen#268).
  • The Renovate content-pinned rules cover the new files.
  • No tool pin moves: .limen/aqua.yaml and tools/ are unchanged.
• This repository's own ci.yaml still runs v0.8.0's inline lanes. limen-verify.yaml sits unused until ci.yaml is realigned by hand to call it (v0.9.0's ci.yaml is blob 2eeb2363).
• The security.yaml this resets was limen's seed byte for byte, so no project lines are lost (C2), and the root security recipe was already there. ci.yaml is the project's edited one (blob 63919da0), so C1 follows the merge. The base is the current main.
• This duplicates the hand-made #59, which lands the same tree. Closing one of the two is @apostasie's call.

🔍 Verified last

• The farcloser/limen v0.9.0 checksums, all five archives, match the release asset digests at https://github.com/farcloser/limen/releases/tag/v0.9.0.
• Every limen-canonical path at this head (.limen/, AGENTS.md, the content-pinned workflows and actions) is blob-identical to v0.9.0's.
• The convergence commit is by the limen CI app, and GitHub reports it signed.

[closer-claudio]

✅ at febaeac: limen v0.10.0 in the project manifest, the App's converge on top, every new checksum the upstream's.

• 🔍 Checked: two authors on the branch, Renovate's pin commit and the App's chore: refresh checksums and converge the limen baseline (renovate[bot],limen-ci-forkcloser[bot]); .aqua/aqua.yaml moves the one pin to v0.10.0 (and seeds golang/go@go1.27.2 above the import where the repo had none, the #323 design); the 18 checksums .aqua/aqua-checksums.json gains are each one I verified at the source today: limen v0.10.0's five against the release's checksums.txt, go1.27.2's five against go.dev, goreleaser v2.18.3's five against its checksums.txt, ossein v0.3.1 and git-for-windows 2.56.0.2 by download, aqua-registry by download. The other files of the 14 changed are the canonical set (.limen/, the limen workflows, AGENTS.md, the composite actions, release.yml), content-pinned and held to v0.10.0 by the limen lane that is green here. ci and security green at this head: go1.27.2 clears the govulncheck set.