pagure is the kind of software that needs an active upstream
for security support (there's even an unfixed CVE right now),
but after Fedora migrated to Forgejo upstream development
seems to have ceased.

pagure upstream has been mostly-dead for a long time: I forwarded my
JavaScript security and pygit 1.16 compatibility patches to them around
18 months ago, and they didn't either accept or reply to them.

pagure has also been removed from testing due to (non-security) RC bugs.

Hence, while I do not like the idea of Debian being without any git
forges (gitlab was removed recently, forgejo isn't packaged yet), I
agree that pagure is not a good choice, and do not object to this
becoming a removal bug.