diff --git a/release-notes-published/10.0.3.md b/release-notes-published/10.0.3.md
new file mode 100644
index 0000000000..16c6ad872b
--- /dev/null
+++ b/release-notes-published/10.0.3.md
@@ -0,0 +1,13 @@
+
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7295) ([backported](https://codeberg.org/forgejo/forgejo/pulls/7306)): <!--number 7306 --><!--line 0 --><!--description Zml4OiB1c2UgY29ycmVjdCBpbnB1dCBmb3Igc3RyaXAgc2xhc2hlcyBtaWRkbGV3YXJl-->fixes a [regression introduced in Forgejo v10.0.2](https://codeberg.org/forgejo/forgejo/pulls/6866/files) which caused unnecessary escaping of URLs. The symptoms were, for instance, a [failure to access theme files when they contain a space](https://codeberg.org/forgejo/forgejo/issues/7294) or [double escaping of links](https://codeberg.org/forgejo/forgejo/issues/7292).<!--description-->
+- Included for completeness but not worth a release note
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7304): <!--number 7304 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvb2F1dGgyIHRvIHYwLjI3LjAgW1NFQ1VSSVRZXSAodjEwLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/oauth2 to v0.27.0<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7303): <!--number 7303 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjM2LjAgW1NFQ1VSSVRZXSAodjEwLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.36.0<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7302): <!--number 7302 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZy1qd3Qvand0L3Y1IHRvIHY1LjIuMiBbU0VDVVJJVFldICh2MTAuMC9mb3JnZWpvKQ==-->Update module github.com/golang-jwt/jwt/v5 to v5.2.2<!--description-->
+<!--end release-notes-assistant-->