Mailman 3 - Mailman-announce

Hyperkitty and mailman-hyperkitty releases
by Abhilash Raj 12 Oct '21

12 Oct '21

Hello Everyone, I have just tagged and released Hyperkitty 1.3.5 and mailman-hyperkitty plugin 1.2.0 to PyPI. This release includes some changes in the authentication between mailman-hyperkitty plugin and Hyperkitty. For that reason, it is important to upgrade both Hyperkitty and mailman-hyperkitty plugin to the latest versions, or it could result in a broken installation. This release of Hyperkitty has bugfixes, some new features and some security enhancements. A full list of changes is available at: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-5 The release tarball is available at PyPI: https://pypi.org/project/HyperKitty/#files https://pypi.org/project/mailman-hyperkitty/#files You can upgrade your installations by running: pip install mailman-hyperkitty hyperkitty -U After the upgrade, please make sure to run these commands: https://docs.mailman3.org/en/latest/upgrade-3.2.html#post-upgrade Also, make sure to restart Mailman Core after upgrading mailman-hyperkitty plugin. Finally, many thanks to all the people who contributed to this release. -- thanks, Abhilash Raj (maxking)

1 0

Ann: Postorius 1.3.6b1 is now out
by Abhilash Raj 28 Sep '21

28 Sep '21

Hey Everyone, I am pleased to announce that Postorius 1.3.6b1 is now out. This is the first pre-release for 1.3.6, which is slated to release next week soon after Mailman Core 3.3.5 release. This release requires Mailman Core 3.3.5 release, so if you are trying out this release, please also upgrade Mailman Core to 3.3.5rc1 (which was just released today). This release includes several new features and bug fixes. A full list of changes is available here[1]. With this release, we have also improved on the localization of the interface, if you want to help out before the release of the stable 1.3.6, please see the instructions for translators here[2]. We use Weblate for translations, so if you are familiar with that, you can directly head over there[3]. Since this is a pre-release version, you can install this using pip via: $ pip install --upgrade --pre postorius django-mailman3 mailmanclient Please also ensure to run the post-install commands as per the upgrade documentation[4] (commands _after_ pip install, needs a post-install heading/anchor in there :-). A release tarball is available on PyPI: https://pypi.org/project/postorius/1.3.6b1/#files Finally, thanks to all the folks who helped with this release in any capacity and made it possible. [1]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-6 [2]: https://docs.mailman3.org/en/latest/translation.html [3]: https://hosted.weblate.org/projects/gnu-mailman/postorius/ [4]: https://docs.mailman3.org/en/latest/upgrade-3.2.html#virtualenv-install thanks, Abhilash

1 1

Ann: Mailman Core 3.3.5b1 is out
by Abhilash Raj 28 Sep '21

28 Sep '21

Hello Everyone, I am pleased to announce that Mailman Core 3.3.5b1 is now out. It is a pre-release for 3.3.5, which is slated to come out in 3 weeks from now. I am planning for a 2 week beta period, after which I'll release the first RC and then stable a week after. Right now I am not planning to release a second beta version, but if there are several changes in Core in the next week or so, then I might. This release includes a lot of bug fixes and some new features. It also includes a security enhancement that improves the authentication of REST API by adding resistance to some timing channel attacks. A full list of changes in this version can be found here[1]. [1]: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… We have also made improvements in the i18n workflow and now the email templates are updated from the translated messages in the .po files that we get from Weblate. Documentation for translators is available here[2] if you want to help translate Mailman into your native language. [2]: https://docs.mailman3.org/en/latest/translation.html This is a pre-release version, if you want to test it with your setup, you can install it using: $ pip install --pre mailman==3.3.5b1 If you want to download a release tarball, you can do so from here: https://pypi.org/project/mailman/3.3.5b1/#files This release received a lot of contributions from community, which I am really happy about! I'd like to thank everyone who made this release possible! -- thanks, Abhilash Raj (maxking)

1 2

Docker-mailman 0.4.0 release
by Abhilash Raj 23 Sep '21

23 Sep '21

Hey Everyone, I tagged and released 0.4.0 version of container images for Mailman. This release includes several fixes that have been accumulating in the repo for how Mailman is setup in the containers. This release does not include any mailman component version bump from 0.3.12 release. More specifically, the major change is that we no longer require static IP configuration in the container images (like previously) and can handle dynamic addresses that are allocated to the containers by Docker. This should help simplify the setup for folks using Kubernetes or other setup than the provided docker-compose files. The migration steps are documented here[1]. Please checkout the release in Github[2] for more details on the changes made in this release. If you are having issues with upgrading your setup to this release, please open an issue on the issue tracker[3] for help. [1]: https://asynchronous.in/docker-mailman/news/#upgrading-to-040-release [2]: https://github.com/maxking/docker-mailman/releases/tag/v0.4.0 [3]: https://github.com/maxking/docker-mailman/issues -- thanks, Abhilash Raj (maxking)

1 0

Mailman container images 0.3.12 is now out
by Abhilash Raj 05 Sep '21

05 Sep '21

Hey Everyone, I have just tagged release 0.3.12 on Github for container images for Mailman 3[1]. This release includes the fix for CVE-2021-40347 that was announced earlier today. For the folks using 0.3 or 0.3.11 release tags, it is highly recommended that you upgrade to this release. This release also bumps the version of Mailman Core to 3.3.4, Mailmanclient to 3.3.3 and Django-mailman3 to 1.3.7. Note that is since the main and v0.3.12 branches are different in many ways, the default documentation[2] and the docker-compose.yaml files in the main branch aren't accurate if you are using the stable release. Please refer to the README[3] at v0.3.12 tag in the Github repo for more accurate docker-compose.yaml and documentation. The project has grown large enough that we need to start versioning the documentation, if someone has experience with versioning docs using Github pages and mkdocs, then I very much need some help here! For those of you who are using the rolling release, it is recommended that you **don't** upgrade to this stable release. The fixes have been pulled into the rolling tags too, so just make sure that you upgrade to the latest published version of rolling release, which as of this writing should be based off on fda837f8d15540e190992c30f7971f50fca54dac commit[4]. This might not be the latest by the time you upgrade if I add a new commit, so look for versions published after 4:00 PM PST 9/5/2021. I am also working on cutting a new release, 0.4.0, which is backwards incompatible with the setup required to talk to web server and MTA (hence the minor version bump!). That should bring the rolling releases and stable releases closer to each other and add improvements around not needing static IPs in the docker network anymore, plus several bug fixes. If someone wants to test the upgrade to 0.4.0 from 0.3 release and is willing to try out the instructions at [5], it would give me some confidence in cutting out the release sooner. The only thing stopping the release of 0.4.0 images is that I haven't verified if the upgrade from 0.3 is documented enough or not. For all the registries listed in README[6], I am still trying to push to Quay (maybe I need to just skip pushing to Quay :-). So, just use the other two to pull the images, Github (ghcr.io) has more generous pull download policy for un-authenticated users though. [1]: https://github.com/maxking/docker-mailman/releases/tag/v0.3.12 [2]: https://asynchronous.in/docker-mailman/ [3]: https://github.com/maxking/docker-mailman/tree/v0.3.12 [4]: https://github.com/maxking/docker-mailman/commit/fda837f8d15540e190992c30f7… [5]: https://asynchronous.in/docker-mailman/news/#upgrading-to-040-release [6]: https://github.com/maxking/docker-mailman#container-registries -- thanks, Abhilash Raj (maxking)

1 0

New vulnerability in Hyperkitty master branch
by Abhilash Raj 05 Sep '21

05 Sep '21

Hey Everyone, A new vulnerability was reported against Hyperkitty’s git master branch branch which can expose the archives of a private Mailing List through the new Feeds API that was added to Hyperkitty recently to someone who isn't a member or logged-in. Thanks to Ngo Wei Lin for reporting this vulnerability. This bug does not affect any stable released version of Hyperkitty and only affects installations from source (1.3.5b1 version). To differentiate from the vulnerable version, I have bumped the version in master branch to 1.3.5b2, so if you have 1.3.5b1 installed, you should upgrade! The fix for this bug has been committed to master branch[1][2] less than an hour ago as of this writing. If you are using git branches to install Hyperkitty, you can upgrade using the following command: $ pip install --upgrade git+https://gitlab.com/mailman/hyperkitty@master I have also triggered a build for Mailman container images[3] with this changes, so if you are using the rolling container images (which are the only affected ones), then you should upgrade to the latest one when the build[1] finishes (approximately in next 30mins). Do note that this version of rolling release of mailman-web image also includes the fix for the vulnerability announced against Postoruis earlier today. You can verify that you have the fixed version of Hyperkitty in the image by running: $ docker run -it --entrypoint bash maxking/mailman-web:rolling bash-5.0# pip list | grep HyperKitty HyperKitty 1.3.5b2 Ensure that you get 1.3.5b2 version. [1]: https://gitlab.com/mailman/hyperkitty/-/merge_requests/362 [2]: https://gitlab.com/mailman/hyperkitty/-/commit/ed086015acbf66ba377e2af7f6e7… [3]: https://github.com/maxking/docker-mailman/runs/3519658592 -- thanks, Abhilash Raj (maxking)

1 0

CVE-2021-40347: New security release for Postorius
by Abhilash Raj 05 Sep '21

05 Sep '21

Everyone, A security vulnerability was reported against Postorius recently which allows any logged-in user to unsubscribe any other member on any other list on same Mailman installation using a specially crafted POST request due to a missing ownership check. This has been assigned CVE-2021-40347. This affects all past versions of Postorius including 1.0.0. Thanks to Kunal Mehta for the security report and a quick patch to fix the vulnerability. I am also attaching a minimal patch that fixes it along with this email, without tests and NEWS so that it applies to older versions of Postorius easily (I have tested the included patch with 1.3.3, 1.3.2 git tags). Upgrading to 1.3.5 release is highly recommended and it mostly includes the fix for this vulnerability (and a small compatibility fix for django-mailman3 1.3.6) so it shouldn’t introduce any other bugs. You can upgrade to this release by running: $ pip install postorius==1.3.5 A full change log is available here[1] as usual and can be downloaded from PyPI[2]. [1]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#news-1-3-5 [2]: https://pypi.org/project/postorius/1.3.5/ Since there aren't many changes, this release requires 3.5+ like 1.3.4. Although, note that the next release will drop support for 3.5 and will support 3.6 only. For those of you who use container images, I am working on 0.3.12 of container images right now, so look out for that announcement. For those of you using the rolling releases, you can already upgrade to the latest version of the rolling release as it has the fix. -- thanks, Abhilash Raj (maxking)

1 0

Mailman Core 3.3.4 is now out
by Abhilash Raj 21 Mar '21

21 Mar '21

Hey Everyone, I am pleased to announce that Mailman Core 3.3.4 is now out. Because of incompatibility with the new version of a downstream library (SQLAlchemy), this release add is setting 1.3.x as the max supported version of SQLAlchemy. Even though it comes soon after 3.3.3, it has a lot of bug fixes and new features. Some notable ones are: * Email -join command now supports subscribing as digests with digest=<no|mime|plain> options being honored. * For anonymous lists, Mailman will filter all the headers except a few that can be configured using a new config option. * Mailman can do max_size checks on filtered message rather than original message (which might be larger before being filtered) * Previously deprecated --add, --del and --sync options from `mailman members` command are now removed. Their alternatives are `addmembers`, `delmembers` and `syncmembers` subcommands. * If configured, Mailman will add a report about content filtering. A complete change log is available here: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… This release is available via PyPI: https://pypi.org/project/mailman/3.3.4/ You can install or upgrade using: ``` $ pip install --upgrade mailman ``` Thanks to all the contributors who helped with this release! -- On behalf of Mailman Core Team Abhilash Raj

1 0

Core, Hyperkitty and Postorius releases
by Abhilash Raj 02 Feb '21

02 Feb '21

Hey Everyone, I am pleased to announce new stable releases for Mailman Core, Postorius, Hyperkitty. These include both new features and bug fixes. Complete change log for each components: Mailman Core 3.3.3: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… Postorius 1.3.4 https://docs.mailman3.org/projects/postorius/en/latest/news.html Hyperkitty 1.3.4 : https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html Minimum supported Python version is 3.6. You can install them using: $ pip install --upgrade postorius hyperkitty mailman We have also recently been working on making the installation instructions[1] to be more detailed and added a new FAQ[2] section for administrators where I hope to capture common questions from mailman-users list. Feedback or Merge Requests to improve these docs are welcome. You can either send an email or open an issue on Gitlab (easier to track) here[3]. [1]: https://docs.mailman3.org/en/latest/install/virtualenv.html [2]: https://docs.mailman3.org/en/latest/faq.html [3]: https://gitlab.com/mailman/mailman-suite-doc/issues Thanks to everyone who helped out with with this release and contributed if any way! :) thanks, Abhilash Raj On behalf of Mailman Core Team

1 0

New release candidates for Postorius and Hyperkitty
by Abhilash Raj 17 Jan '21

17 Jan '21

Hey Everyone, Happy new year to everyone! I am pleased to announce new release candidates for Postorius and Hyperkitty along with new releases for Mailmanclient and Django-mailman3! These include both new features and bug fixes. Complete change log for each components: Postorius 1.3.4rc1: https://docs.mailman3.org/projects/postorius/en/latest/news.html Hyperkitty 1.3.4rc1 : https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html Mailmanclient 3.3.2.: https://docs.mailman3.org/projects/mailmanclient/en/latest/src/mailmanclien… Django-mailman3 1.3.5: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst These releases require Mailman Core 3.3.2 and Python 3.6+. Since these are pre-releases, you can install them using: $ pip install --pre --upgrade postorius hyperkitty Or you can also specify the exact versions: $ pip install --upgrade 'postorius==1.3.4rc1' 'hyperkitty==1.3.4rc1' Unless there is a release-blocker bug, stable versions for Postorius and Hyperkitty will be released in 2 weeks time. If you can test these releases, we encourage you to report any bugs to us on Gitlab. If you'd like to help out with translations for some of the new strings in your native language, the documentation is available here[1] on how to do that. [1]: https://docs.mailman3.org/en/latest/translation.html -- thanks, Abhilash Raj (maxking) On behalf of GNU Mailman Team

1 1