Proxmox Backup Server 1.1 → 4.2.9
87 releases · 21 breaking changes · 8 security fixes · 1 advisory fixed
8security21breaking3deprecated471feature137fix
Vulnerabilities fixed by this upgrade
- 8.8 CVE-2023-43320 An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to es…
Breaking changes
- breaking fix #6267: remove old task logs and archives again on busy systems. in 4.2.7
- breaking css: remove x-grid-row-loading class, replace it with non-blurry SVG variant from proxmox-widget-toolkit in 4.2.3
- breaking fix client metadata-mode incremental backups breaking with strict payload-offset rejections introduced in pxar 1.0.1: hold-back chunks could survive across cache-range discontinuities and produce non-monotonic PXAR_PAYLOAD_REF offsets on disk. Inject any held chunk explicitly when a discontinuity… in 4.1.12
- breaking fix #6714: docs: remove wrong --drive parameter from cli example. in 4.0.15
- breaking fix #6358: remove group note file if present on group destroy in 3.4.2
- breaking fix #4382: api: access control: remove permissions of token on deletion. in 3.3.7
- breaking fix #3336: datastore: remove group if the last snapshot is removed to avoid confusing situations where the group directory still exists and blocks re-creating a group with another owner even though the empty group was not visible in the web UI. in 3.3.5
- breaking Improvements to Secure Boot management. With the need to update the revocation database embedded in the shim boot loader, some edge-cases were discovered and improved in the proxmox-secure-boot metapackage. Ship an apt pinning snippet to ensure that Proxmox provided packages are installed, even if… in 3.3
- breaking fix #5861: ui: remove minimum required username length in dialog for changing the owner of a backup group, as PBS support usernames shorter than 4 characters since a while now. in 3.2.9
- breaking api-types: remove influxdb bucket name restrictions in 3.2.3
- breaking Remove the hard limit on the number of tapes in a media set (issue 5229). The limit was not properly enforced and, if exceeded, blocked access to most functions via API, CLI and GUI. Instead of a partially enforced hard limit, log a task warning if the media set has more than 20 media. in 3.2
- breaking Remove whitespace when adding a subscription key, to avoid failing subscription checks due to superfluous whitespace. in 3.2
- breaking Models using i40e. Their names can get an additional port suffix like p0 added. in 3.2
- breaking fix #5229: tape: remove max sequence number limit in 3.1.5
- breaking remove datastore from internal cache based on maintenance mode to avoid that a lock file is kept open. With that lock-file closed one can use a offline maintenance mode to cleanly unmount the mount point where such a datastore resides. in 3.1.5
- breaking Some users with Intel Wi-Fi cards, like the AX201 model, reported that initialization of the card failed with Linux kernel 6.5. This is still being investigated. You should avoid booting into the new kernel if you have no physical access to your server and an Intel Wi-Fi device is used as its only… in 3.1
- breaking Some SAS2008 controllers need a workaround to get detected since kernel 6.2, see the forum thread for details. in 3.1
- breaking fix #4823: datastore: ignore vanished files when walking over namespace and groups hierarchy. This avoids a rare chance of failing a running garbage-collection when a snapshot is removed by the user or a prune job during the same time. in 3.0.3
- breaking Remove support for unauthenticated LDAP binds (where no password is given), which are not supported in Proxmox VE either. in 3.0
- breaking User accounts will now be locked after too many attempts to authenticate with a second factor. This is intended to protect against an attacker who has obtained the user password and attempts to guess the second factor. Unlocking requires either a successful login with a recovery key or a manual… in 3.0
- breaking Systems booting via UEFI from a ZFS on root setup should install the systemd-boot package after the upgrade. The systemd-boot was split out from the systemd package for Debian Bookworm based releases. It won't get installed automatically upon upgrade from Proxmox VE 7.4 as it can cause trouble on… in 3.0
Security changes
- security backup-manager cli: document that cert update create auth and csrf key if they are missing in 4.2.6
- security re-build with proxmox-tfa 6.0.2 to cope with both possible states of backup-eligibility for WebAuthn credentials to fix a regression with (hardware) security keys from the previous version. in 4.0.11
- security Several vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy. in 3.4
- security api: datastore list: move checking if a datastore is mounted after we ensured that the user may actually access it. While this had no effect security wise, it could significantly increase the cost of this API endpoint in big setups with many datastores and many tenants that each have only access… in 3.3.3
- security Fix a RCE vulnerability in the shim bootloader used for Secure Boot support. See PSA-2024-00007-1 for details. in 3.3
- security auth: move to hmac keys for csrf tokens as future-proofing in 3.2.3
- security Fix an issue where the encryption key of the tape-drive was unloaded too eagerly. Before proxmox-backup-server version 3.1.4-1 the additional tape-specific encryption was disabled. We recommend using the native software-defined client-side encryption for the best security. in 3.2
- security build with newer proxmox-rest-server to remove the full static file path from error messages, which might trigger some simple security scanners confusing the API server with a classic (file serving) HTTP server. in 3.0.1
Deprecations
- deprecated update proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice. in 4.2.7
- deprecated api schema/section config: add support for declaring deprecated property aliases, to allow renaming properties without showing the old name in the documentation in 4.2.3
- deprecated rest server: accept deprecated property aliases in JSON request bodies by rewriting them to the canonical name before verification and dispatch, like the CLI and query-string handling already do. in 4.2.3
Every release in between
4.2.9 Nov 3, 2026
otherdocs: installer: document the advanced network options
othersnapshot locking: improve error contexts, prefer short human readable format instead of struct-debug printing
otherdatastore: prefer standard library over custom unsafe code
otherdatastore: rephrase error messages for failed chunk insert, to direct users at running verification if required
fixfix #7746: cli: manager: show installed instead of candidate version
otherGC: fail on abnormal system time drifted between phase 1 and 2, to avoid dataloss in case of manual or automatic system clock adjustments during GC runtime
otherbackup API: reject snapshots created using future timestamps outside of configured "time skew" acceptance window
otherprune: ignore snapshots with backup timestamp in the future
otherapi: sync jobs: extend privilege checks when modifying sync job to cover pre-update configuration
featureauth: ldap/ad: reject empty passwords, which might be interpreted as unauthenticated binds if the backend server allows them
4.2.8 Oct 2, 2026
othertape: labeling: improve error message for tapes with existing data, making the need for formatting them easier to understand.
fixfix #8003: sync: pull: log skipped chunk reuse in case of failed verification. When the previous snapshot is marked as failed, the chunks referenced by it are not reused, but this fact was not logged before.
fixfix #6251: api: list tasks: skip running tasks when failed ones are requested, since a task that is still running cannot have failed.
othersync: refactor and improve ACL checks when setting up local pull sync jobs, encrypting or decrypting sync jobs and prune jobs.
featureapi: admin: add missing ACL check for GC status endpoint, correctly limiting it to users with audit or backup privs.
fixfixed index files: prevent out-of-bounds memory access in FixedIndexReader and restrict fixed index files to a chunk size of 4MB in general. The backup API only allowed creating fixed index files with such a chunk size in the first place, now this is enforced across the board.
othersync: pull: refactor handling of reusable chunks to include checking of chunk sizes, in addition to chunk digests. This prevents a misbehaving pull source from potentially creating inconsistent index files on the target.
4.2.7 Sep 23, 2026
otherdocs: warn in the FAQ that apt upgrade can leave a partial upgrade, as only apt full-upgrade can remove packages to satisfy dependencies. Also fix a typo in the pcat1 file format description.
otheropenid auth: log the full error chain if getting the authorization URL fails, to ease diagnosing connection problems.
fixfix #7823: tape: do not announce a data-in transfer for SCSI commands without a data phase, which targets such as SCST rejected with an ILLEGAL REQUEST error.
othertape: configuration: also reject drive or changer device paths already used by another entry of the same type on update. Enforce unique drive numbers within each changer on creation and update. Existing duplicates can block edits until they are resolved.
othertape: permissions:
othercheck '/tape/device/{drive}' for backup, restore and the drive list, as grants on this documented path were previously ignored.
otherrequire Datastore.Read on the datastore and Tape.Write on the media pool and drive when creating or updating tape backup jobs. Scheduled jobs run as root@pam, so job editors could otherwise get a datastore written to tape without having read access to it.
othertape restore: validate the datastore name read from tape and require the snapshot name to match the one selected for restore, so corrupt or crafted media cannot place temporary files outside of the restore directory.
others3: validate object keys against the datastore layout when refreshing the contents from the bucket, instead of using them as file paths unchecked. Directory marker objects returned by some providers are now skipped.
otherclient: pxar: harden restore and extraction against crafted archives that could write or link files outside of the target directory. Symlinks are no longer followed when entering existing directories or overwriting files, also for symlinks already in the target, and hardlink targets must resolve…
otherupdate proxmox-rest-server to 1.1.1:
otheronly abort a worker task if its whole UPID matches. Previously, users allowed to stop their own tasks could stop others' tasks through a crafted UPID.
breakingfix #6267: remove old task logs and archives again on busy systems.
otherharden authentication: mask the credential check runtime in the delay for failed logins, skip malformed cookie pairs and prefer a ticket over an API token in the same request.
otheraccept quoted and unquoted Forwarded header addresses with optional ports, use the last proxy element and reject unterminated quotes.
otherhonor zero deflate weights in Accept-Encoding, stop logging redirects and unchanged responses as failures, and log client errors as warnings.
otherrun all API authentication and permission checks through one shared code path.
deprecatedupdate proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice.
otherupdate proxmox-network-api to 1.0.6:
fixfix #7329: allow listing interfaces configured with the IPv6 'auto' method.
otherkeep dhcp, auto and loopback methods on unrelated updates instead of switching to manual, which could drop IPv6 settings.
otherreject non-static methods while an address or gateway is set for the same address family.
otherupdate proxmox-rate-limiter to 1.0.1: prevent frequent refill updates from stalling low-rate traffic, and fix opening the shared limiter on aarch64.
4.2.6 Sep 16, 2026
securitybackup-manager cli: document that cert update create auth and csrf key if they are missing
othernotifications: use Severity::Error for acme renewal failures
otherconfig: invalidate CachedUserInfo after ACL changes, to reduce the time it takes for ACL changes to become active
fixfix #7911: api: report: mark endpoint as protected, since it calls commands that require root privileges
otherclient: improve handling of encryption/signing key configuration and manifest signature state
otherbackup: change misleading log message in sign-only mode
othermanifest: reject unsigned manifests when a key is set
otherreuse chunks across compatible crypt modes, e.g. when transitioning from unsigned to signed
featurerestore: allow explicitly trusting unsigned backups, even if the client has a key configured
4.2.5 Aug 5, 2026
otherbackup: harden the handling of client supplied backup manifests:
otheronly accept archive names that are plain file names carrying a server side type extension. A crafted name in a manifest could previously make a sync job read or write outside of the snapshot directory, running as the unprivileged 'backup' user. Reaching this needed a manifest from a configured…
otherkeep an uploaded manifest in memory and only persist it on backup finish, checking that every archive it lists was really uploaded during that session and that the checksums match the ones computed server side. A client uploading a manifest that references archives it did not upload now gets an…
fixfix #7878: sync: push: reuse the manifest of a previous snapshot on a non-encrypting push if the source snapshot was encrypted with a matching key, restoring chunk reuse and thus avoiding needlessly long sync runs.
othersync: push: keep the sign-only crypt mode of a source archive instead of reducing it to unencrypted when pushing without server side encryption.
othersubscription: reject a subscription key issued for a different architecture than the host, as arm64 keys carry an explicit marker, so a wrong key fails fast instead of only erroring during the online check.
fixupdate to proxmox-upgrade-checks 1.1, which accepts the 7.0 kernel, tells a bookworm backport apart from a trixie build and fixes the dkms check.
otherdocs: clarify in the backup protocol description that the manifest is uploaded by the client and only persisted on backup finish.
4.2.4 Jul 29, 2026
otherdocs: document the debug symbol repository
fixdatastore: fix wrong local path used for S3 bad chunk handling during garbage collection
otherrefactor file creation/mode/ownership helpers to proxmox-product-config crate
fixfix #7642: avoid expensive user lookups on file locking by caching the backup user/group ID
otherdepend on proxmox-enterprise-support-keyring, and track its version in the package version API endpoint
fixfix #5748: docs: add catalog.pcat1 format specification
otherdocs: system requirements: document we recommend local storage
fixS3: fix #6841: allow configuring request rate limits by updating to proxmox-s3-client 1.4.1. these rate limits are split into active and passive methods, allowing separate handling of POST/PUT/DELETE and GET/HEAD request limits.
featureS3: config: allow editing the use-node-config flag that controls whether requests S3 endpoints honor the node's proxy settings or not
othersync: push: gracefully handle previous manifest signature mismatches, which can happen when enabling or disabling push-encryption on an already synced backup group
4.2.3 Jul 14, 2026
breakingcss: remove x-grid-row-loading class, replace it with non-blurry SVG variant from proxmox-widget-toolkit
featurepbs-client: add backoff log throttle, to ensure progress and similar output appears quickly initially, but does not create overly long logs
otherclient: report progress during restore
featureapi: journal: adopt proxmox-syslog-api and stream the output, making the implementation consistent with the one from Proxmox Datacenter Manager
otherui: enable the structured journal view and per-service logs, including colored output and filtering capabilities
otherui: always use arrays for 'delete' property, instead of manually converting
fixfix #5971: tape: don't warn on custom MAM attribute write failures
fixfix #7175: api: time: use timedatectl instead of /etc/timezone
fixfix #7187: report: add ethtool output for physical interfaces
featureprune jobs: schedule jobs that do not prune anything, but warn during their execution. such jobs allow testing scheduling options, but make no sense for production use.
fixfix #6691: allow search by comment in datastore content, make search case-insensitive and correctly reset content view after empty searches
otherui: datastore: disable various action tooltips for actions which cannot be triggered
otherldap: escape the user-provided user name when using it in the LDAP search filter that looks up the user DN.
otherldap sync: log which user properties change when synchronizing an existing user, instead of only reporting that the user was updated.
deprecatedapi schema/section config: add support for declaring deprecated property aliases, to allow renaming properties without showing the old name in the documentation
deprecatedrest server: accept deprecated property aliases in JSON request bodies by rewriting them to the canonical name before verification and dispatch, like the CLI and query-string handling already do.
fixfix #7690: fs: replace_file: close the temporary file before renaming or unlinking it, fixing the replacement on WORM file systems and avoiding leftover .fuse_hidden files on FUSE mounts.
otherfs: make_tmp_file: append the temporary suffix instead of replacing the file extension, keeping the original file name intact for easier debugging of leftover temporary files.
4.2.2 Jun 18, 2026
otherapi: backup: run synchronous chunk-insert operations off the asynchronous runtime's worker threads. Blocking those threads, most notably during S3 uploads that can wait up to three hours for a chunk lock, could stall the I/O and timer drivers of the entire runtime and starve other backup workers.
otherclient: backup: make the file-based backup more robust against files that cannot be accessed or that vanish while the backup is running:
fixfix #7658: skip a file and log a warning instead of aborting the whole backup when querying its metadata fails with a permission error, matching the existing handling of permission errors when opening files. Such files can also still be excluded explicitly.
otherconsistently ignore files that disappear during the backup and warn about them, instead of treating this as a fatal error in some cases.
fixtape: backup: fix the command-line group filter, which was passed to the API under the wrong parameter name and thus had no effect.
otherapi: do not log a spurious error when listing the files of a snapshot whose manifest does not exist yet, which is expected while a backup to that snapshot is still running.
fixui: datastore summary: fix the per-datastore sync and prune job counts, which were derived from an incorrectly parsed datastore ID; the prune count in particular was always shown as zero.
fixtape: fix two typos in log and informational messages.
4.2.1 May 26, 2026
fixfix #5076: api: support an 'audiences' property on OpenID realms, listing additional trusted audience values besides the configured client-id. Improves compatibility with providers that issue tokens with multiple audiences.
fixfix #7562: api/ui: tape: separate the format-media 'load-barcode' parameter from the existing 'label-text' verification, so the web interface can load and format empty or previously-unrelated tapes from a changer slot in one step. The old shared parameter aborted formatting after a successful load…
othersync: pull: refuse to overwrite a locally encrypted snapshot from an unencrypted source or one using a different key, and detect content differences between two unencrypted snapshots that share a backup time. Previously such mismatches silently triggered a resync that overwrote the local snapshot.
fixdatastore: fix tuning option changes not propagating the updated sync level to the chunk store until the service was restarted.
otherdatastore: improve the error message when prune cannot acquire a snapshot lock for deletion, by showing the snapshot directory and lock file paths instead of an internal debug dump.
fixapi: backup: fix benchmark, finish-failed, and backup-failed cleanups leaving an orphaned empty backup group behind on the datastore.
otherapi: node: tasks status: return the task end time as an optional field once the task is finished, so the task viewer can render the correct duration without an extra API call.
featureapi/ui: node: add a 'location' property to the node config, exposed through the node options panel.
othersubscription: reuse the server ID from an existing subscription info when multiple candidates are detected, falling back to the first candidate only when no prior info exists.
otherchunk store: include the filesystem backing path in the syncfs log output for easier identification of which directory is being synced.
othertree-wide: print error chains as a colon-separated single line and stop quoting simple errors without context, making logs and CLI output easier to read at a glance.
otherui: encryption keys: extract the error message from API2 responses before displaying the alert, so permission and other endpoint errors no longer surface as an empty popup.
otherremovable device attach service: clarify the systemd unit description so it no longer suggests that mount is attempted for every device or that every device is a datastore.
otherdocs: faq: correct the Debian Bookworm end-of-life date; the last point release is planned for July 2026.
featureLatest 7.0 Kernel as new stable default
featureAllow moving groups and namespaces. Backup groups and namespaces can now be moved to different locations within the same datastore. This allows users to reorganize existing backups while ensuring data consistency.
featureServer-side encryption for push sync jobs. Push sync jobs can now be configured to encrypt snapshots before sending them to remote datastores. For example, this can be used to push snapshots to Proxmox Backup Server instances in less trusted offsite locations. Furthermore, pull sync jobs can be…
featureConcurrent group pull/push processing for sync jobs. Sync jobs can now process multiple groups in parallel by configuring the new worker-threads property. This can significantly improve throughput on high latency networks.
featureS3-compatible object stores as backup storage backend officially supported, including request statistics and notification thresholds. Using S3-compatible object stores as a backup storage backend has graduated from the technology preview phase and is now officially supported. S3-backed datastores…
featureKernel 7.0 as the new stable default.
featurePersist the column state of the datastore usage panel on the dashboard (issue 7412).
featureExpose new option to use the node's HTTP proxy for remote connections in the remote edit window.
featureFix an issue where creating a new user would change the pre-selected realm for the currently logged-in user (issue 7149).
featureFix an issue where OpenID Connect logins would drop the originally requested URL, preventing deep links from working correctly (issue 7337).
featureSet datastore usage related titles based on the backend type. For example, the "Storage Usage" column is now labeled "Local Cache Usage" for S3-backed datastores.
featureUpdated translations, among others:
featureCzech
featureFrench
featureGerman
featureItalian
featureJapanese
featureKorean
featurePolish
featureRussian
featureSimplified Chinese
featureSpanish
featureSwedish
featureTraditional Chinese
featureAllow moving groups and namespaces (issue 6195). Backup groups and namespaces can now be moved to different locations within the same datastore. This lets users reorganize existing backups while ensuring data consistency through per-group locking. Any lock conflicts are gracefully handled by…
featureConcurrent group pull/push processing for sync jobs (issue 4182). Sync jobs can now process multiple groups in parallel by configuring the new worker-threads property. This can significantly improve throughput on high latency networks, overcoming HTTP/2 connection limitations. Log messages are now…
featureMake the garbage collector run automatically on removable datastores when they are unmounted, if the new gc-on-unmount flag is set (issue 7465).
featureUse proper errors for fixed-index inputs instead of panics so a corrupted or unexpected index state fails the single backup task instead of crashing the service.
featureFix a bug that allowed users with powerful Sys.Modify privileges to inject arbitrary options into an apt-get invocation (PSA-2026-00003-1).
featureFix an issue which caused the API to leak information about whether a user exists if certain conditions are met (PSA-2026-00008-1).
featureSupport configuring the proxy daemon's real peer-IP header and allowed source IP addresses through environment variables (PSA-2026-00009-1). The PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM variables can be set by overriding the proxmox-backup-proxy.service systemd unit. This enables…
featureAllow remote connections to optionally use the node's configured HTTP proxy (issue 3723). When configuring a remote, there is now an option to route the connection through the node's HTTP proxy.
featureImplement datastore config caching to avoid re-parsing the whole config on every access, improving performance with a large number of datastores (issue 6049).
featureFix include/exclude pattern matching for nested paths on both server and client (issue 7382). Anchored patterns in subdirectories would fail to match because the leading slash was not added when building the nested pattern.
featureFix an issue where modifying the IPv6 network configuration would overwrite an existing config method like auto with manual (issue 7329).
featureFix push sync jobs cleanup on datastore destroy.
featureFix a bug that prevented push sync jobs from being enumerated in the 'matcher-field-values' API endpoint.
featureIntegrate upstream fixes for the "Crackarmor" AppArmor vulnerabilities (PSA-2026-00010-1).
featureFix a bug where corrupted or missing job state files would prevent users from viewing configured jobs (issue 7400). The API now gracefully handles such errors by returning an unknown job state instead of failing. Furthermore, the proxy daemon now actively self-heals corrupted state files by…
featureImprove detection of configured Proxmox repositories by verifying their signature rather than relying solely on the repository URI (issue 5207). This fixes a spurious "No repository is enabled" warning in the Repositories panel when using a mirrored repository (for example, via the Proxmox Offline…
+31 more items in the release notes4.1.13 Apr 28, 2026
fixfix #5247: client: sanitize relative paths in pxar exclude patterns. Patterns starting with ./ or containing /../ silently never matched any files during a backup; they now go through the same sanitization as the paths they are matched against, and emit a warning if rewritten.
othersync: rename the internal manifest field 'change-detection-fingerprint' to 'sync-source-signature'. Avoids confusion with the unrelated client 'change-detection-mode' parameter, especially in log output. Read access falls back to the legacy field name for already-synced snapshots.
fixpull sync: fix subsequent decrypting pulls re-downloading an unchanged snapshot for the chain signed backup -> encrypting push -> decrypting pull. Decrypt-pull strips the 'sign-only' crypt-mode marker on the local target so the source-side signature check no longer reproduces; now also accept the…
otherpull sync: store and check a sync-source-signature on decrypt-on-pull, so subsequent pulls of an unchanged source snapshot can be skipped without re-downloading and re-decrypting the snapshot's files.
otherclient: pxar: rework the metadata-mode incremental-backup fix from 4.1.12 to avoid metadata-archive index bloat. Use a tighter chunk-identity check at the chunk-reuse decision sites instead of forcing injection on every cache-range hole; preserves the PXAR_PAYLOAD_REF monotonicity guarantee…
otherdatastore: dynamic-index reader: read ctime from the index header instead of the current time. Accidentally regressed by a 2020 refactor; reachable only via the proxmox-backup-debug inspect tool, which now shows the actual creation time of an inspected .didx file.
otherproxmox-backup-debug: produce deterministic output when inspecting index files (sort the chunk-digest list).
featureui: datastore content: reliably refresh the view after namespace operations. Always reload after a partial namespace move so successfully-moved groups disappear from the source view, and fix double-click navigation into a namespace that was just added by a manual reload.
featureui: datastore content: widen the actions column so all icons (including the file-browser icon) remain visible after the namespace/group move feature added another icon.
otherdatastore: when a backup group lock cannot be acquired, log the on-disk paths of the group and lock file instead of an internal BackupGroup struct debug dump.
otherdatastore: move group / move namespace: polish operator-facing log and error output. Use human-readable snapshot timestamps (not raw epoch seconds) in overlap errors, emit the "moving group X" context log line before the pre-move check so subsequent warnings have visible context, use "snapshot…
4.1.12 Apr 28, 2026
otherpull sync: surface CRC errors on the source manifest as actual errors instead of silently treating them as a vanished snapshot.
otherpull sync: bail with a snapshot-prefixed 'archive missing on source' error when fetching a referenced archive returns no data, instead of silently continuing and failing later in the index parser with a confusing message.
otherpull sync: handle vanished snapshots uniformly between local and remote sources, so a concurrent prune during a local-source sync no longer aborts the whole group with 'No such file or directory' but skips the affected snapshot like the remote path already did.
otherpull sync: clean up leftover .tmp files and the otherwise empty freshly-created snapshot directory when a source snapshot vanishes mid-sync or a referenced archive is missing, and drop the misleading 'sync done' log line for snapshots that never actually synced.
otherpull sync: emit an explicit 'skipped' log line for snapshots that fail the verified-only or encrypted-only post-filter check, so the encrypted-only rejection case is no longer silent.
breakingfix client metadata-mode incremental backups breaking with strict payload-offset rejections introduced in pxar 1.0.1: hold-back chunks could survive across cache-range discontinuities and produce non-monotonic PXAR_PAYLOAD_REF offsets on disk. Inject any held chunk explicitly when a discontinuity…
otherclient: show the full error context on upload failures in single-line form, restoring information that was lost when the metadata and payload upload streams were split.
otherui: sync/verify view: show the correct duration of finished tasks in the task log window, instead of computing the duration against the current time.
4.1.11 Apr 25, 2026
featurepull sync: avoid double-decoding blob files on the decrypt-on-pull path, which broke any pull sync job that should have decrypted snapshot manifests, catalogs or other blob files using a configured decryption key. The decrypt-on-pull feature was introduced in 4.1.9.
featurepull sync: also fetch the client log for local sync jobs, where the implementation had been a no-op stub since the trait was first introduced. Skip silently if the source snapshot has no client log, matching the existing behavior of remote sync jobs.
otherpull sync: decrypt the client log on the fly when a matching decryption key is configured, mirroring the existing decrypt-on-pull behavior for the rest of a snapshot's data.
featureui: encryption keys: always enable the tape key restore button and rename it to 'Restore Tape Key'. Restoring loads a new key, so an existing tape key does not need to be selected first; this matches the existing behavior in the tape backup view.
4.1.10 Apr 24, 2026
featureapi: add new '/nodes/localhost/identity' endpoint that returns a stable, unique instance ID derived from /etc/machine-id, for uniquely identifying a PBS node. Primarily useful for matching PBS storages in a PVE cluster to PBS remotes in PDM.
featureclient, manager: add 'server-identity' CLI subcommand to query the instance ID from the backup client and admin tools.
featurecli: migrate the 'move-group' and 'move-namespace' commands introduced in 4.1.9 from the manager to the backup client, exposed as 'group move' and 'namespace move' respectively, where they fit better alongside the other group and namespace subcommands. This also implicitly fixes any permission…
otherapi: namespace move: create the target namespace automatically if it does not exist yet (its parent namespace must still exist), matching what a plain file 'mv' does.
fixfix: sync: pull: distinguish signed-only from fully encrypted snapshots when deciding whether to decrypt on pull. The mere presence of a key fingerprint on the source manifest was previously taken as proof of encryption, which could cause pull sync jobs with a matching decryption key to fail on…
otherpartially fix #6372: acme: also pick a shorter renewal lead of half the certificate lifetime for short-lived certificates (under ten days total), following the Let's Encrypt integration guide. The previous 1/3 fraction still applies for longer-lived certificates.
otherui: datastore create: drop the now outdated 'technology preview' label for S3-backed datastores.
otherui: tape: tune vertical alignment of the tape icon in tree views so it sits better next to the surrounding text.
otherdocs: describe the S3 request counters, how they can trigger notifications, and the periodic threshold reset schedule.
otherdocs: list previously missing entries under the configuration subtree with a short description of each.
4.1.9 Apr 23, 2026
others3: graduate the S3 datastore backend from technology preview to a fully supported feature; drop the corresponding preview note from the docs.
fixfix #7251: sync jobs: support server-side encryption of snapshots using encryption keys stored on the datastore server. Push sync jobs can encrypt previously unencrypted source snapshots on the fly while uploading to the remote; pull sync jobs can decrypt snapshots with a matching key and store…
featureconfig: add 'encryption-keys' as ACL subpath under 'system' for more granular access control over individual encryption keys.
featureui: expose encryption key management via a new menu (list, create, archive/unarchive and delete keys) and allow assigning an active encryption key and associated decryption keys in the sync job editors.
fixfix: sync: pull: also upload the client log to s3-backed target datastores in the "no data changes" fast-path; this was previously only done on full resync.
otherdocs: add chapter on server-side encryption for sync jobs, covering key management, associated keys and requirements for removing keys.
otherui: sync job edit: show a direction-specific hint in the encryption panel, since pull sync jobs only use configured keys to decrypt and never encrypt, which is easy to miss without an explicit note.
otherapi/ui: sync job: reject setting the active encryption key on pull sync jobs (including switching a push job with an active key over to pull without clearing it first), since the active key is only consumed by the push side and would otherwise be silently ignored.
featureadd move operations for backup groups and entire namespace subtrees within the same datastore, covering both filesystem and S3 backends and preserving group notes. Snapshots can be merged into an existing target group when ownership matches and source snapshots are strictly newer. Exposed via new…
featuredatastore: add a per-datastore move journal consumed by the mark phase of garbage collection, closing a race where a concurrent move-group or move-namespace could cause the mark phase to miss a relocated index, which would let the sweep phase remove its still-referenced chunks.
otherdocs: add section on moving namespaces and groups.
otherui: show empty backup groups. Previously, removing the last snapshot of a group also removed the group itself, discarding group-level metadata like notes; it also prevented cleaning up groups left behind by a partially failed move on an S3-backed datastore without going through the API.
otherpartially fix #6372: acme: scale certificate renewal check cadence with certificate lifetime. Start renewing once 2/3 of the total lifetime have passed instead of the hard-coded 30 days, with a minimum of 3 days remaining to still cope with transient failures. This lets short-lived (e.g. 7-day…
otherdocs: sync: document the new 'worker-threads' option for parallel sync jobs.
otherdocs: storage: document the 'gc-on-unmount' flag for removable datastores.
4.1.8 Apr 22, 2026
fixfix #4182: sync jobs: allow pulling or pushing backup groups in parallel, configurable via the new 'worker-threads' sync job property (1 to 32, defaults to 1 for sequential). Significantly improves throughput on high-latency connections where the single HTTP/2 connection to the source was limited…
othersync jobs: in parallel mode prefix log messages by group and buffer them briefly, so lines from concurrent groups stay readable and do not interleave excessively.
featureui: sync job edit: expose the new parallel group worker count setting.
featureapi: datastore: add 'gc-on-unmount' option for removable datastores, which runs garbage collection automatically before unmounting. This gives setups relying on auto-unmount a natural point to run GC. The unmount waits for the GC run, or an already running one, to complete. Rejected on…
featureui: datastore options: expose the new 'gc-on-unmount' toggle for removable datastores.
featuretools: move ParallelHandler to the new proxmox-parallel-handler crate in the proxmox-rs workspace, for reuse across Proxmox products.
otherbump proxmox-shared-memory to 1.0.2, which immediately flushes the contents of newly created mmap files, avoiding a possible race between a file being initialized and another consumer opening it while checking its header.
featureclient: add --server, --port, --datastore, --auth-id and --ns as per-field alternatives to the compound --repository URL across all client tools (proxmox-backup-client, proxmox-file-restore, proxmox-backup-debug). Each has a matching PBS_SERVER, PBS_PORT, PBS_DATASTORE, PBS_AUTH_ID environment…
fixfix #5340: client: add PBS_NAMESPACE environment variable as a per-tool fallback for --ns, consistent with the other PBS_* atom environment variables.
otherdocs: document the new per-field client repository options, their mutual exclusion with --repository, and the corresponding PBS_* environment variables.
fixfix #7337: ui: preserve the target deep link when redirecting through an OpenID login round-trip. The hash was previously dropped, sending users to the dashboard instead of their originally requested view after logging in.
fixfix #7400: handle corrupted or missing job statefiles gracefully. The API no longer errors out when the statefile cannot be parsed (a default schedule status is returned instead), and the scheduler loops actively overwrite corrupted statefiles on the next run so affected jobs resume normally.
fixpbs-key-config: fsync() newly stored encryption keys to match the replace path, so a crash between key creation and the next filesystem flush cannot leave the key partially written on disk.
4.1.7 Apr 15, 2026
otherbump pxar dependency, adding a consistency check for payload reference offsets in split archives.
fixfix #7382: correctly anchor nested paths for include/exclude patterns. Anchored patterns in subdirectories were not matched because the leading slash was not prepended to the match path.
fixfix #7329: api: avoid overwriting existing IPv6 config method. Setting IPv4 configuration could silently reset the IPv6 method to manual, causing the inet6 stanza to be dropped from the interfaces file.
othersystem report: adapt to the ZFS arcstat CLI tool getting renamed to zarcstat.
fixfix #7412: ui: dashboard: persist datastore usage column configuration across page reloads and navigations.
otherui: task descriptions: use title case also for 'Format Media' task.
others3: bump proxmox-s3-client to 1.4.0, fixing the Content-Type for object upload and copy requests to application/octet-stream instead of the non-standard binary/octet.
fixfix #6716: pass node http proxy config to s3 backend, so that S3 operations respect the configured HTTP proxy.
features3: add request statistics with configurable notification thresholds and scheduled counter resets, allowing to monitor and alert on S3 backend traffic.
otherpartially fix #6563: ui: expose s3 rrd charts in datastore summary.
otherapi: metrics: support sub-path metric object IDs, so that S3 sub-metrics inherit their parent datastore's permissions.
otherapi: datastore: include backend type in listing response, allowing the UI to distinguish backends without loading the full config.
otherui: s3: hide S3-only options for non-S3 datastores.
otherui: datastore summary improvements:
othergive notes panel its own full row.
otheruse backend-type from datastore list API for immediate S3 detection.
4.1.6 Mar 19, 2026
fixfix #3723: api: remote: optionally use node proxy config for http client
fixfix #7078: ui: S3: expose "DeleteObjects via DeleteObject" provider quirk
otherapi: status/datastore: expose backend type in datastore status/list
otherui: Set datastore usage related titles based on backend
otherbump proxmox-fuse to 3
fixfix #7017: cache token.shadow verification results
4.1.5 Mar 10, 2026
fixapi: backup: don't verify total file size for incremental backups to fix a critical regression with the previous version bump and incremental qemu backups. As there, the submitted value is currently the upload size instead of the total size.
otherapi: backup: disallow incremental backups with different index length again. Currently, fixed index files are only reused for qemu backups where the total size never changes at the moment.
4.1.4 Feb 17, 2026
fixupdate proxmox-rest-server to 1.0.5 addressing a minor regression that resulted in some requests with auth issues being answered with HTTP code 400 "bad request" instead of the correct HTTP code 401 "unauthorized". The new rest-server also defaults to only checking the forwarded header in the…
featureproxy daemon: support configuration of real peer-ip header and allowed source through the PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM environment variables. These variables can currently be set through overriding the proxmox-backup-proxy.service systemd unit. For example, to check the…
4.1.2 Jan 29, 2026
fixfix #7149: ui: user create: do not leak changing the realm for a new user into the pre-selected realm of the currently logged in user, as that might cause some UX friction and confusion on their next login.
fixfix recent regression that failed s3 refresh.
fixfix #7219: client: mount: align encryption key loading behavior to fallback to the default key location, just like all other commands.
featurepartially fix #6049: datastore: implement various optimizations for handling large datastore configs, including a cache for the datastore config to avoid re-parsing the whole config if not necessary.
otherchunk store: various code clean-ups for the chunk store iterator, chunk filename checks and "bad chunk" handling.
featureadd basic multiarch support to resulting package and executable locations.
featureswitch ACME implementation over to factored out one.
fixfix #6939: acme: support servers returning 204 for nonce requests.
4.1.1 Dec 22, 2025
otherdatastore: s3: use owner from local store cache instead of refetching to reduce the time and amount of request needed for listing backup contents.
featuregarbage collection: add task-cancellation points during phase 2 for s3 stores after each processed s3 object key.
othertape: cope with drives that aligned buffer sizes when setting up encryption.
otherapi: notification: correctly enumerate known push-sync-jobs.
fixapi: config: fix push sync jobs cleanup on datastore destroy.
otherupdate proxmox-apt and related api-types for more robust package name handling.
featureLatest 6.17.2-1 Kernel as new stable default
featureTraffic control based on the authenticated user. Traffic control already allows limiting backup and restore traffic for specific client networks. Now, traffic control can also take the authenticated Proxmox Backup Server user into account. This allows more convenient and fine-grained…
featureAllow to control parallelism of verify jobs. Backup snapshot verification is both an IO- and CPU-heavy workload, as it needs to read chunks from disk and verify their checksums. The number of threads used for reading from disk and for checksum verification can now be customized. In some setups,…
featureBandwidth rate limiting for S3 endpoints. Since Proxmox Backup Server 4.0, backup metadata and chunks can be stored in S3-compatible object stores (technology preview). It is now possible to enforce bandwidth rate limits on incoming and outgoing connections from or to S3 endpoints. This can avoid…
featureKernel 6.17 as the new stable default.
featureAllow users outside the pam realm to access the shell (issue 6398). Accessing the shell requires the Sys.Console privilege. Non-PAM users are required to enter valid PAM credentials to access the shell.
featureFix a sorting issue where the "Last comment" field was not considered (issue 6592).
featureImprove appearance with high-resolution displays.
featureFix an issue where the WebAuthn setting dialog, which is only accessible for the root user, was susceptible to XSS (PSA-2025-00014-1).
featureUpdated translations, among others:
featureCzech
featureFrench
featureGeorgian
featureGerman
featureItalian
featureJapanese
featureKorean
featurePolish
featureSpanish
featureSwedish
featureTraditional Chinese
featureUkrainian
featureAllow to control parallelism of verify jobs. Backup snapshot verification is both an IO- and CPU-heavy workload, as it needs to read chunks from disk and verify their checksums. The number of threads used for reading from disk and for checksum verification can now be customized in the datastore…
featureAllow to automatically unmount removable datastores after an automatic sync job is completed. A removable datastore can be configured to trigger a sync job when it is mounted. In addition, the removable datastore can now be unmounted automatically after the sync job has finished.
featureAllow removable datastore creation on the device's root directory.
featureImprove performance of the API endpoint for listing backup groups.
featureEnsure proper cleanup if setting the backup group owner fails.
featureClarify task log messages for protected backup snapshots when pruning (issue 6624).
featureMount a dedicated tmpfs under /run/proxmox-backup to avoid exceeding the maximum number of inodes on low-memory hosts. This will only take effect after a reboot.
featureFix an issue where Proxmox Backup Server would stop accepting incoming connections in certain error cases. This could be caused by health checks, for example when running behind HAProxy.
featureFix a regression where pull sync jobs would not resync all corrupt snapshots.
featureFix an issue where authenticating against a Remote running some versions of Proxmox Backup Server 3.4 would fail.
featureFix an issue where backup snapshot creation would not drop locks in time and cause an immediately following backup snapshot creation to fail (issue 6566). This could, for example, happen for push sync jobs.
featureFix a race condition during long-running garbage collection and pruning of recent snapshots that could lead to backup corruption before Proxmox Backup Server 3.4 (PSA-2025-00019-1).
featureImprove the efficiency of fingerprint validation.
featureFix a verification error message that mentioned S3 even in case of a local datastores.
featureFix a locking issue where a backup would not be prioritized over garbage collection during a server reload.
featureAvoid slowdowns when waiting for chunk insertion to finish during pull sync jobs.
featureEnsure correct reuse of pre-existing chunks for backup snapshots created by a pull sync job.
featureFix a race condition between deleting a datastore and modifying the configuration of unrelated datastores.
+42 more items in the release notes4.0.22 Nov 24, 2025
fixs3 garbage-collection: fix local marker cleanup for unreferenced chunks that are only available on the s3 storage itself.
otherprovide and enable dedicated mount unit for /run/proxmox-backup, avoiding the (inode) limits of /run.
featuredatastore config: add default-verification-workers and default-verification-readers to the tuning options.
featureui, docs: integrate new verification related thread-count options.
featureui: traffic-control: rename add-timeframe button to "Add Timeframe" to avoid having two buttons with an "Add" label visible at the same time.
4.0.21 Nov 21, 2025
fixtask tracking: fix adding new entry if other PID is tracked.
otherGC: S3: reduce number of open FDs for to-be-deleted objects to avoid running into soft FD count limits, as we cannot just increase that due to some libraries still potentially using the ancient select syscall.
othersystem report: better hardware and system utilization overview.
otherpulling sync: ensure that all chunks of a synced index files can be downloaded from the remote.
otherpulling sync: mark chunks referenced in last backup snapshot as reusable.
otherpulling sync: keep one "encountered chunks" map for a full backup group to avoid frequently reinstating that map.
otherdocs: storage: fix "persistent" typo
featuretraffic-control: add user-specific rule matching and precedence. Introduce user-aware rule lookup by accepting an optional user and preferring rules that specify 'users' over IP-only matches.
featureui: traffic-control: add users field in edit form and list.
features3 datastore: add support for configuring bandwidth rate-limiting for clients, reusing the token bucket filter that the API server uses for rate limiting.
otherui: expose rate and burst limits for s3 endpoints.
4.0.20 Nov 14, 2025
otherverify: distinguish s3 object fetching and chunk loading error, as loading chunks from the object store might be cause by transient issues, and must therefore handled so they do not incorrectly mark chunks as corrupt.
otherapi: admin: rework waiting on active operations and maintenance locking.
otherapi: datastore: wait for active operations to clear before s3 refresh.
othernotifications/pbsXtoX: adapt to proxmox-apt making old_version optional.
featureapi: access: add vncticket verification endpoint.
featureapi: node shell: allow access for tokens.
otherui: replace Proxmox logo with slightly bigger SVG version to make it crisper on HiDPI displays.
otherdatastore: GC: drop overly verbose info message during s3 chunk sweep.
fixdatastore: various concurrency fixes for GC and handling corrupt chunks.
otherverify: never hold mutex lock in async scope on corrupt chunk rename to avoid rare deadlock potential.
othercleanup chunk markers from cache in phase 3 on s3 backends.
featureverification: add option to set number of {read,verify}-threads for jobs, allowing one to potentially increase verification throughput as long as the system does not gets IO starved.
featureapi: datastore: auto-unmount after mount-triggered sync for a removable datastore. This can be configured through a new 'unmount-on-done' option for sync jobs.
4.0.19 Nov 7, 2025
featuresync: pull: instantiate backend only once per sync job to avoid establishing a new connection for each chunk that gets inserted.
otherapi, datastore: ensure that the exclusive lock on the backup group is acquired before updating the notes, in order to avoid possible race conditions, e.g. with backup group destruction.
otherbackup log upload: avoid calling a blocking function in async context.
otherverify: improve logs and behavior on errors.
otherdatastore: avoid potential loss of concurrent config changes that happened during datastore deletion.
fixfix #4995: pxar: Include symlinks in zip file creation.
fixchunk store: fix theoretical race window between chunk stat and GC cleanup, for a case where a chunk must be older than the cutoff time and not be referenced by any index file and also uploaded at the exact same time that the GC passed over it in phase 2.
othervarious code style fixes, partially automated through rust clippy, upgrading from rust 1.85 to 1.90..
4.0.18 Oct 22, 2025
otherapi: chunk upload: extend consistency checks for s3 backend
4.0.17 Oct 15, 2025
fixfix #6665: never rename chunks on s3 client fetch errors
fixfix #6398: api: allow non-pam users to access shell
otherapi: admin: datastore: optimize groups api call
othersync job: pull: avoid blocking future during thread pool completion
otherrefactor GC helpers
otherS3 chunk cache: rework fetching and caching logic
fixfix #6906: s3-client: conditionally set Content-Length header
otherGC: refactor chunk removal helper
4.0.16 Oct 2, 2025
fixsync: pull: fix regression in resync of corrupt snapshots
fixfix #6750: api: avoid possible deadlock on datastores with s3 backend
fixfix #6566: backup: api: conditionally drop group and snapshot locks
otherGC: rework locking logic to avoid deadlock with s3 backend
otherverify: silence incorrect backend error message for filesystem stores
4.0.15 Sep 15, 2025
otherpbs3to4: sync to changes made on bookworm PBS 3 branch.
othernotification: don't deserialize notification config when there is nothing to send.
otherapi: do not block current thread during s3 backup log upload.
others3: pass now optional default request timeout for s3 api calls.
breakingfix #6714: docs: remove wrong --drive parameter from cli example.
fixfix #6624: ui: improve task log output for protected entry.
featureupdate proxmox-s3-client to 1.2.2 to benefit from the higher request timeout of 30 minutes and the new retry logic for transient client errors using an exponentially increasing back-off time and a maximum of 3 tries for the retries.
featureapi: allow creation of removable datastore at device's root.
otherdocs: network-management: use correct syntax for code-blocks.
otherdocs: network-management: link to systemd.link documentation.
fixfix #6592: ui: add custom sort function to comment column.
4.0.14 Aug 13, 2025
otherui: webauthn view: make sure renderers are html encoded
4.0.13 Aug 11, 2025
otherbin: pbs3to4: adapt boot-loader checks to trixie
otherdatastore: cleanup newly created group dir if setting owner failed
4.0.12 Aug 7, 2025
otherupdate proxmox-tfa dependency to 0.6.3 to also keep old passkeys created with PBS 3 or earlier working, where the backup eligible state was not yet exposed.
featureapi: openid connect: allow users of OIDC realms to opt into the HttpOnly cookies.
featureui: opt OpenID connect authentication flows into the new http only flow.
otherproxy: avoid exiting connection acceptor loop in error case, like some monitoring and health checks of reverse proxies or load balancer cause.
4.0.11 Aug 6, 2025
securityre-build with proxmox-tfa 6.0.2 to cope with both possible states of backup-eligibility for WebAuthn credentials to fix a regression with (hardware) security keys from the previous version.
4.0.10 Aug 5, 2025
featurenotifications templates: adapt to whitespace handling changes with new handlebars version to ensure lists are not placed on a single line.
featureS3 Endpoints: allow one to set quirks to adapt to provider specific behavior, like not understanding the If-None-Match HTTP header.
othermetric collection: use ip link for determining the type of interfaces.
otherd/control: recommend proxmox-network-interface-pinning package for the Proxmox Backup Server package.
otherdocs: add documentation for proxmox-network-interface-pinning.
4.0.9 Aug 4, 2025
othersync: conditionally pre-filter source list by verified or encrypted state.
otherapi: return s3 client errors during datastore create with context.
featureacls: add s3-endpoint as valid 'system' subpath and expose on the web UI.
others3 endpoint: make required permissions specific to acl sub-paths in '/system/s3-endpoint/{id}' to allowing one to provide only access to a specific S3 endpoint.
4.0.8 Jul 31, 2025
featureadd pbs-network-config-commit systemd service to apply pending network changes on boot.
otherdatastore: delete all objects on datastore destroy when the remove data flag was set.
otherui: switch datastore destroy label text depending on the backend type.
otherdocs: s3: extend recommendations and limitations for local cache.
otherdatastore: destroy: delete s3 in-use marker unconditionally to make re-adding the bucket as datastore easier.
otherdatastore: wrap bucket name, as in is now optional in the s3 client.
otherapi: admin s3: make store prefix for check command optional.
featureapi: config s3: add bucket list api endpoint.
otherui: replace bucket field by bucket selector
4.0.7 Jul 25, 2025
features3 api types: make region regex less strict to allow more providers, like e.g., Hetzner, to work.
othertell client to remove authentication cookies via http header on unauthorized request.
featureallow log-in via valid parameters even if there is a pre-existing HttpOnly cookie with a (now) invalid ticket, as that should not block valid new logins.
otherdon't set Expire for HttpOnly cookies anymore as heuristic to try to make browsers clear these login-ticket cookies on exit.
4.0.6 Jul 24, 2025
fixd/postinst: fix setting up pbs-test repo on fresh installation during the beta.
featureLatest 6.14.8-2 Kernel as new stable default
featureNew major release based on the great Debian Trixie.
featureSeamless upgrade from Proxmox Backup Server 3.4, see Upgrade from 3 to 4.
featureS3-compatible object stores as backup storage backend (technology preview). Proxmox Backup Server can now connect to object stores that provide an S3-compatible API. A new datastore type persists backup metadata and chunks to an S3-compatible object store. To reduce the number of requests to the…
featureZFS now supports adding new devices to existing RAIDZ pools with minimal downtime.
featureFix an issue where the datastore creation tasks would not be formatted properly in the task list.
featureImprovements to the custom consent window:
featureAvoid showing the consent text twice for OIDC logins.
featureRestrict the text length of the consent banner to 64 KiB.
featureFix an issue where the consent window size would exceed the viewport size (issue 6312).
featureUse HttpOnly cookies as an additional layer of protection against cookie stealing attacks.
featureSmall improvements to the services view in the host's system panel.
featureFix an issue where the node services panel would incorrectly show postfix as disabled.
featureImproved handling of translations:
featureAdd support for plural forms and ngettext usage.
featureTranslations can now contain comments that are extracted from the source code and provide useful context for translators.
featureUpdated translations, among others:
featureCzech (new!)
featureArabic
featureBulgarian
featureFrench
featureGerman
featureItalian
featureJapanese
featureKorean
featurePolish
featureRussian
featureSimplified Chinese
featureSpanish
featureSwedish
featureTraditional Chinese
featureUkrainian
featureS3-compatible object stores as backup storage backend (technology preview). Proxmox Backup Server can now connect to object stores that provide an S3-compatible API. A new datastore type persists backup metadata and chunks to an S3-compatible object store. One such datastore cannot be shared…
featureAllow to automatically run sync jobs whenever a relevant removable datastore is mounted. Sync jobs that reference a local removable datastore can only be run while the removable datastore is mounted. Setting the new run-on-mount flag on a sync job causes it to run automatically when the removable…
featureFix an issue where forgetting a group, or the last snapshot of a group, would fail if a group note is present (issue 6358).
featureFix an issue where forgetting a group, or the last snapshot of a group, would fail if the owner file was already deleted.
featureImprovements to the garbage collection:
featureAllow bypassing the chunk cache used during the marking phase by setting a cache capacity of 0.
featureTrack chunk cache statistics in the garbage collection task log.
featureFix logging in case of index files created or deleted while the garbage collection job is running.
+26 more items in the release notes3.4.9 Sep 26, 2026
3.4.8 Sep 26, 2026
3.4.7 Sep 26, 2026
3.4.6 Sep 26, 2026
3.4.5 Sep 26, 2026
3.4.4 Sep 26, 2026
3.4.3 Sep 26, 2026
3.4.2 Jun 4, 2025
otherdatastore: various small perf optimizations
otherrestore-daemon: adapt to zpool output changes in 2.3
breakingfix #6358: remove group note file if present on group destroy
otherdocs: tuning: list default and maximum values for gc-cache-capacity
otherbackup info: avoid additional stat syscall for protected check
othertools: lru cache: document limitations for cache capacity
othergarbage collection: bypass cache if gc-cache-capacity is 0
3.4.1 Apr 16, 2025
fixui: token view: fix typo in 'lose' and rephrase token regenerate dialog message for more clarity.
otherrestrict consent-banner text length to 64 KiB.
otherdocs: describe the intend for the statically linked pbs client.
otherapi: backup: include previous snapshot name in log message.
othergarbage collection: account for created/deleted index files concurrently to GC to avoid potentially confusing log messages.
fixgarbage collection: fix rare race in chunk marking phase for setups doing high frequent backups in quick succession while immediately pruning to a single backup snapshot being left over after each such backup.
othertape: wait for calibration of LTO-9 tapes in general, not just in the initial tape format procedure.
featureLatest 6.8.12-9 Kernel as new stable default
featurePerformance improvements for garbage collection. Garbage collection frees up storage space by removing unused chunks from the datastore. For this, it has to mark all chunks that are currently in use by backup snapshots. The marking phase now uses a cache to avoid redundant marking operations. This…
featureMore fine-grained control over backup snapshot selection for sync jobs. Sync jobs are useful for pushing or pulling backup snapshots to or from remote Proxmox Backup Server instances. Group filters already allow selecting which backup groups should be synchronized. In addition, it is now possible…
featureStatic build of the Proxmox Backup command-line client. Proxmox Backup Server is tightly integrated with Proxmox VE, but its command-line client can also be used outside Proxmox VE. Packages for the command-line client are already provided for hosts running Debian or Debian derivatives. A new…
featureLatest Linux 6.14 kernel available as opt-in kernel.
featureAllow configuring a default realm which will be pre-selected in the login dialog (issue 5379).
featureThe prune simulator now allows specifying schedules with both range and step size (issue 6069).
featureEnsure that the prune simulator shows kept backups in the list of backups.
featureFix an issue where the GUI would not fully load after navigating to the "Prune & GC Jobs" tab in rare cases.
featureDeleting the comment of an API token is now possible.
featureVarious smaller improvements to the GUI.
featureFix some occurrences where translatable strings were split, which made potentially useful context unavailable for translators.
featurePerformance improvements for garbage collection (issue 5331). Garbage collection frees up storage space by removing unused chunks from the datastore. For this, its first phase updates the atime (access time) of all chunk files that are currently in use by backup snapshots. The marking phase now…
featureAdd a safeguard against filesystems that do not honor atime updates (issue 5982). The first phase of garbage collection marks used chunk files by explicitly updating their atime. If the filesystem backing the chunk store does not honor such atime updates, phase two may delete chunks that are still…
featureAllow to customize the atime cutoff for garbage collection in the datastore's tuning options. The atime cutoff defaults to 24 hours and 5 minutes, as a safeguard for filesystems that do not always immediately update the atime. However, on filesystems that do immediately update the atime, this can…
featureAllow to generate a new token secret for an API token via the API and GUI (issue 3887).
featureRevert a check for known but missing chunks when creating a new backup snapshot (reverts fix for issue 5710). This check was introduced in Proxmox Backup Server 3.3 to enable clients to re-send chunks that disappeared. However, the check turned out to not scale well for large setups, as reported…
featureEnsure proper unmount if the creation of a removable datastore fails.
featureRemove a backup group if its last backup snapshot is removed (issue 3336). Previously, the empty backup group persisted with the previous owner still set. This caused issues when trying to add new snapshots with a different owner to the group.
featureDecouple the locking of backup groups, snapshots, and manifests from the underlying filesystem of the datastore (issue 3935). Lock files are now created on the tmpfs under /run instead of the datastore's backing filesystem. This can also alleviate issues concerning locking on datastores backed by…
featureEnsure that permissions of an API token are deleted when the API token is deleted (issue 4382).
featureEnsure that chunk files are inserted with the correct owner if the process is running as root.
featureFix an issue where prune jobs would not write a task log in some cases, causing the tasks to be displayed with status "Unknown".
featureWhen listing datastores, parse the configuration and check the mount status after the authorization check. This can lead to performance improvements on large setups.
featureImprove the error reporting by including more details (for example the errno) in the description.
featureEnsure that "Wipe Disk" also wipes the GPT header backup at the end of the disk (issue 5946).
featureEnsure that the task status is reported even if logging is disabled using the PBS_LOG environment variable.
featureFix an issue where proxmox-backup-manager would write log output twice.
featureFix an issue where a worker task that failed during start would not be cleaned up.
featureFix a race condition that could cause an incorrect update of the number of current tasks.
featureIncrease the locking timeout for the task index file to alleviate issues due to lock contention.
featureFix an issue where verify jobs would be too eagerly aborted if the manifest update fails.
featureFix an issue where file descriptors would not be properly closed on daemon reload.
featureFix an issue where the version of a remote Proxmox Backup Server instance was checked incorrectly.
featureStatic build of the Proxmox Backup command-line client (issue 4788). Proxmox Backup Server is tightly integrated with Proxmox VE, but its command-line client can also be used outside Proxmox VE. Packages for the command-line client are already provided for hosts running Debian or Debian…
featureAllow to read passwords from credentials passed down by systemd. Examples are the API token secret for the Proxmox Backup Server, or the password needed to unlock the encryption key.
featureImprovements to the vma-to-pbs tool, which allows importing Proxmox Virtual Machine Archives (VMA) into Proxmox Backup Server:
featureOptionally read the repository or passwords from environment variables, similarly to proxmox-backup-client.
featureAdd support for the --version command-line option.
securitySeveral vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy.
+22 more items in the release notes3.3.7 Apr 5, 2025
fixfix #5982: garbage collection: add a check to ensure that the underlying file system supports and honors file access time (atime) updates. The check is performed once on datastore creation and on start of every garbage collection (GC) task, just to be sure. It can be disabled in the datastore…
othergarbage collection: support setting a custom access time cutoff, overriding the default of one day and five minutes.
otherui: expose flag for GC access time support safety check and the access time cutoff override in datastore tuning options.
otherdocs: describe rationale for new GC access time update check setting and the access time cutoff check in tuning options.
featureaccess control: add support to mark a specific authentication realm as default selected realm for the login user interface.
breakingfix #4382: api: access control: remove permissions of token on deletion.
fixfix #3887: api: access control: allow users to regenerate the secret of an API token without changing any existing ACLs.
fixfix #6072: sync jobs: support flags to limit sync to only encrypted and/or verified snapshots.
featureui: datastore tuning options: expose overriding GC cache capacity so that admins can either restrict the peak memory usage during GC or allow GC to use more memory to reduce file system IO even for huge (multiple TiB) referenced data in backup groups.
otherui: datastore tuning options: increase width and rework labels to provide a tiny bit more context about what these options are.
otherui: sync job: increase edit window width to 720px to make it less cramped.
otherui: sync job: small field label casing consistency fixes.
3.3.6 Apr 3, 2025
otherdatastore: ignore group locking errors when removing snapshots, they normally happen only due to old-locking, and the underlying snapshot is deleted in any case at this point, so it's no help to confuse the user.
featureapi: datastore: add error message on failed removal due to old locking and tell any admin what they can do to switch to the new locking.
featureui: only add delete parameter on token edit, not when creating tokens.
featurepbs-client: allow reading fingerprint from system credential.
otherdocs: client: add section about system credentials integration.
3.3.5 Apr 2, 2025
otherapi: config: use guard for unmounting on failed datastore creation
otherclient: align description for backup specification to docs, using archive-name and type over label and ext.
featureclient: read credentials from CREDENTIALS_DIRECTORY environment variable following the "System and Service Credentials" specification. This allows users to use native systemd capabilities for credential management if the proxmox-backup-client is used in systemd units or, e.g., through a wrapper…
fixfix #3935: datastore/api/backup: move datastore locking to '/run' to avoid that lock-files can block deleting backup groups or snapshots on the datastore and to decouple locking from the underlying datastore file-system.
fixapi: fix race when changing the owner of a backup-group.
breakingfix #3336: datastore: remove group if the last snapshot is removed to avoid confusing situations where the group directory still exists and blocks re-creating a group with another owner even though the empty group was not visible in the web UI.
featurenotifications: clean-up and add dedicated types for all templates as to allow declaring that interface stable in preparation for allowing overriding them in the future (not included in this release).
featuretape: introduce a tape backup job worker-thread option for restores. Depending on the underlying storage using more threads can dramatically improve the restore speed. Especially fast storage with low penalty for random access, like flash-storage (SSDs) can profit from using more worker threads.…
othergarbage collection: generate index file list via datastore iterators in a structured manner.
fixfix #5331: garbage collection: avoid multiple chunk atime updates by keeping track of the recently marked chunks in phase 1 of garbage to avoid multiple atime updates via relatively expensive utimensat (touch) calls. Use a LRU cache with size 32 MiB for tracking already processed chunks, this…
featurelogging helper: use new builder initializer – not functional change intended.
3.3.4 Mar 13, 2025
fixfix #6185: client/docs: explicitly mention archive name restrictions
otherdocs: using-the-installer: adapt to raised root password length requirement
otherdisks: wipe: replace dd with write_all_at for zeroing disk
fixfix #5946: disks: wipe: ensure GPT header backup is wiped
otherdocs: fix hash collision probability comparison
3.3.3 Feb 11, 2025
securityapi: datastore list: move checking if a datastore is mounted after we ensured that the user may actually access it. While this had no effect security wise, it could significantly increase the cost of this API endpoint in big setups with many datastores and many tenants that each have only access…
fixRevert "fix #5710: api: backup: stat known chunks on backup finish" due to a big performance impact relative to what this is protectign against. We will work out a more efficient fix for this issue in the future.
otherprune simulator: show backup entries that are kept also in the flat list of backups, not just in the calendar view.
otherdocs: improve the description for the garbage collection's cut-off time
otherpxar extract: correctly honor the overwrite flag
featureapi: datastore: add missing log context for prune to avoid a case where the worker state being unknown after it finished.
otherdocs: add synopsis and basic docs for prune job configuration
otherbackup verification: handle manifest update errors as non-fatal to avoid that the job fails, as we want to continue with verificating the rest to ensure we uncover as much potential problems as possible.
fixfix #4408: docs: add 'disaster recovery' section for tapes
fixfix #6069: prune simulator: correctly handle schedules that mix both, a range and a step size at once.
fixclient: pxar: fix a race condition where the backup upload stream can miss an error from the create archive function, because the error state is only set after the backup stream was already polled. This avoids a edge case where a file-based backup was incorrectly marked as having succeeded while…
3.3.2 Dec 10, 2024
fixfile-restore: fix regression with the new blockdev method used to pass disks of a backup to the isolated virtual machine.
3.3.1 Dec 3, 2024
featuretree-wide: add missing O_CLOEXEC flags to openat calls to avoid passing any open FD to new child processes which can have undesired side-effects like keeping a lock open longer than it should.
fixcargo: update proxmox dependency of rest-server and sys crates to include some fixes for open FDs and a fix for the active task worker tracking, as on failing to update the index file the daemon did not finished the worker, causing a reference count issue where an old daemon could keep running…
otherui: check that store is set before trying to select anything in the garbage collection (GC) job view.
featureLatest 6.8.12-4 Kernel as new stable default
featurePush direction for sync jobs. Sync jobs can already pull backup snapshots from remote Proxmox Backup Server instances. The new push direction allows copying backup snapshots from the local instance to remote instances. This can be useful in setups where the remote instance cannot initiate…
featureSupport for removable datastores. Datastores can now be created on removable media for offline storage. After unmounting the removable datastore, the medium can be removed. The datastore can be used on multiple Proxmox Backup Server instances.
featureWebhook target for the notification system. The new webhook notification target allows notification events to trigger HTTP requests. Request headers and body can be customized and can contain notification metadata. This allows users to push notifications to any target that supports webhooks.
featureNew change detection modes for speeding up file-based backups. Metadata and data of backup snapshots are now stored in two separate archives. Optionally, files that have not changed since the previous backup snapshot can be identified using the previous backup snapshot's metadata archive.…
featureAllow to set a consent banner that users must acknowledge before logging in (issue 5463). This can be required for compliance reasons. The banner supports Markdown and can be set in Configuration → Other → General → Consent Text.
featureColumns in the "Prune & GC Jobs" view are now sortable (issue 5422).
featureFix a short-lived regression where updating proxmox-backup-server without updating proxmox-widget-toolkit made the GUI inaccessible (issue 5503).
featureFix an issue where the "Change owner" dialog would not accept usernames shorter than 8 characters (issue 5861).
featureDisallow creating a datastore on / via the GUI, as this is most likely unintended.
featureFix an issue where clicking on an external link to the GUI would display a login screen, even if the current session was still valid.
featureShow only installed services in the node's system panel by default, but optionally allow showing all services (issue 5611).
featureRight-align numbers in the S.M.A.R.T. values table (issue 5831).
featureFix an issue where the installed Proxmox Backup Server version was incorrectly rendered with a hyphen instead of a dot.
featureImproved translations, among others:
featureBulgarian (NEW!)
featureArabic
featureFrench
featureGerman
featureItalian
featureJapanese
featureRussian
featureSpanish
featureTraditional Chinese
featurePush direction for sync jobs (issue 3044). Sync jobs can already pull backup snapshots from remote Proxmox Backup Server instances. The new push direction allows copying backup snapshots from the local instance to remote instances. This can be useful in setups where the remote instance cannot…
featurePull sync jobs can now optionally resync corrupt chunks (issue 3786). When syncing a backup group from a remote, the sync job checks whether the last local snapshot has previously failed verification. If this is the case, the sync job overwrites the local snapshot with the remote snapshot. As the…
featureSupport for removable datastores. Datastores can now be created on removable media for offline storage. After unmounting the removable datastore in the GUI, the medium can be removed. The datastore can be used on multiple Proxmox Backup Server instances. Multiple datastores per device are also…
featureCheck for known but missing chunks when creating a new backup snapshot (issue 5710). Known chunks are chunks that are contained in the previous snapshot of the backup group. When creating a new backup snapshot, the list of known chunks is sent to the client, so the client can skip uploading known…
featureFix a regression where an early HTTP connection close could result in high CPU usage and denial-of-service (issue 5868). Early connection closes are used by some monitoring solutions performing health checks.
featureAllow reusing already-existing datastores, but disallow creating datastores in non-empty directories (issue 5439).
featureFix a regression that prevented legacy notifications for successful sync jobs.
featureFix an issue where a delayed TLS Client Hello would cause the API server to respond with a plain HTTP 400 "Bad Request" response (issue 5105).
featureAbort garbage collection if a nested datastore is encountered, as garbage collection cannot be done safely on nested datastores.
featureUpdate choices of cryptographic primitives:
featureCSRF tokens now use a standard HMAC construction.
featureMigrate to yescrypt for hashing passwords. Old hashes will be upgraded to the new scheme once a user logs in.
featureMigrate to Ed25519 for authentication tickets.
featureUse constant-time comparison for additional hardening against timing side-channels.
breakingImprovements to Secure Boot management. With the need to update the revocation database embedded in the shim boot loader, some edge-cases were discovered and improved in the proxmox-secure-boot metapackage. Ship an apt pinning snippet to ensure that Proxmox provided packages are installed, even if…
securityFix a RCE vulnerability in the shim bootloader used for Secure Boot support. See PSA-2024-00007-1 for details.
+69 more items in the release notes3.2.14 Nov 27, 2024
otherpull-sync: do not interpret older missing snapshots as needs-resync
otherapi: directory: use relative path when creating removable datastore
otherui: prune keep input: actually clear value on clear trigger click
fixui: datastore edit: fix empty-text for path field
othersync: push: pass full error context when returning error to job
otherapi: mount removable datastore: only log an informational message if the correct device is already mounted.
featureapi: sync: restrict edit permissions for the new push sync jobs to avoid that a user is able to create or edit sync jobs in push direction, but not able to see them.
fixapi: create datastore: fix checks to avoid that any datastore can contain another one to better handle the case for the new removable datastores.
3.2.13 Nov 26, 2024
otherupdate pxar dependency to fix selective extraction with the newly supported match patterns.
otherreuse-datastore: avoid creating another prune job
featureapi: notification: add API routes for webhook targets
featuremanagement cli: add CLI for webhook targets
otherui: utils: enable webhook edit window
featureui: utils: add task description for mounting/unmounting
featureui: add onlineHelp for consent-banner option
otherdocs: client: fix example commands for client usage
otherdocs: explain some further caveats of the change detection modes
otherui: use same label for removable datastore created from disk
featureapi: maintenance: allow setting of maintenance mode if 'unmounting'
otherdocs: add more information for removable datastores
otherui: sync jobs: revert to single list for pull/push jobs, improve distinction between push and pull jobs through other means.
otherui: sync jobs: change default sorting to 'store' -> 'direction' -> 'id'
featureui: sync jobs: add search filter-box
otherconfig: sync: use same config section type sync for push and pull, note that this breaks existing configurations and needs manual clean-up. As the package versions never made it beyond test this is ignored, as while it's not really ideal we never give guarantees for testing package versions, and…
otherapi: removable datastores: require Sys.Modify permission on /system/disks
featureui: allow resetting unmounting maintenance
otherdatastore: re-phrase error message when datastore is unavailable
fixclient: backup writer: fix regression in progress output
3.2.11 Nov 21, 2024
fixfix #3044: server: implement push support for sync operations
otherpush sync related refactors
3.2.10 Nov 19, 2024
otherapi: disk list: do not fail but just log error on gathering smart data
othercargo: require proxmox-log 0.2.6 to reduce spamming the logs with the whole worker task contents
3.2.9 Nov 14, 2024
otherclient: catalog: fallback to metadata archives for dumping the catalog
otherclient: catalog shell: make the catalog optional and use the pxar accessor for navigation if the catalog is not provided, like its the case for example for split pxar archives.
otherclient: catalog shell: drop payload offset in stat output, as this is a internal value that only helps on debugging some specific development.
fixsync: fix premature return in snapshot-skip filter logic to avoid that the first snapshot newer that the last synced one gets unconditionally included.
breakingfix #5861: ui: remove minimum required username length in dialog for changing the owner of a backup group, as PBS support usernames shorter than 4 characters since a while now.
fixfix #5439: allow one to reuse an existing datastore on datastore creation
otherui: disallow datastore in the file system root, this is almost never what user want and they can still use the CLI for such an edge case.
fixfix #5233: api: tape: add explicit required permissions for the move tape, update tape and destroy tape endpoints, requiring Tape.Modify and Tape.Write on the /tape ACL object path, respectively. This avoids requiring the use of the root account for basic tape management.
otherclient: catalog shell: make the root element its own parent to avoid navigating below archive root, which makes no sense and just causes odd glitches.
otherapi: disk management: avoid retrieving lsblk result twice when listing disks, while it's not overly expensive it certainly does not help to be performant either.
otherapi: disk management: parallelize retrieving the output from smartctl checks.
fixfix #5600: pbs2to3: make check more flexible to allow one to run arbitrary newer '-pve' kernels after upgrade
otherclient: pxar: perform match pattern check for exclusion only once
featureclient: pxar: add debug output for exclude pattern matches to more conveniently debug possible issues.
fixfix #5868: rest-server: handshake detection: avoid infinite loop on connections abort
3.2.8 Oct 18, 2024
otherswitch various log statements in worker tasks to the newer, more flexible proxmox log crate. With this change, errors from task logs are now also logged to the system log, increasing their visibility.
otherdatastore api: list snapshots: avoid calculating protected attribute twice per snapshot, this reduces the amounts of file metadata requests.
otheravoid re-calculating the backup snapshot path's date time component when getting the full path, reducing calls to the relatively slow strftime function from libc.
fixfix #3699: client: prefer the XDG cache directory for temporary files with a fallback to using /tmp, as before.
othersync job: improve log message for when syncing the root namespace.
otherclient: increase read buffer from 8 KiB to 4 MiB for raw image based backups. This reduces the time spent polling between the reader, chunker and uploader async tasks and thus can improve backup speed significantly, especially on setups with fast network and storage.
otherclient benchmark: avoid unnecessary allocation in the AES benchmark, causing artificial overhead. The benchmark AES results should now be more in line with the hardware capability and what the PBS client could already do. On our test system we saw an increase by an factor of 2.3 on this specific…
otherdocs: add external metrics server page
othertfa: webauthn: serialize OriginUrl following RFC6454
featurefactor out apt and apt-repository handling into a new library crate for reuse in other projects. There should be no functional change.
fixfix various typos all over the place found using the rust based typos tool.
featuredatastore: data blob compression: increase compression throughput by switching away from a higher level zstd method to a lower level one, which allows us to control the target buffer size directly and thus avoid some allocation and syscall overhead. We saw the compression bandwidth increase by a…
otherdaily-update: ensure notification system context is initialized.
otherbackup reader: derive if debug messages should be printed from the global log level. This avoids printing some debug messages by default, e.g., the "protocol upgrade done" message from sync jobs.
otherui: user view: disable 'Unlock TFA' button by default to improve UX if no user is selected.
othermanager cli: ensure the worker tasks finishes when triggering a reload of the system network.
fixfix #5622: backup client: properly handle rate and burst parameters. Previously, passing any non-integer value, like 1mb, was ignored.
othertape: read element status: ignore responses where the library specifies that it will return a volume tag but then does not includes that field in the actual response. As both the primary and the alternative volume tag are not required by PBS, this specific error can simply be downgraded to a…
otherpxar: dump archive: print entries to stdout instead of stderr
othersync jobs: various clean-ups and refactoring that should not result in any semantic change.
othermetric collection: put metrics in a cache with a 30 minutes lifetime.
featureapi: add /status/metrics API to allow pull-based metric server to gather data directly.
otherpartial fix #5560: client: periodically show backup progress
otherdocs: add proxmox-backup.node.cfg man page
otherdocs: sync: explicitly mention removed-vanish flag
3.2.7 Jul 3, 2024
otherdocs: drop blanket statement recommending against remote storage
fixui: gc job edit: fix i18n gettext usage
otherpxar: improve error handling, e.g., avoiding duplicate information
featureclose #4763: client: add command to forget (delete) whole backup group with all its snapshots
fixclose #5571: client: fix regression for map command
otherclient: mount: wait for child to return before exiting to provide better UX for some edge paths
fixfix #5304: client: set process uid/gid for .pxarexclude-cli to avoid issues when trying to backup and restore the backup as non-root user.
otherhttp client: keep renewal future running on failed re-auth to make it more resilient against some transient errors, like the request just failing due to network instability.
fixdatastore: fix problem with operations counting for the case where the .chunks/ directory is not available (deleted/moved)
othermanager: use confirmation helper in wipe-disk command
3.2.6 Jun 17, 2024
othertape: disable Programmable Early Warning Zone (PEWZ)
othertape: handle PEWZ like regular early warning
otherdocs: add note for not using remote storages
fixclient: pxar: fix fuse mount performance for split archives
3.2.5 Jun 10, 2024
featurepxar: add support for split archives
fixfix #3174: pxar: enable caching and meta comparison
otherdocs: file formats: describe split pxar archive file layout
otherdocs: add section describing change detection mode
featureapi: datastore: add optional archive-name to file-restore
otherclient: backup: conditionally write catalog for file level backups
otherdocs: add table listing possible change detection modes
3.2.4 Jun 5, 2024
fixfix: network api: permission using wrong pathname
fixfix #5503: d/control: bump dependency for proxmox-widget-toolkit
featureauth: add locking to PbsAuthenticator to avoid race conditions
3.2.3 May 22, 2024
breakingapi-types: remove influxdb bucket name restrictions
otherapi: datastore status: delay lookup after permission check to improve consistency of tracked read operations
othertape: improve throughput by not unnecessarily syncing/committing after every archive written beyond the first 128 GiB
featuretape: save 'bytes used' in the tape inventory and show them on the web UI to allow users to more easily see the usage of a tape
othertape drive status: return drive activity (like cleaning, loading, unloading, writing, ...) in the API and show them in the UI
otherui: tape drive status: avoid checking some specific status if the current drive activity would block doing so anyway
othertape: write out basic MAM host-type attributes to media to make them more easily identifiable as Proxmox Backup Server tape by common LTO tooling.
fixapi: syslog: fix the documented type of the return value
fixfix #5465: restore daemon: mount NTFS with UTF-8 charset
otherrestore daemon: log some more errors on directory traversal
fixfix #5422: ui: garbage-collection: make columns in global view sortable
securityauth: move to hmac keys for csrf tokens as future-proofing
otherauth: upgrade hashes on user log in if a users password is not hashed with the latest password hashing function for hardening purpose
featureauth: use ed25519 keys when generating new auth api keys
fixnotifications: fix legacy sync notifications
otherdocs: document notification-mode and merge old notification section
otherdocs: notifications: rewrite overview for more clarity
otherui: datastore options: link to 'notification-mode' section
otheracme: explicitly print a query when prompting for the custom directory URI
3.2.2 Apr 25, 2024
otherui: notifications fix empty text format for the default mail author
otherui: tape backup: do not try to delete the namespace property if its empty
fixui: sync job: fix error if local namespace is selected first
featureLatest 6.8 Kernel as new stable default
featureNew flexible notification system. Send notifications not only via the local Postfix MTA, but also via authenticated SMTP or to Gotify instances. Flexible notification routing with matcher-based rules to decide which targets receive notifications about which events.
featureSupport for automated and unattended installation of Proxmox Backup Server. Proxmox Backup Server now ships a tool that prepares a Proxmox Backup Server ISO for automated installation. The prepared ISO retrieves all required settings for automated installation from an answer file. The answer file…
featureAbility to exclude particular backup groups from sync and tape backup jobs. Group filters already supported including particular backup groups, and now additionally support excluding particular backup groups. This allows more flexibility when defining which backup groups should be synchronized…
featureOverview of prune and garbage collection jobs of all datastores. A new tab in the datastore summary panel shows defined prune and garbage collection jobs of all datastores. This allows to quickly assess whether all datastores are correctly set up to regularly run important maintenance tasks.
featureSupport for Active Directory authentication realms. The new Active Directory realm type synchronizes users and groups from a remote Active Directory server. This makes it easier to integrate with existing Enterprise infrastructure.
featureAllow managing VLAN network interfaces in the GUI.
featureA new "Prune & GC Jobs" tab in the datastore summary panel shows an overview of prune and garbage collection jobs of all datastores (issue 3217).
featureThe garbage collection job status view now displays the amount of removed, as well as, pending data.
featureAllow usernames shorter than 4 characters, as they are already allowed by the backend (issue 4819).
featureThe datastore summary now handles missing usage information gracefully and avoids logging errors to the console.
featureFix an issue where the node summary page would not display the version of a running foreign kernel (issue 5117).
featureFix an issue where individual entries of the DNS configuration for the system (searchdomain and DNS Servers) could not be deleted via the GUI.
featureFix an issue where creating a new InfluxDB metric server entry would fail if one already exists.
featureThe context menu of backup snapshots and groups now allows to copy the snapshot or group name to the clipboard (issue 5188).
featureDisallow setting an empty schedule for a prune job.
featureVarious fixes to the sync job overview.
featureFix issues where some edit windows would send API parameters that were not accepted by the backend.
featureFix an issue where the settings window would fail to reset the layout.
featureFix an issue where the GUI used an incorrect language code for Korean, and provide a clean transition for users who still have a cookie with the incorrect language code set.
featureFix xterm.js not loading in certain OS+Browser constellations, for example iOS (issue 5063).
featureFix an issue where the date picker would choose the wrong date after changing to a different month.
featureClarify the confirmation prompt for removing a certificate without a name.
featureFix an issue where edit windows would not be correctly masked while loading.
featureDisplay the end-of-life message as a notice up until three weeks before the end-of-life date, and display it as a warning from that point on.
featureMove the "Reset" button for edit windows to an icon-only button in the title bar (issue 5277). This reduces the risk of misclicking and accidentally resetting form data.
featureThe TFA input field now sets an autocompletion hint for improved compatibility with password managers (issue 5251).
featureImproved translations, among others:
featureFrench
featureGerman
featureItalian
featureJapanese
featureKorean
featureSimplified Chinese
featureSpanish
featureTraditional Chinese
breakingRemove the hard limit on the number of tapes in a media set (issue 5229). The limit was not properly enforced and, if exceeded, blocked access to most functions via API, CLI and GUI. Instead of a partially enforced hard limit, log a task warning if the media set has more than 20 media.
securityFix an issue where the encryption key of the tape-drive was unloaded too eagerly. Before proxmox-backup-server version 3.1.4-1 the additional tape-specific encryption was disabled. We recommend using the native software-defined client-side encryption for the best security.
breakingRemove whitespace when adding a subscription key, to avoid failing subscription checks due to superfluous whitespace.
breakingModels using i40e. Their names can get an additional port suffix like p0 added.
+57 more items in the release notes3.1.5 Mar 25, 2024
fixfix #5190: api: OIDC: accept generic URIs for the ACR value
breakingfix #5229: tape: remove max sequence number limit
featureclient: add "delete-groups" option to allow one to delete all groups in a hierarchy, which allows removing non-empty namespaces
fixfix #4975: client: add option to ignore E2BIG error flag when restoring, to workaround the interface limitation of the kernel where on some file systems can have a bigger extended attribute (xattr) as the kernel supports reading. This can happen due to the file system having been accessed by…
otherdocs: clarify prune settings slightly more
otherui: trim whitespaces when adding a subscription key
fixui: system config: fix deleting DNS entries
fixfix #5217: api: send missing header when upgrading to HTTP/2 to improve support with reverse proxies like caddy
otherdocs: lto barcod generator: disable add button when fields are not valid
otherdocs: lto barcode generator: add LTO-9 and WORM types
otherui: adapt to the API enforcing the not accepting any additional parameters if a API endpoint does not explicitly state that it needs that behavior:
othermetrics: avoid trying to load existing config, fixes case where a wrong digest was send along, failing the creation of the metrics host entry
otheravoid sending a 'delete' parameter on create for tape backup jobs, prune settings, sync jobs, verify jobs
otheruser edit: don't send realm property
otherserver: sync job: return PullStats for pull related methods
fixfix #5285: api: sync job: add job summary to task log
otherui: tape: transfer: increase timeout to 3 minutes
featureadd 'confirmation-password' parameter to user password change API/UI
breakingremove datastore from internal cache based on maintenance mode to avoid that a lock file is kept open. With that lock-file closed one can use a offline maintenance mode to cleanly unmount the mount point where such a datastore resides.
otherdocs: clarify difference between zfs cache and log
fixfix #5188: gui: add copy to clipboard on snapshots
otherapi: sync job: log stats for removed vanished entities
otherdocs: add examples for --exclude parameter
otherui: prune job: disallow setting blank schedule
3.1.4 Feb 1, 2024
otherapi: acme: skip serializing empty 'api' and 'data' option
fixtape: fix regression in restoring an encryption key from medium, avoid trying to load the key to the drive, which cannot work in this special case.
3.1.3 Jan 22, 2024
otherimprove efficiency of detecting if a block device is a partition
featureacme: api: add option for external account binding to account registration endpoint
otherui: datastore summary handle non-existent 'avail' and 'used' status values
featuretape: allow configuring the time out for "wait until ready" to better cope with the long initialization duration that happens on the first use of LTO 9+ tapes
othertape: improve error on decode element status page
othertape: improve LTO 9 compatibility
fixfix #4904: tape changer: add option to explicitly eject the tape before unloading it
otherdocs: tape: replace use of 'export-media' with correct 'export-media-set' option
otherdocs: tape: add LTO 9 considerations
fixfix #5117: ui: node info: avoid invalid array access for certain foreign kernels
otherd/control: explicitly depend on gdisk package to ensure it's available when installing on top of a plain Debian installation
featuretape: work around buggy changer implementations when reading the element status
othersystem report: include prune.cfg
fixfix #4315: jobs: modify group filter so include/exclude is tracked
otherui: show if Filter includes or excludes
featuredatastore: add additional context for a parsing error when getting the owner of a backup group
otherapi: tape: optionally accept uuid for destroying or moving a media, so that one can uniquely identify existing tapes with duplicate labels.
featureapi: tape: don't allow duplicate media label-texts anymore
otherui: tape inventory: use uuid as id
featureui: tape: add button to remove a medium from the inventory, while not touching the data
otherapi: custom certificate upload: make key optional and use the existing key, if it's not specified.
featureclose #4819: ui: allow usernames shorter than 4 characters
othertape: rework on-drive encryption key handling and ensure this key does not gets unloaded to early
3.1.2 Nov 30, 2023
fixsync: fix recent regression with recursive remote sync
fixsync: fix source store+namespace printing to refer to the actual namespace
featureSecure Boot support. Proxmox Backup Server now includes a signed shim bootloader trusted by most hardware's UEFI implementations. All necessary components of the boot chain are available in variants signed by Proxmox.
featureLocal sync jobs for efficiently copying backup snapshots between local datastores. This is particularly useful for complex setups involving tiered datastores, for example, where a smaller, faster datastore is used for incoming backups, and a slower one for long-term archival.
featureAutomatically upgrade HTTP connections to HTTPS.
featureSeamless upgrade from Proxmox Backup Server 2.4, see Upgrade from 2 to 3, which includes the addition of a pbs2to3 helper tool in the old stable release.
featureImprovements to the node summary panel:
featureThe summary now indicates whether the node was booted in legacy (BIOS) mode, EFI mode, or EFI mode with Secure Boot enabled.
featureThe currently running kernel is now reported more compactly by indicating only the version and the build date.
featureA new button in the datastore can now conveniently display connection information for connecting to that particular datastore from Proxmox Virtual Environment, another Proxmox Backup Server instance, or the backup client.
featureIf no comment is set for a backup group, the web GUI now displays the note of the last snapshot instead (issue 4260).
featureSupport wiping disks in the Storage/Disks menu, providing parity with the functionality in Proxmox VE (issue 3690).
featureAllow removing systemd mount units of unused mounted directories via GUI and CLI. This enables users to unmount the directory of a removed datastore, so that they can wipe and reuse the disk.
featureRight-clicking on a backup group or snapshot now opens a context menu for easier access to relevant actions.
featureAutomatically redirect HTTP requests to HTTPS for convenience. This avoids "Connection reset" browser errors that can be confusing, especially after setting up Proxmox Backup Server the first time.
featureThe ZFS creation window does not show a reset button anymore, as this button does not make sense for creation windows.
featureUpdate external links to proxmox.com that changed during the website redesign.
featureImproved translations, among others:
featureCroatian (NEW!)
featureGeorgian (NEW!)
featureArabic
featureCatalan
featureGerman
featureItalian
featurePolish
featureSimplified Chinese
featureSpanish
featureTraditional Chinese
featureUkrainian
featureSeveral remaining occurrences of the GiB unit in the GUI can now be translated (issue 4551).
featureSupport for local sync jobs that pull contents of a local datastore to another local datastore. Previously, sync jobs could only pull datastores from remote Proxmox Backup Server instances over the network. Now, sync jobs can alternatively pull contents from a local datastore.
featureCreating a datastore with prune options now creates a corresponding prune job (issue 4374). Previously, the prune options given on datastore creation were ignored.
featureThe backup task log now contains the IP address of the client initiating the backup, in order to simplify troubleshooting (issue 3777).
featureFix an issue where garbage collection would fail with an error if a snapshot is deleted while the job is running. This situation is now handled gracefully without an error (issue 4823).
featureFix an issue where scheduled garbage collection would not run if the task log of the previous garbage collection was missing, for example due to a host crash or power loss (issue 4895).
featureWith the Proxmox repositories having support for fetching them directly the changelogs for new package versions shown in the UI are now all gathered with apt changelog.
featureImprove checks when setting up an offline subscription key.
featureMails sent by Proxmox Backup Server now contain an Auto-Submitted header to avoid triggering automated replies (issue 4162).
featureImprove clarity of API parameter verification errors by showing a list of errors if there is more than one error.
featureImprove the proxmox-backup-debug tool output by including the chunk size and compression state of chunks.
breakingSome users with Intel Wi-Fi cards, like the AX201 model, reported that initialization of the card failed with Linux kernel 6.5. This is still being investigated. You should avoid booting into the new kernel if you have no physical access to your server and an Intel Wi-Fi device is used as its only…
breakingSome SAS2008 controllers need a workaround to get detected since kernel 6.2, see the forum thread for details.
+33 more items in the release notes3.0.4 Oct 2, 2023
otherrebuild with env_logger 0.10, proxmox-api-macro 1.0.6 and syn 2
otherupdate dependencies (tokio, libc, serde, openssl, futures, bindgen)
3.0.3 Sep 27, 2023
fixfix #4380: client: check if file is excluded before running stat() to get metadata
otherimprove error messages when parsing a chunk fails
featureadd support for LTO-9 tape density code
fixpbs2to3: fix boot-mode detection, "/sys/firmware/efi" either doesn't exist (legacy boot) or is a directory (EFI boot), but never a file.
fixfix #4761: client: restore: unlink existing entries for hard/symlinks when overwrite-existing flag is enabled
otherclient: restore: provide finer-grained controls for what (files, sym-links, hard-links, or all) to overwrite on restore if the target already exists.
otherui: don't show form-reset button on ZFS creation
featureclose #3777: backup: add client-ip information to worker task log
fixfix #4343: client cli: exit with failure-code if a worker-task finished with a unknown, or an error status.
breakingfix #4823: datastore: ignore vanished files when walking over namespace and groups hierarchy. This avoids a rare chance of failing a running garbage-collection when a snapshot is removed by the user or a prune job during the same time.
fixfix #4895: scheduled jobs: ignore task-log not found error to avoid a stuck job after, e.g., the system was shutdown uncleanly, for example, due to a powerless.
3.0.2 Aug 1, 2023
otherdocs: update FAQ release support table, add PBS 2.x EOL date
fixencrypted backup: fix log message
otherreset tfa failure count when unlocking
othersync over pbs2to3 upgrade check-list script to master
otherpbs-client: pxar: preserve error context
otherpbs-client: pxar: refactor body of extract_archive to ExtractorIter
featurepbs-client: pxar: add PxarExtractContext
featureproxmox-backup-client: restore: add 'ignore-extract-device-errors' flag
otherdocs: replace concrete device paths with pseudo paths
otherpbs-client: backup-writer: use log::warn instead of eprintln!
fixfix #4591: pbs-client: backup_writer: improve error reporting
otherbackup: improve skipped download error message
otherhandle pve-kernel -> proxmox-kernel rename
3.0.1 Jun 27, 2023
securitybuild with newer proxmox-rest-server to remove the full static file path from error messages, which might trigger some simple security scanners confusing the API server with a classic (file serving) HTTP server.
otherbuild with newer proxmox-apt to fix #4653: (In)Release file: improve handling of special suites
fixui: user view: fix refresh for TOTP-locked column
otherapi: node services: switch to systemd-journald and chrony instead of syslog and systemd-timesyncd, respectively
otherdocs: consistent spelling of "USB flash drive"
otherdocs: fix spelling of "command line" (noun) & "command-line" (adjective)
otherBased on Debian Bookworm (12.0)
otherLatest 6.2 Kernel as stable default
otherZFS 2.1.12
featureNew major release based on the great Debian Bookworm.
featureSeamless upgrade from Proxmox Backup Server 2.4, see Upgrade from 2 to 3
featureIncrease the flexibility of sync-jobs with the new transfer-last option.
featureAdd new text-based UI mode for the installation ISO, written in Rust using the Cursive TUI (Text User Interface) library.
featureImproved Dark color theme: The Dark color theme, introduced in Proxmox Backup Server 2.4, received a lot of positive feedback from our community, which resulted in further improvements.
featureTape backup and restore tasks are now included in the task summary.
featureWhen labeling a tape in a changer, the default value cannot be overridden in the GUI anymore: Proxmox Backup Server relies on the label being identical to the barcode, so it is not advisable to change the label. If having a different label is required, then it is still possible to override this…
featureFixed an issue where the GUI would not immediately refresh the subscription information after uploading a subscription key.
featureImproved translations, among others:
featureUkrainian (NEW)
featureJapanese
featureSimplified Chinese
featureTraditional Chinese
featureThe size units (Bytes, KB, MiB,...) are now passed through the translation framework as well, allowing localized variants (e.g., for French).
featureThe language selection is now localized and displayed in the currently selected language
featureChunk store now handles specific edge cases during insertion more gracefully.
featureUpdated the kernel of the image that proxmox-backup-restore-image uses to 6.2.16 and ZFS 2.1.12. This can be particularly useful when trying to restore from guests that used newer features of a filesystem that are only supported by newer kernel versions, for example with Btrfs or ZFS volumes.
featureIn HTTP error responses, mention the requested path instead of the filesystem path, to avoid triggering automated security scanners.
featureWhen authenticating via PAM, pass the PAM_RHOST item. With this, it is possible to manually configure PAM such that certain users (for example root@pam) can only log in from certain hosts.
featureIncrease the flexibility of sync-jobs with the new transfer-last option: Specifying this parameter will only transfer the newest n backups, instead of all backups.
featureImproved log output for sync jobs: In order to improve readability, the log now contains one opening line for every backup group.
featureproxmox-backup-manager user tfa now supports list and delete commands (issue #4734). These can be used to list all currently configured TFA tokens as well as delete them.
featureproxmox-file-restore now honors the environment variable PBS_QEMU_DEBUG.
featureFix an issue where running the status command would fail with a traceback (issue #4638).
featureImproved error handling when zipping a directory fails, by exiting early if a fatal error occurs.
otherImproved reading attributes from tapes that use medium auxiliary memory (MAM).
otherShow a list of required tapes when restoring a single snapshot, like it has been the case for full restores already.
featureAdded a fallback mode for tapes only supporting the 6 byte variant of the MODE SENSE or SELECT commands. This improves compatibility with some tape drives and libraries, for example the StarWind VTL.
fixFixed an issue with media-sets that have multiple datastores, where trying to restore a single datastore via the GUI would inadvertently restore all datastores.
featureAdd TFA/TOTP lockout to protect against an attacker who has obtained the user password and attempts to guess the second factor: If TFA fails too many times in a row, this user account is locked out of TFA for an hour. If TOTP fails too many times in a row, TOTP is disabled for the user account.…
breakingRemove support for unauthenticated LDAP binds (where no password is given), which are not supported in Proxmox VE either.
fixFixed an issue where certain prune job tasks did not show up in the task summary.
fixFixed an issue where garbage collection would incorrectly show warnings when namespaces were used by a datastore (issue #4357).
fixFixed a bug that prevented entering netmasks for networks with CIDR prefix length smaller than /8 in the network interface configuration (issue #4722).
fixRestoring files from a ZFS snapshot directory now works with proxmox-file-restore (issue #4477).
breakingUser accounts will now be locked after too many attempts to authenticate with a second factor. This is intended to protect against an attacker who has obtained the user password and attempts to guess the second factor. Unlocking requires either a successful login with a recovery key or a manual…
breakingSystems booting via UEFI from a ZFS on root setup should install the systemd-boot package after the upgrade. The systemd-boot was split out from the systemd package for Debian Bookworm based releases. It won't get installed automatically upon upgrade from Proxmox VE 7.4 as it can cause trouble on…
+3 more items in the release notesotherBased on Debian Bullseye (11.6)
otherLatest 5.15.102 Kernel as stable default
otherNewer 6.2.6 kernel as opt-in
featureProxmox Backup Server now provides a dark theme for the web interface & the documentation.
featureAdd LDAP as a new user authentication realm.
featureAdd initial support for WORM (write once, read many) tapes.
featureAdd a fully-integrated "Proxmox Dark" theme variant of the long-time Crisp light theme.
featureTask logs can now be downloaded directly as text files for further inspection.
featureThe Add User dialog has now a realm field, making it possible to add users to an LDAP or OpenID Connect realm manually.
featureImprove the UI for verification jobs, showing the namespace and max-depth columns and allowing one to edit those fields in the edit job window (#4448).
featureThe 'Services' panel of the 'Administration' section now marks optional services that are not installed as not installed instead of marking them as dead.
featureIn order to make it more obvious how to disable scheduled Garbage Collection (GC), the 'GC Schedule' window now shows an X button that resets the schedule to none.
featureFor prune jobs, rename 'Store' to 'Datastore' for consistency reasons.
featureFixed the default value for pruning mail notification settings in the datastore options.
featureFixed rendering the 'Enabled' column for the 'Metric Server' view.
featureImproved translations, among others:
featureArabic
featureFrench
featureGerman
featureItalian
featureJapanese
featureRussian
featureSlovenian
featureSimplified Chinese
featureTraditional Chinese
featureAdd LDAP realm authentication and user synchronization
featureSuppress harmless but confusing "storing login ticket failed" errors when backing up to Proxmox Backup Server.
featureThe proxmox-backup-manager CLI tool can now be used to trigger an existing prune, verification, or sync job manually.
featureThe output of the proxmox-backup-debug diff archive command was improved.
featureProvide higher runtime control for logging in the pxar CLI tool (#4578).
featureVarious improvements for error handling and reported messages to improve user experience.
featureAdd initial support for WORM (write once, read many) tapes
featureImplement dark mode that honors the prefers-color-scheme media query automatically.
featureAdd dark mode support to the API viewer widget.
fixDon't interrupt tasks when pressing Ctrl + C when viewing task logs via proxmox-backup-manager task log or proxmox-backup-client task log (#4483).
fixproxmox-backup-client now prints task logs to stdout instead of stderr (#4387).
fixRemoval of all associated prune jobs and ACL entries when their data store is deleted (#4256).
fixFixed a bug where snapshots were not listed in a tape media set (#4466).
fixWarn if a login ticket could not be stored (e.g. due to $XDG_RUNTIME_DIR not being set, which can happen if invoked via sudo) (#4346).
fixReduce lock contention of the verify-after-complete feature with periodic syncs (#4523).
+4 more items in the release notesotherBased on Debian Bullseye (11.5)
otherLatest 5.15 Kernel as stable default (5.15.74)
otherNewer 5.19 Kernel as opt-in
otherZFS 2.1.6
otherEnhancements in the Web Interface (GUI):
featureDatastore permissions: Allow editing the ACL path and query the available namespaces and add them as ACL path to the pre-defined selections for convenience
featureDatastore content: Only mask the inner view of the content tree on error, to allow a user to trigger a manual reload using the reload button in the top bar
otherImprove navigating the whole Proxmox Backup Server web UI when a user only has limited permissions on a specific (sub-)namespace
otherShow block device partition tree on the web UI
featureImprove the prune-simulator, among other things allow setting a custom simulation "now" date/time
otherImproved certificate view - for example for certificates with many SANs
otherImproved translations, among others:
otherArabic
otherDutch
otherGerman
otherItalian
otherPolish
otherTraditional Chinese
otherTurkish
featureAdd Namespace Aware Prune Jobs
otherExpand the single-schedule per datastore to a flexible, namespace aware prune job system
featureAllow fine-grained control over when and how deep a specific namespace get pruned
otherIn addition to above, the manual prune action also became more powerful w.r.t. namespace and prune-depth selection
featureImplement email notifications for prune jobs
otherRework the task log outputs for prune job workers
featureNative Support for Sending Periodic Metrics to InfluxDB
featureSupport for HTTP(S) and UDP endpoints
otherOptionally TLS certificate validation can be disabled for HTTPS endpoints
otherMetric data is aligned as good as possible to the stats sent from a Proxmox VE node.
otherMetrics include:
featureProxmox Offline Mirror: The tool supports subscriptions and repository mirrors for air-gapped systems. Newly added proxmox-offline-mirror utility can now be used to keep Proxmox Backup Server hosts, without access to the public internet up-to-date and running with a valid subscription.
featureProxmox-backup-client: Added ignore-acls, ignore-xattrs, ignore-ownership, ignore-permissions and overwrite parameters to the restore command: If any of the ignore parameters is set the corresponding metadata is not restored - e.g. there is no chown call if ignore-ownership is set. The overwrite…
featureFile-restore: Add 'format' and 'zstd' parameters to 'extract' CLI command.
featureAdd the diff sub-command to proxmox-backup-debug, allowing one to compare pxar archives for two arbitrary snapshots, outputting a list of added/modified/deleted files.
fixFix an issue with the mount subcommand, where reading large files could yield corrupt data.
featureNew mail-forwarding binary proxmox-mail-forward: It unifies the configuration for sending the system-generated mails to the email address configured for root@pam, with Proxmox VE.
featureImplement sync-level option for datastores, allowing one to configure how backup data is synced to disk to match their respective setup and needs.
featureSMART: Add raw field, for compatibility with the Proxmox VE API - it contains the same data as value, which for now is kept for backwards compatibility
featureSMART: Don't treat certain non-zero exit codes of smartctl as error (if bit 2 of the exit-code is set the returned data is still parseable) - aligns with the implementation in Proxmox VE
featureMove some blocking parts off to their own (reused) thread to reduce the chance of sometimes blocking the tokio reactor thread handling things like new incoming connections
+26 more items in the release notesotherBased on Debian Bullseye (11.3)
otherKernel 5.15
otherZFS 2.1.4
otherEnhancements in the web interface (GUI):
featureAdd "Group Filter" tab to the "Add" and "Edit" windows of sync and tape-backup jobs
featureAllow configuration of the default language used in the web interface
featureAdd Markdown aware panel for recording structured notes, and support multi-line comments in the node configuration file.
otherHide RRD chart for IO delay, if no `io_ticks` are returned
otherImproved translations, among others:
otherArabic
otherFrench
otherGerman
otherJapan
otherPolish
otherTurkish
featureDatastore Backup Namespaces: Namespaces allow for the reuse of a single chunk store deduplication domain for multiple sources, while avoiding naming conflicts and enabling more fine-grained access control. With the max-depth setting, you can control how deep the recursion on finding groups to sync…
featureImplement backup namespaces for datastores.
featureAdd support for syncing a source namespace into any target namespace.
featureAdd support for namespaces in current Proxmox VE 7.2, the following versions form the baseline:
featureMaintenance Mode and Active Operations Tracking: Track whether each datastore access is a write or read operation, so that Proxmox Backup Server can gracefully enter the respective mode, by allowing conflicting operations that started before the maintenance mode to finish. Once enabled, depending…
featureImplement read-only and offline maintenance modes for a datastore.
featureGeneral backend improvements: While inode-sorting benefits read performance on block devices with higher latency (for example, spinning disks), it also requires extra work to get the metadata needed for sorting, so it's a trade-off. For setups that have either very slow or very fast metadata IO,…
otherImprove memory footprint The glibc allocator has a misguided heuristic to detect transient allocations, which will only start to use mmap in allocation sizes above 32 MiB. This means that relatively large allocations end up on the heap, where cleanup and returning memory to the OS is harder to do…
otherImprove interaction with the glibc system allocator to dramatically decrease peak and overall RSS memory usage
otherOptimize LRU caches
featureAdd streaming interfaces for some API endpoints, such as the task-log list or snapshot list. This can remove the need to collect large lists into intermediate memory buffers.
otherTransform all access to group or snapshot lists to efficient, lazy iterators.
otherImprove IO access pattern for some scenarios, like TFA with high user and login count.
otherDisable SSL/TLS renegotiation in the API daemon.
otherFor zpools created via the API, set the `relatime=on` flag by default.
featureAllow for the disabling of inode-sorting for chunk iteration.
featureAdd dry-run option for the proxmox-backup-client backup CLI command.
featureVerify: Allow one to enforce verification when manually verifying a datastore or namespace through the web interface
otherImprove reload behavior of the proxmox-backup-proxy API daemon
featureImprovements on file restore The tar archive supports more file types (for example, hard links and device nodes), and zstd allows for fast, efficient, and effective compression. This improves the handling of non-ASCII code point extraction under Windows. On average the restore-tool should be…
featureAdd support for zstd-compressed tar archive download, in addition to the existing zip download option.
featureAdd language encoding flag (EFS) to files when creating a zip archive, if an entry is valid UTF-8.
featureAllow up to 25s for the file-restore VM to have scanned all possible filesystems in a backup.
otherImprove IO access in the file-restore-for-block-backup VM's internal driver, and start disk initialization in parallel to staring the API listening task.
otherAvoid automatically pre-mounting ZFS pools.
otherBased on Debian Bullseye (11.1)
otherKernel 5.13
otherZFS 2.1
otherEnhancements in the web interface (GUI):
featureAdd traffic control management panel in the web interface.
otherLoad and usage graphs now have much higher resolution.
otherDisplay the next media label for a tape backup job.
otherImproved translations, among others:
otherArabic
otherBasque
otherBrazilian Portuguese
otherFrench
otherGerman
otherSimplified Chinese
otherTraditional Chinese
otherTurkish
featureEnhancements in Backup Management Implement a token bucket filter (TBF) for limiting incoming (for example, backup) and outgoing (for example, restore) traffic from a set of networks. Limits can be configured such that they get applied only during specific time-frames. For such a job, you can…
otherSupport flexible traffic-control bandwidth limits:
featureSupport for protected backups, which will not be pruned and cannot be removed manually, without first removing the protected flag.
otherSupport group-filter for sync jobs and tape-backup jobs:
otherEnhance existing OpenID Connect (OIDC) support:
featureAdd support for configuring an arbitrary username claim.
featureAllow setting the requested scopes for user information requests. The default remains the same (profile and email).
otherThe prompt behavior is now unset (previously hard-coded to login) and can be configured to the OIDC specification defined variants or an arbitrary extension.
otherYou can now configure Authentication Context Class Reference (ACR) values to be requested on any authentication request.
featureImproved Round Robin Database implementation
otherUses a journal to avoid data loss
otherUses much higher resolution:
otherper-day: 1 min (previously 30 min)
otherper-month: 30 min (previously 12 hours)
otherper-year: 6 h (previously 1 week)
otherper-decade: 1 week (previously none)
otherStores data for last 10 years
otherBackend
featureNew debugging tool proxmox-backup-debug
featureImproved support for various tape drives and changers
otherBased on Debian Bullseye (11)
otherKernel 5.11
otherZFS 2.0
otherTape Backup:
otherMatured from technology preview to the first stable release
otherImprove restore flexibility, allowing you to select multiple snapshots for one restore job
otherRead chunks sorted by inode on backup, to leverage improved read speed on slow spinning disks with increased sequential access
otherBackend:
featureSupport for Single-Sign-On (SSO) with the new OpenID Connect access realm type You can integrate external authorization servers, either using existing public services or your own identity and access management solution, for example, Keycloak or LemonLDAP::NG.
otherACME/Let's Encrypt integration with stand-alone and DNS Plugins, for easy deployment of trusted certificates
otherImproved caching for proxmox-backup-client map
featureSingle file-restore support for VMs that use ZFS or LVM internally
otherSupport setting an HTTP proxy for package updates and subscription check requests
otherEnhancements in the web interface (GUI):
otherMake dashboard status panel more detailed, showing, among other things, uptime, Kernel version, CPU info and a high level repository status overview.
featureNew Repository management panel in the Administration tab shows an in-depth status and a list of all configured repositories. Basic repository management, for example, activating or deactivating a repository, is also supported.
otherACME/Let's Encrypt GUI integration
otherSupport setting comments on a backup group
otherUpdated ExtJS JavaScript framework to latest GPL release 7.0
otherImproved translations, including:
otherArabic
otherFrench
otherGerman
otherJapanese
otherPolish
otherTurkish
otherInstaller:
otherRework the installer environment to use switch_root instead of chroot, when transitioning from initrd to the actual installer. This improves module and firmware loading, and slightly reduces memory usage during installation.
otherAutomatically detect HiDPI screens, and increase console font and GUI scaling accordingly. This improves UX for workstations with Proxmox VE (for example, for passthrough).
otherImprove ISO detection:
otherSupport ISOs backed by devices using USB Attached SCSI (UAS), which modern USB3 flash drives often do.
featureLinearly increase the delay of subsequent scans for a device with an ISO image, bringing the total check time from 20s to 45s. This allows for the detection of very slow devices, while continuing faster in general.
otherUse zstd compression for the initrd image and the squashfs images.
otherUpdate to busybox 1.33.1 as the core-utils provider.
otherNetwork: Due to the updated systemd version, and for most upgrades, the newer kernel version (5.4 to 5.11), some network interfaces might change upon reboot:
otherSome may change their name. For example, due to newly supported functions, a change from enp33s0f0 to enp33s0f0np0 could occur. We observed such changes with high-speed Mellanox models.
otherBridge MAC address selection has changed in Debian Bullseye - it is now generated based on the interface name and the machine-id (5) of the system. Note that by default, Proxmox Backup Server does not uses a Linux Bridge for networking, so most setups are unaffected.