Added
- In-TUI self-update (leader+
U): checks GitHub Releases for a newer version without downloading anything, shows "Update available: vX.Y.Z → vA.B.C" if one exists, and on enter downloads, verifies (against GitHub's own per-asset sha256 digest), and installs it in place of the running binary — then automatically relaunches into it, no manual restart needed. Runs on a background thread so the TUI never freezes on the network call. Verified live end-to-end against the real repo: detects an available update, declines to re-flag when already current, and a full download → verify → install → relaunch round trip that lands on the new version's footer.
Security
git2 bumped 0.19 → 0.21, closing 3 cargo audit "unsound" advisories (Remote::list()/BlameHunk signature/Buf dereference UB) — shiki's code never called any of the affected APIs, but they showed up in every audit regardless while pinned to 0.19. Commit::summary()/Reference::shorthand()/Reference::name()/Remote::url() all changed from Option-returning to Result-returning between these versions; every call site in git.rs was updated to match. ssh/https are now explicit features (git2 0.21's default-features became empty, whereas 0.19 defaulted to them) — without this, SSH remotes and Cred::credential_helper would've silently stopped working. Verified live: full push → remote commit → pull-into-fresh- notebook → note-history round trip against a local bare repo. cargo audit is down to 4 warnings, all transitive via syntect/ratatui and not fixable from shiki's own Cargo.toml..github/workflows/ci.yml now declares permissions: contents: read explicitly instead of inheriting the repo's default token permissions — it only builds/lints, never needs write access.
