Mailman 3 - Mailman-announce

More Mailman releases!
by Abhilash Raj 22 Oct '23

22 Oct '23

Hello Everyone, I am pleased to announce several new releases for GNU Mailman project. Thanks to all the contributors for making these releases possible! 1. Postorius 1.3.10 [1] 2. Hyperkitty 1.3.8 [2] 3. Django-mailman3 1.3.10 [3] 4. Mailman-web 0.0.7 [4] All the releases are published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ A full list of change logs are available below: [1]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-10 [2]: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-8 [3]: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst [4]: https://gitlab.com/mailman/mailman-web/-/blob/master/README.rst Do note that for Postorius, I released 1.3.9, but I forgot to update dependency metadata to require `django-mailman3>=1.3.10` (which is required for the new bootstrap 5 upgrade across packages) and so I also released Postorius 1.3.10 just after. Installation documentation is available at https://docs.mailman3.org/en/latest/install/install.html and if you are upgrading an existing virtualenv install you can refer https://docs.mailman3.org/en/latest/upgrade-3.2.html If you find any issues, you can report them at the respective bug tracker for the projects. The links to issue trackers are available at https://docs.mailman3.org/en/latest/. Finally, similar to Mailman Core, note that PyPI doesn't accept signatures anymore so each packages' release page now has the tarball uploaded to them along with the signature: Django-mailman3: https://gitlab.com/mailman/django-mailman3/-/releases/v1.3.10 Hyperkitty: https://gitlab.com/mailman/hyperkitty/-/releases/v1.3.8 Postorius: https://gitlab.com/mailman/postorius/-/releases/v1.3.10 Mailman-web: https://gitlab.com/mailman/mailman-web/-/releases/0.0.7 -- thanks, Abhilash Raj (maxking)

1 1

Mailman Core 3.3.9 Release
by Abhilash Raj 20 Oct '23

20 Oct '23

Hello Everyone, Mailman 3.3.9 is now published to PyPI! Thanks to everyone who helped make this release possible. Minimum supported Python version for this release is 3.9, we had to drop support for 3.7 & 3.8 due to incompatibilities with importlib-resources package. Maximum Python version supported right now is 3.11, we haven't yet added 3.12 to CI, so un-sure if there are any errors there. The full change log for the release can be found in the docs as usual: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… You can download the release via PyPI or via Gitlab Release: https://gitlab.com/mailman/mailman/-/releases/v3.3.9 For those of you who need to verify signatures for packages, PyPI doesn't allow publishing signatures anymore so I pushed them to Gitlab Releases along with a copy of the same tarball uploaded to PyPI. I'll be working on the release for the web components tomorrow. -- thanks, Abhilash Raj (maxking)

1 0

New year releases!
by Abhilash Raj 04 Jan '23

04 Jan '23

Hello Everyone, Happy new year! I am pleased to announce several new releases for GNU Mailman project. 1. Mailman Core 3.3.8 [1] 2. Postorius 1.3.8 [2] 3. Hyperkitty 1.3.7 [3] 4. Mailmanclient 3.3.5 [4] 5. Django-mailman3 1.3.9 [5] 6. Mailman-hyperkitty 1.2.1 [6] All the releases are published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ A full list of change logs are available below: [1]: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… [2]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-8 [3]: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-7 [4]: https://docs.mailman3.org/projects/mailmanclient/en/latest/src/mailmanclien… [5]: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst [6]: https://gitlab.com/mailman/mailman-hyperkitty/-/blob/master/README.rst Finally, the minimum Python version required is 3.7, and all the components now support Python 3.7 to 3.11. Thanks to all the contributors for making this release possible! If you find any issues, you can report them at the respective bug tracker for the projects. The links to issue trackers are available here: https://docs.mailman3.org/en/latest/ Installation documentation is available at https://docs.mailman3.org/en/latest/install/install.html and if you are upgrading an existing virtualenv install you can refer https://docs.mailman3.org/en/latest/upgrade-3.2.html -- thanks, Abhilash Raj (maxking)

1 0

New Mailman Core Release
by Mark Sapiro 14 Nov '22

14 Nov '22

We are pleased to announce the release of Mailman core 3.3.7. It is published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ The change log is at https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… - please note the `BREAKING CHANGE` documented there and due to our now using SQLAlchemy >-1.4. Finally, the minimum Python version required is 3.7 although, 3.9 is recommended if you are doing a new install for longest support. 3.10 is supported for Django apps, but Mailman Core is missing that due to one of the core dependencies (aiosmtpd) not supporting 3.10 yet. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

New Mailman Releases
by Abhilash Raj 26 Oct '22

26 Oct '22

Hi, I am pleased to announce several new releases for GNU Mailman project. 1. Mailman Core 3.3.6 [1] 2. Postorius 1.3.7 [2] 3. Hyperkitty 1.3.6 [3] 4. Mailmanclient 3.3.4 [4] 5. Django-mailman3 1.3.8 [5] All the releases are published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ A full list of changelogs are available below: [1]: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… [2]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#section-2 -- Something weird is going on with the page missing the bullets. [3]: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-6 [4]: https://docs.mailman3.org/projects/mailmanclient/en/latest/src/mailmanclien… [5]: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst Finally, the minimum Python version required is 3.7 although, 3.9 is recommended if you are doing a new install for longest support. 3.10 is supported for Django apps, but Mailman Core is missing that due to one of the core dependencies not support 3.10 yet (aiosmtpd). Thanks to all the contributors for making this release possible and apologies on my end for delayed releases. If you find any issues, you can report them at the respective bug tracker for the projects. The links to issue trackers are available here: https://docs.mailman3.org/en/latest/ -- thanks, Abhilash Raj (maxking)

1 0

Mailman 2.1.39 Release
by Mark Sapiro 13 Dec '21

13 Dec '21

I am pleased to announce the release of Mailman 2.1.39. This is a bug fix release. It fixes https://bugs.launchpad.net/mailman/+bug/1954694 This addresses two issues. The fix for CVE-2021-42097 was case sensitive and should not be. The fix for CVE-2021-44227 introduced a potential NameError in logging. This could cause a user's changes to the option's page to not be accepted and perhaps cause a `We hit a bug` response if the user visited the page with a mixed- or upper-case email address For those who just want a patch one is attached to the bug report. As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following: i18n updates. security issues. bugs affecting operation for which no satisfactory workaround exists. Mailman 2.1.39 is the ninth such patch release. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ Mailman 2.1.39 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Mailman 2.1.38 security release
by Mark Sapiro 30 Nov '21

30 Nov '21

A CSRF vulnerability has been reported by Riccardo Schirone of RedHat. This is assigned CVE-2021-44227. I plan to release Mailman 2.1.38 on Tuesday, 30 November to fix this. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 1

Mailman 2.1 security release
by Mark Sapiro 12 Nov '21

12 Nov '21

I am pleased to announce the release of Mailman 2.1.36. This is a security release. It fixes https://bugs.launchpad.net/mailman/+bug/1949401 CVE-2021-43331 and https://bugs.launchpad.net/mailman/+bug/1949403 CVE-2021-43332. The former of these could allow an XSS attack against the user options page and the latter could allow a list moderator to discover the list admin password via a brute force attack against the admindb page CSRF token. For those who just want a patch for the security issues, patches are atteched. As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following: i18n updates. security issues. bugs affecting operation for which no satisfactory workaround exists. Mailman 2.1.36 is the sixth such patch release. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ Mailman 2.1.36 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 2

Mailman 2.1 security release
by Mark Sapiro 06 Nov '21

06 Nov '21

Two new security issues have been reported in Mailman 2.1. These have been given the IDs CVE-2021-43331 and CVE-2021-43332. I plan to release 2.1.36 with full details this Friday, November 12. At that time the vulnerabilities will be made public and patches will also be made available. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Mailman 2.1 security release
by Mark Sapiro 20 Oct '21

20 Oct '21

A couple of vulnerabilities have recently been reported. Thanks to Andre Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and helping with the development of a fix. CVE-2021-42096 could allow a list member to discover the list admin password. CVE-2021-42097 could allow a list member to create a successful CSRF attack against another list member enabling takeover of the members account. These attacks can't be carried out by non-members so may not be of concern for sites with only trusted list members. In any case, I am planning to make a 2.1.35 release and to post a patch for those who don't want to upgrade to address these issues. This is scheduled for Tuesday, October 19. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 3