CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

net-p2p/py-nicotine-plus 3.3.10

Graphical client for the Soulseek file sharing network

Port info

Maintainer
marko.cupac@mimar.rs
Packages
latest: 3.3.10
Upstream
Higher version available: 3.3.11
Last update
to 3.3.10 · dbe3d48b70
Quarterly
2026Q4: 3.3.10
WWW
https://github.com/Nicotine-Plus/nicotine-plus/
Links
cgit · VuXML

Install

Package
# pkg install py312-nicotine-plus
installs 3.3.10 from latest; from quarterly (2026Q4) 3.3.10
Port
# cd /usr/ports/net-p2p/py-nicotine-plus && make install clean
Size
1.9 MiB download · 12 MiB installed
Depends on
accessibility/at-spi2-core 2.60.4, audio/py-mutagen 1.48.1, databases/py-gdbm 3.12.15_10, devel/gettext-runtime 1.0_1, devel/glib20 2.88.3,2, devel/py-pygobject 3.58.0, graphics/cairo 1.18.2,3, graphics/gdk-pixbuf2 2.44.1, lang/python312 3.12.15, print/harfbuzz 14.6.0, x11-toolkits/gtk30 3.24.52, x11-toolkits/pango 1.57.1
License
GPLv3

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.3.103.3.10–
FreeBSD 153.3.103.3.10–
FreeBSD 143.3.103.3.103.3.10

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.3.103.3.10–
FreeBSD 143.3.103.3.103.3.10

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 3.3.10 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-689118.72026-09-29Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containin…

VuXML only (0)

Listed in VuXML, the packaged version 3.3.10 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (19)

Christos Margiolis (christos) · 3.3.10
net-p2p/py-nicotine-plus: Update to 3.3.10

Approved by:	Marko Cupać <marko.cupac@mimar.rs> (maintainer)
Reviewed by:	fuz
Differential Revision:	https://reviews.freebsd.org/D49593
dbe3d48b70
Charlie Li (vishwin) · 3.3.6_1
python: bump all USE_PYTHON=distutils consumers after RUN_DEPENDS removal

Any missed ports, feel free to bump.

Any ports that need setuptools at runtime can have the devel/py-setuptools
manually added back to RUN_DEPENDS, but understand that this practice
is deprecated; see CHANGES for details.
06a08e69f3
Robert Clausecker (fuz) · 3.3.6
net-p2p/py-nicotine-plus: update to 3.3.6

Submitter becomes maintainer.

Changelog: https://nicotine-plus.org/NEWS.html

PR:		283124
a0c05bb214
Charlie Li (vishwin) · 3.3.5_1
devel/py-pygobject: bump consumer PORTREVISIONs after port rename

With hat: gnome
PR: 273722
32a55d206d
Charlie Li (vishwin) · 3.3.5
devel/py-gobject3: use USE_GNOME=pygobject3 helper

The helper is equivalent to the previous explicit dependency
declaration so no functional or metadata changes.

With hat: gnome
PR: 273722
48060e03b6
Robert Clausecker (fuz) · 3.3.5
net-p2p/py-nicotine-plus: update to 3.3.5

Changelog: https://nicotine-plus.org/NEWS.html

PR:		282100
a8f2ceb4a2
Neel Chauhan (nc) · 3.3.2_1
net-p2p/py-nicotine-plus: Update to 3.3.2

PR:	277373
cb4afae28e
Nuno Teixeira (eduardo) · 3.2.9_1
*/*: Bump consumers of x11-toolkits/gtk30

New version of gtk3 in tree
3572ca3e01
Rodrigo Osorio (rodrigo) · 3.2.9
net-p2p/py-nicotine-plus: update to 3.2.9

Full changelog : https://github.com/nicotine-plus/nicotine-plus/releases

Port changes:
    * apply portfmt linter
e0c9a14d55
Rene Ladan (rene) · 3.2.0_1
all: remove explicit versions in USES=python for "3.x+"

The logic in USES=python will automatically convert this to 3.8+ by
itself.

Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.

finance/quickfix: mark BROKEN with PYTHON

libtool: compile:  c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp  -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
          ^~~~~~~~~~
1 warning and 1 error generated.

Reviewed by:	portmgr, vishwin, yuri
Differential Revision:	<https://reviews.freebsd.org/D40568>
3d9a815d9c
Tobias C. Berner (tcberner) · 3.2.0_1
accessibility/at-spi2-core: update to 2.46.0

What's new in at-spi2-core 2.46.0:
* Fix GetInterfaces documentation on org.a11y.atspi.Accessible
  interface.

What's new in at-spi2-core 2.45.91:
* Send device event controller events using the same signature as other
  events.
* Document the Accessible, Action, and Cache dbus interfaces.
* Fix license of atspi-gmain.c (#87).

What's new in at-spi2-core 2.45.90:
* xml: Add some documentation.
* xml: Fix event arguments.
* xml: Add some missing DeviceEventController methods.
* Bind the AT-SPI bus to the graphical session.
* Mark bus service as belonging to the session slice.
* Add ATSPI_ROLE_PUSH_BUTTON_MENU.
* Add an "announcement" event/signal to allow objects to send
  notifications (!63).
* Various code clean-ups and test improvements.

What's new in at-spi2-core 2.45.1:
* Atk and at-spi2-atk are now merged into this project.
* Now requires meson 0.56.2 and glib 2.67.4.
* at-spi2-atk: Expose the accessible hierarchy via dbus introspection.
* Properly escape the AT-SPI bus address; fixes warnings about the address
  not containing a colon (!55).
* Add a text value to AtspiValue, so that a value can expose a textual
  description, as in the new Atk value API.
* Add atspi_event_listener_register_with_app, to allow an event listener
  to be registered only for a given application (!52).

- accessibility/atk and accessibility/at-spi2-atk have been merged into
  accessibility/at-spi2-core

- accessibility/at-spi2-core: bump consumers of removed ports atk and at-spi2-atk

PR:		269704
Exp-run by:	antoine
---
fa81a4f5f8
Dmitry Marakasov (amdmi3) · 3.2.0
*/*: rename CHEESESHOP to PYPI in MASTER_SITES

PR:			267994
Differential revision:	D37518
Approved by:		bapt
77d68471ad
Po-Chuan Hsieh (sunpoet) · 3.2.0
net-p2p/py-nicotine-plus: Convert to USE_PYTHON=unittest

- Sort USES
df0f65b210
Lorenzo Salvadore (salvadore) · 3.2.0
all: Return Daniel Menelkir's ports to the pool per his request

PR:		266294
12a4cabc61
Stefan Eßer (se) · 3.2.0
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 3.2.0
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Jason E. Hale (jhale) · 3.2.0
*/*: Update maintainer's email address

PR:		262198
c10ed451d2
Hiroki Tagato (tagattie) · 3.2.0
net-p2p/py-nicotine-plus: update to 3.2.0

Changelog: https://github.com/nicotine-plus/nicotine-plus/releases/tag/3.2.0

PR:		260655
Reported by:	Daniel Menelkir <menelkir@itroll.org> (maintainer)
bbaf50b36f
Daniel Engberg (diizzy) · 3.1.1
net-p2p/py-nicotine-plus: New port: Graphical client for the Soulseek file sharing network

Nicotine+ is a graphical client for the Soulseek peer-to-peer network.
Aims to be a pleasant, free and open source (FOSS) alternative to
the official Soulseek client, providing additional functionality while
keeping current with the Soulseek protocol.
It uses GTK for its graphical user interface, and is written in Python.

WWW: https://github.com/Nicotine-Plus/nicotine-plus/

PR:		246328
Approved by:	arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D32290
d0084dad79