Mailman 3 - Mailman-announce

New year releases!
by Abhilash Raj 04 Jan '23

04 Jan '23

Hello Everyone, Happy new year! I am pleased to announce several new releases for GNU Mailman project. 1. Mailman Core 3.3.8 [1] 2. Postorius 1.3.8 [2] 3. Hyperkitty 1.3.7 [3] 4. Mailmanclient 3.3.5 [4] 5. Django-mailman3 1.3.9 [5] 6. Mailman-hyperkitty 1.2.1 [6] All the releases are published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ A full list of change logs are available below: [1]: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… [2]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-8 [3]: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-7 [4]: https://docs.mailman3.org/projects/mailmanclient/en/latest/src/mailmanclien… [5]: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst [6]: https://gitlab.com/mailman/mailman-hyperkitty/-/blob/master/README.rst Finally, the minimum Python version required is 3.7, and all the components now support Python 3.7 to 3.11. Thanks to all the contributors for making this release possible! If you find any issues, you can report them at the respective bug tracker for the projects. The links to issue trackers are available here: https://docs.mailman3.org/en/latest/ Installation documentation is available at https://docs.mailman3.org/en/latest/install/install.html and if you are upgrading an existing virtualenv install you can refer https://docs.mailman3.org/en/latest/upgrade-3.2.html -- thanks, Abhilash Raj (maxking)

1 0

New Mailman Core Release
by Mark Sapiro 14 Nov '22

14 Nov '22

We are pleased to announce the release of Mailman core 3.3.7. It is published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ The change log is at https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… - please note the `BREAKING CHANGE` documented there and due to our now using SQLAlchemy >-1.4. Finally, the minimum Python version required is 3.7 although, 3.9 is recommended if you are doing a new install for longest support. 3.10 is supported for Django apps, but Mailman Core is missing that due to one of the core dependencies (aiosmtpd) not supporting 3.10 yet. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

New Mailman Releases
by Abhilash Raj 26 Oct '22

26 Oct '22

Hi, I am pleased to announce several new releases for GNU Mailman project. 1. Mailman Core 3.3.6 [1] 2. Postorius 1.3.7 [2] 3. Hyperkitty 1.3.6 [3] 4. Mailmanclient 3.3.4 [4] 5. Django-mailman3 1.3.8 [5] All the releases are published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ A full list of changelogs are available below: [1]: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… [2]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#section-2 -- Something weird is going on with the page missing the bullets. [3]: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-6 [4]: https://docs.mailman3.org/projects/mailmanclient/en/latest/src/mailmanclien… [5]: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst Finally, the minimum Python version required is 3.7 although, 3.9 is recommended if you are doing a new install for longest support. 3.10 is supported for Django apps, but Mailman Core is missing that due to one of the core dependencies not support 3.10 yet (aiosmtpd). Thanks to all the contributors for making this release possible and apologies on my end for delayed releases. If you find any issues, you can report them at the respective bug tracker for the projects. The links to issue trackers are available here: https://docs.mailman3.org/en/latest/ -- thanks, Abhilash Raj (maxking)

1 0

Mailman 2.1.39 Release
by Mark Sapiro 13 Dec '21

13 Dec '21

I am pleased to announce the release of Mailman 2.1.39. This is a bug fix release. It fixes https://bugs.launchpad.net/mailman/+bug/1954694 This addresses two issues. The fix for CVE-2021-42097 was case sensitive and should not be. The fix for CVE-2021-44227 introduced a potential NameError in logging. This could cause a user's changes to the option's page to not be accepted and perhaps cause a `We hit a bug` response if the user visited the page with a mixed- or upper-case email address For those who just want a patch one is attached to the bug report. As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following: i18n updates. security issues. bugs affecting operation for which no satisfactory workaround exists. Mailman 2.1.39 is the ninth such patch release. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ Mailman 2.1.39 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Mailman 2.1.38 security release
by Mark Sapiro 30 Nov '21

30 Nov '21

A CSRF vulnerability has been reported by Riccardo Schirone of RedHat. This is assigned CVE-2021-44227. I plan to release Mailman 2.1.38 on Tuesday, 30 November to fix this. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 1

Mailman 2.1 security release
by Mark Sapiro 12 Nov '21

12 Nov '21

I am pleased to announce the release of Mailman 2.1.36. This is a security release. It fixes https://bugs.launchpad.net/mailman/+bug/1949401 CVE-2021-43331 and https://bugs.launchpad.net/mailman/+bug/1949403 CVE-2021-43332. The former of these could allow an XSS attack against the user options page and the latter could allow a list moderator to discover the list admin password via a brute force attack against the admindb page CSRF token. For those who just want a patch for the security issues, patches are atteched. As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following: i18n updates. security issues. bugs affecting operation for which no satisfactory workaround exists. Mailman 2.1.36 is the sixth such patch release. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ Mailman 2.1.36 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 2

Mailman 2.1 security release
by Mark Sapiro 06 Nov '21

06 Nov '21

Two new security issues have been reported in Mailman 2.1. These have been given the IDs CVE-2021-43331 and CVE-2021-43332. I plan to release 2.1.36 with full details this Friday, November 12. At that time the vulnerabilities will be made public and patches will also be made available. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Mailman 2.1 security release
by Mark Sapiro 20 Oct '21

20 Oct '21

A couple of vulnerabilities have recently been reported. Thanks to Andre Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and helping with the development of a fix. CVE-2021-42096 could allow a list member to discover the list admin password. CVE-2021-42097 could allow a list member to create a successful CSRF attack against another list member enabling takeover of the members account. These attacks can't be carried out by non-members so may not be of concern for sites with only trusted list members. In any case, I am planning to make a 2.1.35 release and to post a patch for those who don't want to upgrade to address these issues. This is scheduled for Tuesday, October 19. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 3

Hyperkitty and mailman-hyperkitty releases
by Abhilash Raj 12 Oct '21

12 Oct '21

Hello Everyone, I have just tagged and released Hyperkitty 1.3.5 and mailman-hyperkitty plugin 1.2.0 to PyPI. This release includes some changes in the authentication between mailman-hyperkitty plugin and Hyperkitty. For that reason, it is important to upgrade both Hyperkitty and mailman-hyperkitty plugin to the latest versions, or it could result in a broken installation. This release of Hyperkitty has bugfixes, some new features and some security enhancements. A full list of changes is available at: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-5 The release tarball is available at PyPI: https://pypi.org/project/HyperKitty/#files https://pypi.org/project/mailman-hyperkitty/#files You can upgrade your installations by running: pip install mailman-hyperkitty hyperkitty -U After the upgrade, please make sure to run these commands: https://docs.mailman3.org/en/latest/upgrade-3.2.html#post-upgrade Also, make sure to restart Mailman Core after upgrading mailman-hyperkitty plugin. Finally, many thanks to all the people who contributed to this release. -- thanks, Abhilash Raj (maxking)

1 0

Ann: Postorius 1.3.6b1 is now out
by Abhilash Raj 28 Sep '21

28 Sep '21

Hey Everyone, I am pleased to announce that Postorius 1.3.6b1 is now out. This is the first pre-release for 1.3.6, which is slated to release next week soon after Mailman Core 3.3.5 release. This release requires Mailman Core 3.3.5 release, so if you are trying out this release, please also upgrade Mailman Core to 3.3.5rc1 (which was just released today). This release includes several new features and bug fixes. A full list of changes is available here[1]. With this release, we have also improved on the localization of the interface, if you want to help out before the release of the stable 1.3.6, please see the instructions for translators here[2]. We use Weblate for translations, so if you are familiar with that, you can directly head over there[3]. Since this is a pre-release version, you can install this using pip via: $ pip install --upgrade --pre postorius django-mailman3 mailmanclient Please also ensure to run the post-install commands as per the upgrade documentation[4] (commands _after_ pip install, needs a post-install heading/anchor in there :-). A release tarball is available on PyPI: https://pypi.org/project/postorius/1.3.6b1/#files Finally, thanks to all the folks who helped with this release in any capacity and made it possible. [1]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-6 [2]: https://docs.mailman3.org/en/latest/translation.html [3]: https://hosted.weblate.org/projects/gnu-mailman/postorius/ [4]: https://docs.mailman3.org/en/latest/upgrade-3.2.html#virtualenv-install thanks, Abhilash

1 1