[1.0.0] Update forgejo to 14.0.3 Full Changelog fix: PKCE challenges to Forgejo's OAuth identity provider were not validated when using the S256 algorithm fix: Forgejo supports using an OAuth Bearer token with HTTP basic authentication, rather than Bearer token authentication, but did not properly apply the limited scopes of the OAuth grant fix: missing permission checks in attachment-related web endpoints allowed modifying attachments that a user did not own fix: email notifications for new releases could be sent to users that no longer access to the repository, or to inactive users