dfetch: all versions and old releases

Release 0.14.4 (released 2026-08-28)
- Fix SVN commands raising UnicodeDecodeError on non-UTF-8 output (#1383)
- Fix a gitlink with no .gitmodules entry aborting fetches outside src (#1380)

Release 0.14.3 (released 2026-06-25)
- Update dfetch environment to show newer version inline (#1310)

Release 0.14.2 (released 2026-06-21)
- Fix git auth/redirect errors being silently misidentified as non-git (#1138)
- Fix WinGet publish workflow blocked on static.crates.io and objects.githubusercontent.com egress endpoints (#1298)

Release 0.14.1 (released 2026-06-19)
- Implement C-043: add pip-audit OSV gate to the release workflow
- Add CRA Compliance: OSCAL 1.2.2 Component Definition
- Fix dfetch import mangling the namespace of a generic VCS URL whose path contains .git (#1268)
- Fix Version comparison raising AttributeError when compared against a non-Version object (#1268)
- Fix dfetch add matching remote whose base URL is only string (not path) prefix of the project URL (#1268)
- Fix git ref resolution spuriously matching the first reference for an empty revision (#1268)
- Strip the trailing newline from the git origin URL returned by get_remote_url (#1268)

Release 0.14.0 (released 2026-06-14)
- Update Winget manifest to the Windows Package Manager Community Repository on new release (#1263)
- Check for new dfetch version during dfetch check & dfetch environment (#1262)
- Respect the superproject's line-ending preference (#1260)
- Strip user:password@ userinfo before storing metadata (#1206)
- Warn when a project URL uses a plaintext transport scheme (#1229)
- Documentation and threat-model clarifications for existing release attestation support (#1208)
- Report SVN externals fetched during update (#1220)
- Use .cdx.json as the default extension for CycloneDX SBOM reports (#1118)
- Embed base64-encoded license text in SBOM licenses[].text when a license is successfully identified (#1112)
- Set SBOM licenses to the SPDX expression NOASSERTION when a license file is not found or cannot be classified (#1112)
- Add a dfetch:license:finding property to SBOM when NOASSERTION is set, explaining the reason (#1112)
- Add dfetch:license:threshold and dfetch:license:tool SBOM properties (#1116)
- Add dfetch:license:<spdx-id>:confidence SBOM property for per-licence confidence scores (#1116)
- Use github purl, repo and version for a github release archive in SBOM (#1063)
- Allow dfetch freeze to accept project names to freeze only specific projects (#1063)
- Edit manifest in-place when freezing inside a git or SVN superproject, preserving comments and layout (#1063)
- Add new remove command to remove projects from manifest and disk (#26)
- Fix "unsafe symlink target" error for archives containing relative .. symlinks (#1122)
- Print runtime errors (e.g. svn not available on system) directly in context of the failing subproject instead of collecting and showing them at the end (#1096)
- Fix dfetch add crashing with a ValueError when the remote URL has a trailing slash (#1137)
- Fix unhelpful error message when a metadata file is malformed (#1145)
- Fix arbitrary file write via malicious tar/zip symlink (#1152)
- Prevent SSH command injection (#1152)
- Allow manifests with no projects key so dfetch add can bootstrap empty manifest (#1197)
- Fix ValueError when generating a PackageURL (e.g. for an SBOM) from an empty or path-only remote URL
- Fix SSH shorthand URLs (git@host:path) being incorrectly joined with / when used as url-base with repo-path (#1247)
- Run svn+ssh:// connections in non-interactive mode to prevent hanging (#1230)