release: 2.10.3: backup-reauth - the account password before a backup

Cut without asking, as the owner said on 2026-10-15. The full backup and a
domain's export ask for the signed-in user's account password under the
password change's limit; the import's file field is drawn as designed
(1888dce design, the code commit before this). go vet, go test (26
packages) and make e2e passed on the test server for that tree. No
migration, schema 12.

CHANGELOG [2.10.3]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 35; roadmap row. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,10 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [2.10.3] - 2026-10-16
+
+The backup asks for your password. No migration; schema 12.
+
 ### Changed
 
 - **A backup and a domain's export ask for your password** (backup-reauth):

README.md

@@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.10.2 \
+> docker build -f build/Dockerfile --build-arg VERSION=2.10.3 \
->   -t ghcr.io/mixeme/selfpost:2.10.2 .
+>   -t ghcr.io/mixeme/selfpost:2.10.3 .
 > ```
 
 ```sh
@@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.10.2
+  ghcr.io/mixeme/selfpost:2.10.3
 ```
 
 **Get the setup URL** (pick one):

deploy/docker-compose.yml

@@ -23,7 +23,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:2.10.2
+    image: ghcr.io/mixeme/selfpost:2.10.3
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `2.10.2`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `2.10.3`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -145,6 +145,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 32 | inbound-upstream-result | `2.10.0` |
 | 33 | long, non-repeating queue ids | `2.10.1` (PATCH) |
 | 34 | phone-desktop-mode | `2.10.2` (PATCH) |
+| 35 | backup-reauth | `2.10.3` (PATCH) |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.

docs/guide.md

@@ -204,14 +204,14 @@ cat ./data/setup-token
 #### Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `2.10.2`. **No 2.x image is
+deliberately never `:latest`. The current pin is `2.10.3`. **No 2.x image is
 published on ghcr.io yet** (the newest there is `1.3.0`); until one is, build
 it from the checkout under the pinned name, and Compose uses the local image
 instead of pulling:
 
 ```sh
-docker build -f build/Dockerfile --build-arg VERSION=2.10.2 \
+docker build -f build/Dockerfile --build-arg VERSION=2.10.3 \
-  -t ghcr.io/mixeme/selfpost:2.10.2 .
+  -t ghcr.io/mixeme/selfpost:2.10.3 .
 ```
 
 `VERSION` must equal the tag: it is the version the backup check compares
@@ -950,7 +950,7 @@ A version mismatch at step 5 refuses to start and leaves `/data` untouched —
 the panel exits with a message naming the tag to use, e.g.:
 
 ```
-backup: this backup was created by SelfPost 2.10.1 but this image is 2.10.2 — restore into the matching image (selfpost:2.10.1)
+backup: this backup was created by SelfPost 2.10.2 but this image is 2.10.3 — restore into the matching image (selfpost:2.10.2)
 ```
 
 Fix the tag in `docker-compose.yml` (build that tag as under [Fixed image

docs/roadmap.md

@@ -33,7 +33,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | test-email | Send a test message from the panel (was preflight) | agreed (2026-10-13) | — | — |
 | inbound-antispam-panel | Inbound antispam journal + allow/deny lists | shipped `2.1.0` | 12/12 | [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) |
 | origin-strict | Refuse a state-changing request that carries neither `Sec-Fetch-Site` nor `Origin` (was csrf-tokens) | agreed (2026-10-13) | — | — |
-| backup-reauth | Ask for the account password before a backup or a domain export is downloaded | done 2026-10-16, unreleased | — | — |
+| backup-reauth | Ask for the account password before a backup or a domain export is downloaded | shipped `2.10.3` | — | — |
 | review-2026-08-followups | Remaining findings of the 2026-08-19 code review | closed 2026-10-14 (rows placed in [audit-2026-10-12](audit-2026-10-12.md)) | — | — |
 | panel-notifications | E-mail notifications about important events | shipped `2.3.0` | 10/10 | [plans/panel-notifications.md](plans/panel-notifications.md) |
 | delivery-log-storage | Keep a message's `mail.log` lines with its send-log row | shipped `2.2.0` | 8/8 | [plans/delivery-log-storage.md](plans/delivery-log-storage.md) |