pagure upstream has been mostly-dead for a long time: I forwarded my
JavaScript security and pygit 1.16 compatibility patches to them around
18 months ago, and they didn't either accept or reply to them.
pagure has also been removed from testing due to (non-security) RC bugs.
Hence, while I do not like the idea of Debian being without any git
forges (gitlab was removed recently, forgejo isn't packaged yet), I
agree that pagure is not a good choice, and do not object to this
becoming a removal bug.
