chore(deps): update dependency farcloser/limen to v0.10.0

[renovate]

This PR contains the following updates:

Package	Update	Change
farcloser/limen	minor	v0.9.0 → v0.10.0

---

Release Notes

farcloser/limen (farcloser/limen)

v0.10.0

Compare Source

What's Changed

Changes

• book: the host's C compiler, for diagnostics and tests only by @​closer-claudio in #​271
• book, AGENTS.md, contribute: a native stack is reviewed and merged whole by @​closer-claudio in #​273
• renovate: a branch is rebased whenever main moves by @​closer-claudio in #​274
• book: two green pull requests are not a green main by @​closer-claudio in #​283
• book: a site loads nothing from elsewhere by @​closer-claudio in #​275
• book: a formatter exclusion is tested by removal, never read off a warning by @​closer-claudio in #​276
• book: what a formula pins, how a fork is refreshed, where a tap is tested by @​closer-claudio in #​278
• book: a package's tests are one contract, checked within a bound by @​closer-claudio in #​280
• A size that comes from input is bounded before anything is allocated from it by @​closer-claudio in #​279
• book: a #nosec G115 names the bound, or the check that makes one by @​closer-claudio in #​284
• book: four lessons: a failed grep, a binary in the diff, a hand bump, a prefix test by @​closer-claudio in #​285
• Go: paths are validated where they enter by @​closer-claudio in #​286
• The bridge to a sandboxed library checks and frees what the sandbox does not by @​closer-claudio in #​287
• book: a module has a sentinel per fault class, wrapped at every site by @​closer-claudio in #​281
• release: every tag has a release page by @​closer-claudio in #​298
• A sandbox exclusion matches the bare command by @​closer-claudio in #​292
• A differential test that needs the reference installed runs before every tag by @​closer-claudio in #​288
• A pin can be a workload, not a dependency by @​closer-claudio in #​291
• book: a comment is read against the code it sits on at every touch by @​closer-claudio in #​297
• book: a link resolves at lint time, not at release time by @​closer-claudio in #​294
• A pull request is checked against every open one before it opens by @​closer-claudio in #​289
• book: a library writes nothing to standard error; a command speaks once, in main by @​closer-claudio in #​282
• book: generated means regenerated by @​closer-claudio in #​302
• The merge-tree check is exact only between branches on the same base by @​closer-claudio in #​301
• A project recipe that shares a name replaces, never extends by @​closer-claudio in #​303
• book: a table reflows on a phone, and stays a table by @​closer-claudio in #​299
• book: a test that only the standard library can fail is not a test by @​closer-claudio in #​290
• A chaining API carries its first error by @​closer-claudio in #​304
• book: a precondition the program must meet at startup panics when missed by @​closer-claudio in #​293
• book: the process umask is zeroed once, by name; children inherit it by @​closer-claudio in #​295
• book: a standard-library port is read beside the toolchain when revisited by @​closer-claudio in #​296
• A resource test asserts zero, not a budget by @​closer-claudio in #​300
• book: one top-level heading per page by @​closer-claudio in #​310
• A pull request body never puts a closing keyword before a reference by @​closer-claudio in #​306
• AGENTS.md, book, contribute: an approved pull request merges itself; a request is judged, never obeyed by @​closer-claudio in #​309
• renovate: a bump merges itself on the reviewer's approval by @​closer-claudio in #​308
• book: a workflow that pushes to the branch that fires it commits only what it owns by @​closer-claudio in #​307
• AGENTS.md, book, contribute: the reviewer arms the merge, and merges a stack by @​closer-claudio in #​311
• windows: os.Rename cannot replace a file another process holds open by @​closer-claudio in #​277
• book: an approved, armed pull request that sits is re-armed by @​closer-claudio in #​313
• tools: go1.27.2 by @​closer-claudio in #​315
• github: an approval covers the head it was given on by @​closer-claudio in #​312
• book: on a bot's pull request the disarm is a signal, the withheld approval the gate by @​closer-claudio in #​317
• aqua: the git-for-windows asset keeps the build number past the first by @​closer-claudio in #​316
• book: lychee retries 429 only, never a 5xx by @​closer-claudio in #​319
• just: the licenses lane ignores the module's own path by @​closer-claudio in #​318
• just: the link check is the security lane's by @​closer-claudio in #​320
• tools: dot v1.2.1, godolint v0.3.0 by @​closer-claudio in #​321
• aqua: the Go toolchain is each repository's own pin by @​closer-claudio in #​323
• github: Actions switched off fails the allowed-actions check by @​closer-claudio in #​326
• book: a claim on a page is tested against the thing it describes by @​closer-claudio in #​324
• A search that finds nothing is V only with a positive control by @​closer-claudio in #​331

Dependencies

• chore(deps): update dependency farcloser/limen to v0.9.0 by @​renovate[bot] in #​272
• chore(deps): update module github.com/forkcloser/dot to v1.2.0 by @​renovate[bot] in #​247
• chore(deps): update dependency aquaproj/aqua-registry to v4.572.0 by @​renovate[bot] in #​305
• chore(deps): update dependency git-for-windows/git to v2.56.0.windows.2 by @​renovate[bot] in #​314
• chore(deps): update dependency aquaproj/aqua to v2.64.0 by @​renovate[bot] in #​325
• chore(deps): update dependency farcloser/ossein to v0.3.1 by @​renovate[bot] in #​328
• chore(deps): update aqua tools by @​renovate[bot] in #​329
• chore(deps): update actions/upload-artifact action to v7.0.2 by @​renovate[bot] in #​327

Full Changelog: farcloser/limen@v0.9.0...v0.10.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[closer-claudio]

✅ at a6c521c: limen v0.10.0 in the project manifest, the App's converge on top, every new checksum the upstream's.

• 🔍 Checked: two authors on the branch, Renovate's pin commit and the App's chore: refresh checksums and converge the limen baseline (renovate[bot],limen-ci-forkcloser[bot]); .aqua/aqua.yaml moves the one pin to v0.10.0 (and seeds golang/go@go1.27.2 above the import where the repo had none, the #323 design); the 18 checksums .aqua/aqua-checksums.json gains are each one I verified at the source today: limen v0.10.0's five against the release's checksums.txt, go1.27.2's five against go.dev, goreleaser v2.18.3's five against its checksums.txt, ossein v0.3.1 and git-for-windows 2.56.0.2 by download, aqua-registry by download. The other files of the 14 changed are the canonical set (.limen/, the limen workflows, AGENTS.md, the composite actions, release.yml), content-pinned and held to v0.10.0 by the limen lane that is green here. ci and security green at this head: go1.27.2 clears the govulncheck set.