7.23.0 (2026-09-28) Features auth: allow PKCE public clients without a client secret (#300) (f73c40c), closes #157