v3.0.5

Repair bundled OpenSSL in Unix release archives and avoid unnecessary
repository-history downloads when listing Git-server refs.

Changed

• Update the pinned ngit-grasp integration-test fixture from 3.0.9 to 3.0.10
  so development and Nix CI use the current server release.

Security

• Build downloadable Unix release archives with statically linked OpenSSL 3.5.9
  LTS instead of the 3.6.3 supplied by openssl-src 300.x. This includes the
  crafted-certificate memory allocation fix for Git HTTPS
  (CVE-2026-35189)
  and the other upstream fixes through September 2026. Verify the embedded
  version in packaged binaries before NIP-82 publication. These are upstream
  fixes, not evidence of exploitation against ngit. Source builds using Cargo's
  vendored-openssl feature alone still require a patched external static
  OpenSSL until a compatible fixed openssl-src is available.

Fixed

• List Git-server refs without downloading repository history. Server checks
  previously fetched HEAD from each server into the same object database,
  causing unnecessary transfers and 60-second timeouts when cloning repositories
  such as Amber. Proposal pushes fetch missing destination history explicitly
  when calculating their base. Private-repository HTTP authorization is preserved.