CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

www/py-postorius 1.3.13_5

Web user interface for GNU Mailman

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 1.3.13_5
Upstream
up to date
Last update
to 1.3.13_5 · 45ea4cf85c
Quarterly
2026Q4: 1.3.13_5
WWW
https://docs.mailman3.org/projects/postorius/en/latest/
Links
cgit · VuXML

Install

Package
# pkg install py312-postorius
installs 1.3.13_5 from latest; from quarterly (2026Q4) 1.3.13_5
Port
# cd /usr/ports/www/py-postorius && make install clean
# make -C /usr/ports/www/py-postorius config  # change options first
Size
1.6 MiB download · 15 MiB installed
Depends on
devel/py-readme-renderer 46.0, lang/python312 3.12.15, mail/py-django-mailman3 1.3.15_1, mail/py-mailmanclient 3.3.5_2, www/py-django52 5.2.18
License
GPLv3
Options
1 of 1 on in the package: EXAMPLES

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.3.13_51.3.13_5–
FreeBSD 151.3.13_51.3.13_5–
FreeBSD 141.3.13_51.3.13_51.3.13_5

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.3.13_51.3.13_5–
FreeBSD 141.3.13_51.3.13_51.3.13_5

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.3.13_5.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVECVSSPublishedDescription
CVE-2026-447427.22026-05-07VuXML · Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (30)

Michael Osipov (michaelo) · 1.3.13_5
*/*: Bump consumers of www/beautifulsoup4 after port rename

PR:		297837
Approved by:	wen (maintainer via email)
45ea4cf85c
Kai Knoblich (kai) · 1.3.13_4
*: Switch consumers over to Django 5.2

Django 4.2 reached its End-of-Life on 7th April 2026 and Django 5.2 is
the new LTS (= Long Term Support) release which will be supported until
April 2028.

* Switch most ports that use www/py-django42 to www/py-django52.

* Where necessary, remove PORTSCOUT, which is no longer needed because
  an update to a newer version that no longer supports Django 4.2 should
  now be possible.

* Bump PORTREVISION due dependency change where necessary.

PR:		291707
Reviewed by:	sunpoet (python)
Differential Revision:	https://reviews.freebsd.org/D56966
ce59801b72
Po-Chuan Hsieh (sunpoet) · 1.3.13_3
www/py-postorius: Do not install .orig files (followup of PR #295225)

- Bump PORTREVISION for package change

PR:		295481
Reported by:	leres
713667397a
Po-Chuan Hsieh (sunpoet) · 1.3.13_2
www/py-postorius: Fix XSS vulnerability

- Bump PORTREVISION for package change

PR:		295225
Reported by:	Einar Bjarni Halldorsson <einar@isnic.is>
Obtained from:	https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b
4444e522e0
Po-Chuan Hsieh (sunpoet) · 1.3.13_1
www/py-postorius: Add EXAMPLES option

- Bump PORTREVISION for package change

PR:		294555
Requested by:	leres
c0bfae42ea
Matthias Andree (mandree) · 1.3.13
*: Revise USES=python:... version range constraints

and strip all lower bounds of 3.9 or 3.10 because they are implied now.

python:3.9-X  -> python:-X
python:3.9+   -> python
python:3.10-X -> python:-X
python:3.10+  -> python
(options such as ,build preserved)
1403bb7765
Po-Chuan Hsieh (sunpoet) · 1.3.13
www/py-postorius: Update to 1.3.13

- Update WWW

Changes:	https://gitlab.com/mailman/postorius/-/commits/master
		https://docs.mailman3.org/projects/postorius/en/latest/news.html
983367587f
Po-Chuan Hsieh (sunpoet) · 1.3.12
www/py-postorius: Update to 1.3.12

Changes:	https://gitlab.com/mailman/postorius/-/commits/master
1c63a94bc7
Po-Chuan Hsieh (sunpoet) · 1.3.11
www/py-postorius: Update to 1.3.11

Changes:	https://gitlab.com/mailman/postorius/-/commits/master
9ed6102cca
Po-Chuan Hsieh (sunpoet) · 1.3.10_2
www/py-postorius: Convert to USE_PYTHON=pep517

- Bump PORTREVISION for package change
53cf55ebc1
Kai Knoblich (kai) · 1.3.10_1
*: Switch consumers over to Django 4.2

Django 3.2 reached its End-of-Life on 1st April 2024 and Django 4.2 is
the new LTS (= Long Term Support) release which will be supported until
April 2026.

* Switch most ports that use www/py-django32 to www/py-django42.

* Ports that are not compatible with Django 3.2 have already been set
  with an expiration date were not taken into account.

* Bump PORTREVISION due dependency change where necessary.

PR:		276319
Reviewed by:	dvl, grembo, ultima
Approved by:	bofh (implicit), dvl, grembo, Kevin Golding, sunpoet,
		ultima, maintainer timeout (remaining maintainers)
Differential Revision:	https://reviews.freebsd.org/D44637
680c68fd4d
Po-Chuan Hsieh (sunpoet) · 1.3.10
www/py-postorius: Update to 1.3.10

Changes:	https://gitlab.com/mailman/postorius/-/commits/master
8ce1ae21e5
Po-Chuan Hsieh (sunpoet) · 1.3.8
www/py-postorius: Update to 1.3.8

- Fix RUN_DEPENDS
- Update version requirement of RUN_DEPENDS
- Fix TEST_DEPENDS
- Take maintainership
823eba8800
Rene Ladan (rene) · 1.3.7
all: remove explicit versions in USES=python for "3.x+"

The logic in USES=python will automatically convert this to 3.8+ by
itself.

Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.

finance/quickfix: mark BROKEN with PYTHON

libtool: compile:  c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp  -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
          ^~~~~~~~~~
1 warning and 1 error generated.

Reviewed by:	portmgr, vishwin, yuri
Differential Revision:	<https://reviews.freebsd.org/D40568>
3d9a815d9c
Dan Langille (dvl) · 1.3.7
www/py-postorius: Give up maintainership

Give up maintainership of www/py-postorius and related mail/mailman3
ports.

I'm not yet using mail/mailman3 and hope that others can give these
ports the attention they deserve.
5522267f91
Dmitry Marakasov (amdmi3) · 1.3.7
*/*: rename CHEESESHOP to PYPI in MASTER_SITES

PR:			267994
Differential revision:	D37518
Approved by:		bapt
77d68471ad
Dan Langille (dvl) · 1.3.7
www/py-postorius: Update to 1.3.7

While here, apply portfmt changes
ff9f1691c5
Stefan Eßer (se) · 1.3.6_1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.3.6_1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Kai Knoblich (kai) · 1.3.6_1
www/py-django32: Switch consumers over to Django 3.2

Django 2.2 became End-of-Life on 11th April 2022 and Django 3.2 is the
new LTS (= Long Term Support) release which will be supported until
April 2024.

* Switch the most ports that use www/py-django22 to www/py-django32

* Switch www/seahub over to www/py-djangorestframework

* Ports that are not yet ready for Django 3.2 (only three so far) or
  those that have already been set with an expiration date were not
  taken into account.

* Bump PORTREVISION due dependency change where necessary.

PR:		261313
Reviewed by:	bofh, dvl, koobs, ultima
Approved by:	bofh, dvl, koobs, ultima, sunpoet, Kevin Golding, Ivan Rozhuk,
		Alexander Sieg (maintainers)
		maintainer timeout (remaining maintainers)
Differential Revision:	https://reviews.freebsd.org/D34859
0cf5531fcd
Dan Langille (dvl) · 1.3.6
www/py-postorius: Update to 1.3.6

PR:		262227
95cdd3469e
Stefan Eßer (se) · 1.3.5
www/py-postorius: Add CPE information

Approved by:	portmgr (blanket)
13a5c55cd5
Dan Langille (dvl) · 1.3.5
www/py-postorius: Update to 1.3.5
e52c174fbc
Mathieu Arnold (mat) · 1.3.3_1
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 1.3.3_1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Sunpoet Po-Chuan Hsieh (sunpoet) · 1.3.3_1
Change TEST_DEPENDS from py-beautifulsoup448 to py-beautifulsoup

- Bump PORTREVISION for dependency change

py-beautifulsoup448 (beautifulsoup4 4.8.2) was added only for py-wagtail which
requires beautifulsoup4 >=4.8<4.9. Other ports should use py-beautifulsoup
(beautifulsoup4 4.9.3) instead.
78a094d2a6
Sunpoet Po-Chuan Hsieh (sunpoet) · 1.3.3_1
Update USES=python for py-isort 5.6.4 update
efbc80c1dd
Sunpoet Po-Chuan Hsieh (sunpoet) · 1.3.3_1
Move devel/py-readme_renderer to devel/py-readme-renderer

- Bump PORTREVISION for dependency change
d019e7c8f6
Dan Langille (dvl) · 1.3.3
Fix broken depends which I had fixed in another copy, but not my working copy that I checked in.

Reported by:	FreshPorts
c71e671397
Dan Langille (dvl) · 1.3.3
Add dependencies required for mail/mailman3
9a05dbe453