Looking at CVE-2018-11780 i decided to move spamassassin to ceres, which
gave:

The following packages have unmet dependencies:
 spamassassin : Depends: init-system-helpers (>= 1.51) but 1.48+devuan2.0 is tobe installed
                Recommends: spamc
                Recommends: sa-compile but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

(502) aw@anhrefn $ apt policy spamassassin
[...]
  Version table:
     3.4.2-1 60
         60 http://auto.mirror.devuan.org/merged ceres/main amd64 Packages
[...]

This looks like a bug.

cu

AW
--
[...] If you don't want to be restricted, don't agree to it. If you are
coerced, comply as much as you must to protect yourself, just don't support
it. Noone can free you but yourself. (crag, on Debian Planet)
Arne Wichmann (aw@???)