From a1724ad72ce734eb8116dead7754ce8148582c29 Mon Sep 17 00:00:00 2001 From: Mix Date: Fri, 16 Oct 2026 23:16:28 +0300 Subject: [PATCH] release: 2.10.4: origin-strict - a change with neither header is refused Cut without asking, as the owner said on 2026-10-15. A POST with neither Sec-Fetch-Site nor Origin is refused (the commit before this); the e2e client sends Origin. go vet, go test (26 packages) and make e2e passed on the test server for that tree. No migration, schema 12. CHANGELOG [2.10.4]; pins in deploy/docker-compose.yml, README and the guide (pin, build, the sample restore message); development's "from pin" and row 36; roadmap row. No tag. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 4 ++++ README.md | 6 +++--- deploy/docker-compose.yml | 2 +- docs/development.md | 3 ++- docs/guide.md | 8 ++++---- docs/roadmap.md | 2 +- 6 files changed, 15 insertions(+), 10 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f95cb37..ae41b32 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,10 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version ## [Unreleased] +## [2.10.4] - 2026-10-16 + +The origin check is strict. No migration; schema 12. + ### Security - **A change with no word of where it came from is refused** diff --git a/README.md b/README.md index daab001..a944cb4 100644 --- a/README.md +++ b/README.md @@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25. > local image and pulls nothing: > > ```sh -> docker build -f build/Dockerfile --build-arg VERSION=2.10.3 \ -> -t ghcr.io/mixeme/selfpost:2.10.3 . +> docker build -f build/Dockerfile --build-arg VERSION=2.10.4 \ +> -t ghcr.io/mixeme/selfpost:2.10.4 . > ``` ```sh @@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \ -e SELFPOST_HOSTNAME=mail.local.test \ -e PANEL_COOKIE_SECURE=false \ -v selfpost-try-data:/data \ - ghcr.io/mixeme/selfpost:2.10.3 + ghcr.io/mixeme/selfpost:2.10.4 ``` **Get the setup URL** (pick one): diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index 442730c..8314623 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -23,7 +23,7 @@ services: selfpost: - image: ghcr.io/mixeme/selfpost:2.10.3 + image: ghcr.io/mixeme/selfpost:2.10.4 restart: unless-stopped environment: SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}" diff --git a/docs/development.md b/docs/development.md index 5ffe08f..f02fdc0 100644 --- a/docs/development.md +++ b/docs/development.md @@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see [§ Release image](#release-image)). -**Planned version cuts** (from pin `2.10.3`; adjust if semver changes mid-track): +**Planned version cuts** (from pin `2.10.4`; adjust if semver changes mid-track): | Stage | ID | Cut | |---|---|---| @@ -146,6 +146,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com | 33 | long, non-repeating queue ids | `2.10.1` (PATCH) | | 34 | phone-desktop-mode | `2.10.2` (PATCH) | | 35 | backup-reauth | `2.10.3` (PATCH) | +| 36 | origin-strict | `2.10.4` (PATCH) | Docs-only prep (checklists in plans, no product code) uses the same per-step commit rule but **no** version cut until the next product stage ships. diff --git a/docs/guide.md b/docs/guide.md index 3bb651a..d9c1dbe 100644 --- a/docs/guide.md +++ b/docs/guide.md @@ -204,14 +204,14 @@ cat ./data/setup-token #### Fixed image tag `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`), -deliberately never `:latest`. The current pin is `2.10.3`. **No 2.x image is +deliberately never `:latest`. The current pin is `2.10.4`. **No 2.x image is published on ghcr.io yet** (the newest there is `1.3.0`); until one is, build it from the checkout under the pinned name, and Compose uses the local image instead of pulling: ```sh -docker build -f build/Dockerfile --build-arg VERSION=2.10.3 \ - -t ghcr.io/mixeme/selfpost:2.10.3 . +docker build -f build/Dockerfile --build-arg VERSION=2.10.4 \ + -t ghcr.io/mixeme/selfpost:2.10.4 . ``` `VERSION` must equal the tag: it is the version the backup check compares @@ -953,7 +953,7 @@ A version mismatch at step 5 refuses to start and leaves `/data` untouched — the panel exits with a message naming the tag to use, e.g.: ``` -backup: this backup was created by SelfPost 2.10.2 but this image is 2.10.3 — restore into the matching image (selfpost:2.10.2) +backup: this backup was created by SelfPost 2.10.3 but this image is 2.10.4 — restore into the matching image (selfpost:2.10.3) ``` Fix the tag in `docker-compose.yml` (build that tag as under [Fixed image diff --git a/docs/roadmap.md b/docs/roadmap.md index 7abfa53..ba986c6 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -32,7 +32,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md). | health-setup-checks | Server › Health also checks the certificate's name, Postfix's greeting and the trusted proxy (was preflight) | agreed (2026-10-13) | — | — | | test-email | Send a test message from the panel (was preflight) | agreed (2026-10-13) | — | — | | inbound-antispam-panel | Inbound antispam journal + allow/deny lists | shipped `2.1.0` | 12/12 | [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) | -| origin-strict | Refuse a state-changing request that carries neither `Sec-Fetch-Site` nor `Origin` (was csrf-tokens) | done 2026-10-16, unreleased | — | — | +| origin-strict | Refuse a state-changing request that carries neither `Sec-Fetch-Site` nor `Origin` (was csrf-tokens) | shipped `2.10.4` | — | — | | backup-reauth | Ask for the account password before a backup or a domain export is downloaded | shipped `2.10.3` | — | — | | review-2026-08-followups | Remaining findings of the 2026-08-19 code review | closed 2026-10-14 (rows placed in [audit-2026-10-12](audit-2026-10-12.md)) | — | — | | panel-notifications | E-mail notifications about important events | shipped `2.3.0` | 10/10 | [plans/panel-notifications.md](plans/panel-notifications.md) |