On 5/8/26 06:19, Demi Marie Obenour wrote: I know that the (unrelated) h2o project (a C HTTP server library and daemon) does tell users to use its master branch. I would like to note that telling users to use the default branch after every release.

With my upstream-elsewhere hat on, keeping the default branch in releasable shape and doing a new release soon after security fixes should be feasible. If it's not feasible, that probably indicates other problems. (I mean that in general and not with regard to Postorius or h2o, specially. I have not looked at these or their processes in detail.)

Best, Sebastian

The current released version of Postorius, and earlier versions, contain an XSS vulnerability in the admin UI. A fix was merged upstream in January 2025, which included documentation of the security issue in the news file[1], but no release has been made since, and I don't see any previous discussion in the oss-security archives. Distributions packaging the latest release that have not backported this fix are vulnerable. I have heard that this issue is being actively exploited.

[1]: https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b