ngit-cli 3.0.3

Fix proposal base selection for PR pushes and draft patches, refresh dependencies, and clarify agent guidance for repository data refreshes.

Changed

• Refresh Rust dependencies and the lockfile, including Nostr SDK 0.45.4,

Reqwest 0.13.5, Rustls 0.23.45, apk-info 1.0.13, mailparse 0.17.0, keyring 4.2.0, and the test harness dependencies. Relevant upstream fixes:

• Rustls rejects TLS 1.3 handshake messages received at the wrong encryption

level (GHSA-2mjx-qc3c-rqvc).

• Reqwest selects the correct credentials when multiple proxies match a URL

and recognizes timeouts wrapped in response-body decoding errors (release notes).

• APK analysis can continue when the resource table is corrupt, resolves

sparse resource entries correctly, and reads ZIP entries lazily to reduce memory use with large archives (release notes).

• The Nostr SDK's local relay, used by the test harness, closes subscriptions

when their live-event buffer overflows so clients can detect missing events (crate changelog).

• Clarify the agent skill's shared repository-data refresh behavior across git

and ngit commands, and when to reuse cached data with --offline to avoid redundant relay fetching.

Fixed

• Fix PR pushes when changes are already on your local default branch or

another remote but have not been accepted by the Nostr destination. A PR that points to the same commit as local main or master works too.

• Support maintainers who build PRs on a newer local default branch. For a new

PR sharing local commits that have not been published to Nostr, explain how -o base=<commit-or-ref> chooses where the proposed changes start. Earlier commits remain in Git history. Local changes outside the PR need no confirmation.

• Keep ngit send working for drafts made directly on main or master.

Rejection messages explain how --base <commit-or-ref> lets you choose which earlier commits to exclude. Remote names such as origin or github do not establish ownership or accepted history.