Proxmox Backup Server 4.0.21 → 4.2.4
19 releases · 2 breaking changes · 0 security fixes · 0 advisories fixed
0security2breaking2deprecated111feature42fix
Breaking changes
- breaking css: remove x-grid-row-loading class, replace it with non-blurry SVG variant from proxmox-widget-toolkit in 4.2.3
- breaking fix client metadata-mode incremental backups breaking with strict payload-offset rejections introduced in pxar 1.0.1: hold-back chunks could survive across cache-range discontinuities and produce non-monotonic PXAR_PAYLOAD_REF offsets on disk. Inject any held chunk explicitly when a discontinuity… in 4.1.12
Security changes
None in the release notes.
Deprecations
- deprecated api schema/section config: add support for declaring deprecated property aliases, to allow renaming properties without showing the old name in the documentation in 4.2.3
- deprecated rest server: accept deprecated property aliases in JSON request bodies by rewriting them to the canonical name before verification and dispatch, like the CLI and query-string handling already do. in 4.2.3
Every release in between
4.2.4 Jul 29, 2026
otherdocs: document the debug symbol repository
fixdatastore: fix wrong local path used for S3 bad chunk handling during garbage collection
otherrefactor file creation/mode/ownership helpers to proxmox-product-config crate
fixfix #7642: avoid expensive user lookups on file locking by caching the backup user/group ID
otherdepend on proxmox-enterprise-support-keyring, and track its version in the package version API endpoint
fixfix #5748: docs: add catalog.pcat1 format specification
otherdocs: system requirements: document we recommend local storage
fixS3: fix #6841: allow configuring request rate limits by updating to proxmox-s3-client 1.4.1. these rate limits are split into active and passive methods, allowing separate handling of POST/PUT/DELETE and GET/HEAD request limits.
featureS3: config: allow editing the use-node-config flag that controls whether requests S3 endpoints honor the node's proxy settings or not
othersync: push: gracefully handle previous manifest signature mismatches, which can happen when enabling or disabling push-encryption on an already synced backup group
4.2.3 Jul 14, 2026
breakingcss: remove x-grid-row-loading class, replace it with non-blurry SVG variant from proxmox-widget-toolkit
featurepbs-client: add backoff log throttle, to ensure progress and similar output appears quickly initially, but does not create overly long logs
otherclient: report progress during restore
featureapi: journal: adopt proxmox-syslog-api and stream the output, making the implementation consistent with the one from Proxmox Datacenter Manager
otherui: enable the structured journal view and per-service logs, including colored output and filtering capabilities
otherui: always use arrays for 'delete' property, instead of manually converting
fixfix #5971: tape: don't warn on custom MAM attribute write failures
fixfix #7175: api: time: use timedatectl instead of /etc/timezone
fixfix #7187: report: add ethtool output for physical interfaces
featureprune jobs: schedule jobs that do not prune anything, but warn during their execution. such jobs allow testing scheduling options, but make no sense for production use.
fixfix #6691: allow search by comment in datastore content, make search case-insensitive and correctly reset content view after empty searches
otherui: datastore: disable various action tooltips for actions which cannot be triggered
otherldap: escape the user-provided user name when using it in the LDAP search filter that looks up the user DN.
otherldap sync: log which user properties change when synchronizing an existing user, instead of only reporting that the user was updated.
deprecatedapi schema/section config: add support for declaring deprecated property aliases, to allow renaming properties without showing the old name in the documentation
deprecatedrest server: accept deprecated property aliases in JSON request bodies by rewriting them to the canonical name before verification and dispatch, like the CLI and query-string handling already do.
fixfix #7690: fs: replace_file: close the temporary file before renaming or unlinking it, fixing the replacement on WORM file systems and avoiding leftover .fuse_hidden files on FUSE mounts.
otherfs: make_tmp_file: append the temporary suffix instead of replacing the file extension, keeping the original file name intact for easier debugging of leftover temporary files.
4.2.2 Jun 18, 2026
otherapi: backup: run synchronous chunk-insert operations off the asynchronous runtime's worker threads. Blocking those threads, most notably during S3 uploads that can wait up to three hours for a chunk lock, could stall the I/O and timer drivers of the entire runtime and starve other backup workers.
otherclient: backup: make the file-based backup more robust against files that cannot be accessed or that vanish while the backup is running:
fixfix #7658: skip a file and log a warning instead of aborting the whole backup when querying its metadata fails with a permission error, matching the existing handling of permission errors when opening files. Such files can also still be excluded explicitly.
otherconsistently ignore files that disappear during the backup and warn about them, instead of treating this as a fatal error in some cases.
fixtape: backup: fix the command-line group filter, which was passed to the API under the wrong parameter name and thus had no effect.
otherapi: do not log a spurious error when listing the files of a snapshot whose manifest does not exist yet, which is expected while a backup to that snapshot is still running.
fixui: datastore summary: fix the per-datastore sync and prune job counts, which were derived from an incorrectly parsed datastore ID; the prune count in particular was always shown as zero.
fixtape: fix two typos in log and informational messages.
4.2.1 May 26, 2026
fixfix #5076: api: support an 'audiences' property on OpenID realms, listing additional trusted audience values besides the configured client-id. Improves compatibility with providers that issue tokens with multiple audiences.
fixfix #7562: api/ui: tape: separate the format-media 'load-barcode' parameter from the existing 'label-text' verification, so the web interface can load and format empty or previously-unrelated tapes from a changer slot in one step. The old shared parameter aborted formatting after a successful load…
othersync: pull: refuse to overwrite a locally encrypted snapshot from an unencrypted source or one using a different key, and detect content differences between two unencrypted snapshots that share a backup time. Previously such mismatches silently triggered a resync that overwrote the local snapshot.
fixdatastore: fix tuning option changes not propagating the updated sync level to the chunk store until the service was restarted.
otherdatastore: improve the error message when prune cannot acquire a snapshot lock for deletion, by showing the snapshot directory and lock file paths instead of an internal debug dump.
fixapi: backup: fix benchmark, finish-failed, and backup-failed cleanups leaving an orphaned empty backup group behind on the datastore.
otherapi: node: tasks status: return the task end time as an optional field once the task is finished, so the task viewer can render the correct duration without an extra API call.
featureapi/ui: node: add a 'location' property to the node config, exposed through the node options panel.
othersubscription: reuse the server ID from an existing subscription info when multiple candidates are detected, falling back to the first candidate only when no prior info exists.
otherchunk store: include the filesystem backing path in the syncfs log output for easier identification of which directory is being synced.
othertree-wide: print error chains as a colon-separated single line and stop quoting simple errors without context, making logs and CLI output easier to read at a glance.
otherui: encryption keys: extract the error message from API2 responses before displaying the alert, so permission and other endpoint errors no longer surface as an empty popup.
otherremovable device attach service: clarify the systemd unit description so it no longer suggests that mount is attempted for every device or that every device is a datastore.
otherdocs: faq: correct the Debian Bookworm end-of-life date; the last point release is planned for July 2026.
featureLatest 7.0 Kernel as new stable default
featureAllow moving groups and namespaces. Backup groups and namespaces can now be moved to different locations within the same datastore. This allows users to reorganize existing backups while ensuring data consistency.
featureServer-side encryption for push sync jobs. Push sync jobs can now be configured to encrypt snapshots before sending them to remote datastores. For example, this can be used to push snapshots to Proxmox Backup Server instances in less trusted offsite locations. Furthermore, pull sync jobs can be…
featureConcurrent group pull/push processing for sync jobs. Sync jobs can now process multiple groups in parallel by configuring the new worker-threads property. This can significantly improve throughput on high latency networks.
featureS3-compatible object stores as backup storage backend officially supported, including request statistics and notification thresholds. Using S3-compatible object stores as a backup storage backend has graduated from the technology preview phase and is now officially supported. S3-backed datastores…
featureKernel 7.0 as the new stable default.
featurePersist the column state of the datastore usage panel on the dashboard (issue 7412).
featureExpose new option to use the node's HTTP proxy for remote connections in the remote edit window.
featureFix an issue where creating a new user would change the pre-selected realm for the currently logged-in user (issue 7149).
featureFix an issue where OpenID Connect logins would drop the originally requested URL, preventing deep links from working correctly (issue 7337).
featureSet datastore usage related titles based on the backend type. For example, the "Storage Usage" column is now labeled "Local Cache Usage" for S3-backed datastores.
featureUpdated translations, among others:
featureCzech
featureFrench
featureGerman
featureItalian
featureJapanese
featureKorean
featurePolish
featureRussian
featureSimplified Chinese
featureSpanish
featureSwedish
featureTraditional Chinese
featureAllow moving groups and namespaces (issue 6195). Backup groups and namespaces can now be moved to different locations within the same datastore. This lets users reorganize existing backups while ensuring data consistency through per-group locking. Any lock conflicts are gracefully handled by…
featureConcurrent group pull/push processing for sync jobs (issue 4182). Sync jobs can now process multiple groups in parallel by configuring the new worker-threads property. This can significantly improve throughput on high latency networks, overcoming HTTP/2 connection limitations. Log messages are now…
featureMake the garbage collector run automatically on removable datastores when they are unmounted, if the new gc-on-unmount flag is set (issue 7465).
featureUse proper errors for fixed-index inputs instead of panics so a corrupted or unexpected index state fails the single backup task instead of crashing the service.
featureFix a bug that allowed users with powerful Sys.Modify privileges to inject arbitrary options into an apt-get invocation (PSA-2026-00003-1).
featureFix an issue which caused the API to leak information about whether a user exists if certain conditions are met (PSA-2026-00008-1).
featureSupport configuring the proxy daemon's real peer-IP header and allowed source IP addresses through environment variables (PSA-2026-00009-1). The PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM variables can be set by overriding the proxmox-backup-proxy.service systemd unit. This enables…
featureAllow remote connections to optionally use the node's configured HTTP proxy (issue 3723). When configuring a remote, there is now an option to route the connection through the node's HTTP proxy.
featureImplement datastore config caching to avoid re-parsing the whole config on every access, improving performance with a large number of datastores (issue 6049).
featureFix include/exclude pattern matching for nested paths on both server and client (issue 7382). Anchored patterns in subdirectories would fail to match because the leading slash was not added when building the nested pattern.
featureFix an issue where modifying the IPv6 network configuration would overwrite an existing config method like auto with manual (issue 7329).
featureFix push sync jobs cleanup on datastore destroy.
featureFix a bug that prevented push sync jobs from being enumerated in the 'matcher-field-values' API endpoint.
featureIntegrate upstream fixes for the "Crackarmor" AppArmor vulnerabilities (PSA-2026-00010-1).
featureFix a bug where corrupted or missing job state files would prevent users from viewing configured jobs (issue 7400). The API now gracefully handles such errors by returning an unknown job state instead of failing. Furthermore, the proxy daemon now actively self-heals corrupted state files by…
featureImprove detection of configured Proxmox repositories by verifying their signature rather than relying solely on the repository URI (issue 5207). This fixes a spurious "No repository is enabled" warning in the Repositories panel when using a mirrored repository (for example, via the Proxmox Offline…
+31 more items in the release notes4.1.13 Apr 28, 2026
fixfix #5247: client: sanitize relative paths in pxar exclude patterns. Patterns starting with ./ or containing /../ silently never matched any files during a backup; they now go through the same sanitization as the paths they are matched against, and emit a warning if rewritten.
othersync: rename the internal manifest field 'change-detection-fingerprint' to 'sync-source-signature'. Avoids confusion with the unrelated client 'change-detection-mode' parameter, especially in log output. Read access falls back to the legacy field name for already-synced snapshots.
fixpull sync: fix subsequent decrypting pulls re-downloading an unchanged snapshot for the chain signed backup -> encrypting push -> decrypting pull. Decrypt-pull strips the 'sign-only' crypt-mode marker on the local target so the source-side signature check no longer reproduces; now also accept the…
otherpull sync: store and check a sync-source-signature on decrypt-on-pull, so subsequent pulls of an unchanged source snapshot can be skipped without re-downloading and re-decrypting the snapshot's files.
otherclient: pxar: rework the metadata-mode incremental-backup fix from 4.1.12 to avoid metadata-archive index bloat. Use a tighter chunk-identity check at the chunk-reuse decision sites instead of forcing injection on every cache-range hole; preserves the PXAR_PAYLOAD_REF monotonicity guarantee…
otherdatastore: dynamic-index reader: read ctime from the index header instead of the current time. Accidentally regressed by a 2020 refactor; reachable only via the proxmox-backup-debug inspect tool, which now shows the actual creation time of an inspected .didx file.
otherproxmox-backup-debug: produce deterministic output when inspecting index files (sort the chunk-digest list).
featureui: datastore content: reliably refresh the view after namespace operations. Always reload after a partial namespace move so successfully-moved groups disappear from the source view, and fix double-click navigation into a namespace that was just added by a manual reload.
featureui: datastore content: widen the actions column so all icons (including the file-browser icon) remain visible after the namespace/group move feature added another icon.
otherdatastore: when a backup group lock cannot be acquired, log the on-disk paths of the group and lock file instead of an internal BackupGroup struct debug dump.
otherdatastore: move group / move namespace: polish operator-facing log and error output. Use human-readable snapshot timestamps (not raw epoch seconds) in overlap errors, emit the "moving group X" context log line before the pre-move check so subsequent warnings have visible context, use "snapshot…
4.1.12 Apr 28, 2026
otherpull sync: surface CRC errors on the source manifest as actual errors instead of silently treating them as a vanished snapshot.
otherpull sync: bail with a snapshot-prefixed 'archive missing on source' error when fetching a referenced archive returns no data, instead of silently continuing and failing later in the index parser with a confusing message.
otherpull sync: handle vanished snapshots uniformly between local and remote sources, so a concurrent prune during a local-source sync no longer aborts the whole group with 'No such file or directory' but skips the affected snapshot like the remote path already did.
otherpull sync: clean up leftover .tmp files and the otherwise empty freshly-created snapshot directory when a source snapshot vanishes mid-sync or a referenced archive is missing, and drop the misleading 'sync done' log line for snapshots that never actually synced.
otherpull sync: emit an explicit 'skipped' log line for snapshots that fail the verified-only or encrypted-only post-filter check, so the encrypted-only rejection case is no longer silent.
breakingfix client metadata-mode incremental backups breaking with strict payload-offset rejections introduced in pxar 1.0.1: hold-back chunks could survive across cache-range discontinuities and produce non-monotonic PXAR_PAYLOAD_REF offsets on disk. Inject any held chunk explicitly when a discontinuity…
otherclient: show the full error context on upload failures in single-line form, restoring information that was lost when the metadata and payload upload streams were split.
otherui: sync/verify view: show the correct duration of finished tasks in the task log window, instead of computing the duration against the current time.
4.1.11 Apr 25, 2026
featurepull sync: avoid double-decoding blob files on the decrypt-on-pull path, which broke any pull sync job that should have decrypted snapshot manifests, catalogs or other blob files using a configured decryption key. The decrypt-on-pull feature was introduced in 4.1.9.
featurepull sync: also fetch the client log for local sync jobs, where the implementation had been a no-op stub since the trait was first introduced. Skip silently if the source snapshot has no client log, matching the existing behavior of remote sync jobs.
otherpull sync: decrypt the client log on the fly when a matching decryption key is configured, mirroring the existing decrypt-on-pull behavior for the rest of a snapshot's data.
featureui: encryption keys: always enable the tape key restore button and rename it to 'Restore Tape Key'. Restoring loads a new key, so an existing tape key does not need to be selected first; this matches the existing behavior in the tape backup view.
4.1.10 Apr 24, 2026
featureapi: add new '/nodes/localhost/identity' endpoint that returns a stable, unique instance ID derived from /etc/machine-id, for uniquely identifying a PBS node. Primarily useful for matching PBS storages in a PVE cluster to PBS remotes in PDM.
featureclient, manager: add 'server-identity' CLI subcommand to query the instance ID from the backup client and admin tools.
featurecli: migrate the 'move-group' and 'move-namespace' commands introduced in 4.1.9 from the manager to the backup client, exposed as 'group move' and 'namespace move' respectively, where they fit better alongside the other group and namespace subcommands. This also implicitly fixes any permission…
otherapi: namespace move: create the target namespace automatically if it does not exist yet (its parent namespace must still exist), matching what a plain file 'mv' does.
fixfix: sync: pull: distinguish signed-only from fully encrypted snapshots when deciding whether to decrypt on pull. The mere presence of a key fingerprint on the source manifest was previously taken as proof of encryption, which could cause pull sync jobs with a matching decryption key to fail on…
otherpartially fix #6372: acme: also pick a shorter renewal lead of half the certificate lifetime for short-lived certificates (under ten days total), following the Let's Encrypt integration guide. The previous 1/3 fraction still applies for longer-lived certificates.
otherui: datastore create: drop the now outdated 'technology preview' label for S3-backed datastores.
otherui: tape: tune vertical alignment of the tape icon in tree views so it sits better next to the surrounding text.
otherdocs: describe the S3 request counters, how they can trigger notifications, and the periodic threshold reset schedule.
otherdocs: list previously missing entries under the configuration subtree with a short description of each.
4.1.9 Apr 23, 2026
others3: graduate the S3 datastore backend from technology preview to a fully supported feature; drop the corresponding preview note from the docs.
fixfix #7251: sync jobs: support server-side encryption of snapshots using encryption keys stored on the datastore server. Push sync jobs can encrypt previously unencrypted source snapshots on the fly while uploading to the remote; pull sync jobs can decrypt snapshots with a matching key and store…
featureconfig: add 'encryption-keys' as ACL subpath under 'system' for more granular access control over individual encryption keys.
featureui: expose encryption key management via a new menu (list, create, archive/unarchive and delete keys) and allow assigning an active encryption key and associated decryption keys in the sync job editors.
fixfix: sync: pull: also upload the client log to s3-backed target datastores in the "no data changes" fast-path; this was previously only done on full resync.
otherdocs: add chapter on server-side encryption for sync jobs, covering key management, associated keys and requirements for removing keys.
otherui: sync job edit: show a direction-specific hint in the encryption panel, since pull sync jobs only use configured keys to decrypt and never encrypt, which is easy to miss without an explicit note.
otherapi/ui: sync job: reject setting the active encryption key on pull sync jobs (including switching a push job with an active key over to pull without clearing it first), since the active key is only consumed by the push side and would otherwise be silently ignored.
featureadd move operations for backup groups and entire namespace subtrees within the same datastore, covering both filesystem and S3 backends and preserving group notes. Snapshots can be merged into an existing target group when ownership matches and source snapshots are strictly newer. Exposed via new…
featuredatastore: add a per-datastore move journal consumed by the mark phase of garbage collection, closing a race where a concurrent move-group or move-namespace could cause the mark phase to miss a relocated index, which would let the sweep phase remove its still-referenced chunks.
otherdocs: add section on moving namespaces and groups.
otherui: show empty backup groups. Previously, removing the last snapshot of a group also removed the group itself, discarding group-level metadata like notes; it also prevented cleaning up groups left behind by a partially failed move on an S3-backed datastore without going through the API.
otherpartially fix #6372: acme: scale certificate renewal check cadence with certificate lifetime. Start renewing once 2/3 of the total lifetime have passed instead of the hard-coded 30 days, with a minimum of 3 days remaining to still cope with transient failures. This lets short-lived (e.g. 7-day…
otherdocs: sync: document the new 'worker-threads' option for parallel sync jobs.
otherdocs: storage: document the 'gc-on-unmount' flag for removable datastores.
4.1.8 Apr 22, 2026
fixfix #4182: sync jobs: allow pulling or pushing backup groups in parallel, configurable via the new 'worker-threads' sync job property (1 to 32, defaults to 1 for sequential). Significantly improves throughput on high-latency connections where the single HTTP/2 connection to the source was limited…
othersync jobs: in parallel mode prefix log messages by group and buffer them briefly, so lines from concurrent groups stay readable and do not interleave excessively.
featureui: sync job edit: expose the new parallel group worker count setting.
featureapi: datastore: add 'gc-on-unmount' option for removable datastores, which runs garbage collection automatically before unmounting. This gives setups relying on auto-unmount a natural point to run GC. The unmount waits for the GC run, or an already running one, to complete. Rejected on…
featureui: datastore options: expose the new 'gc-on-unmount' toggle for removable datastores.
featuretools: move ParallelHandler to the new proxmox-parallel-handler crate in the proxmox-rs workspace, for reuse across Proxmox products.
otherbump proxmox-shared-memory to 1.0.2, which immediately flushes the contents of newly created mmap files, avoiding a possible race between a file being initialized and another consumer opening it while checking its header.
featureclient: add --server, --port, --datastore, --auth-id and --ns as per-field alternatives to the compound --repository URL across all client tools (proxmox-backup-client, proxmox-file-restore, proxmox-backup-debug). Each has a matching PBS_SERVER, PBS_PORT, PBS_DATASTORE, PBS_AUTH_ID environment…
fixfix #5340: client: add PBS_NAMESPACE environment variable as a per-tool fallback for --ns, consistent with the other PBS_* atom environment variables.
otherdocs: document the new per-field client repository options, their mutual exclusion with --repository, and the corresponding PBS_* environment variables.
fixfix #7337: ui: preserve the target deep link when redirecting through an OpenID login round-trip. The hash was previously dropped, sending users to the dashboard instead of their originally requested view after logging in.
fixfix #7400: handle corrupted or missing job statefiles gracefully. The API no longer errors out when the statefile cannot be parsed (a default schedule status is returned instead), and the scheduler loops actively overwrite corrupted statefiles on the next run so affected jobs resume normally.
fixpbs-key-config: fsync() newly stored encryption keys to match the replace path, so a crash between key creation and the next filesystem flush cannot leave the key partially written on disk.
4.1.7 Apr 15, 2026
otherbump pxar dependency, adding a consistency check for payload reference offsets in split archives.
fixfix #7382: correctly anchor nested paths for include/exclude patterns. Anchored patterns in subdirectories were not matched because the leading slash was not prepended to the match path.
fixfix #7329: api: avoid overwriting existing IPv6 config method. Setting IPv4 configuration could silently reset the IPv6 method to manual, causing the inet6 stanza to be dropped from the interfaces file.
othersystem report: adapt to the ZFS arcstat CLI tool getting renamed to zarcstat.
fixfix #7412: ui: dashboard: persist datastore usage column configuration across page reloads and navigations.
otherui: task descriptions: use title case also for 'Format Media' task.
others3: bump proxmox-s3-client to 1.4.0, fixing the Content-Type for object upload and copy requests to application/octet-stream instead of the non-standard binary/octet.
fixfix #6716: pass node http proxy config to s3 backend, so that S3 operations respect the configured HTTP proxy.
features3: add request statistics with configurable notification thresholds and scheduled counter resets, allowing to monitor and alert on S3 backend traffic.
otherpartially fix #6563: ui: expose s3 rrd charts in datastore summary.
otherapi: metrics: support sub-path metric object IDs, so that S3 sub-metrics inherit their parent datastore's permissions.
otherapi: datastore: include backend type in listing response, allowing the UI to distinguish backends without loading the full config.
otherui: s3: hide S3-only options for non-S3 datastores.
otherui: datastore summary improvements:
othergive notes panel its own full row.
otheruse backend-type from datastore list API for immediate S3 detection.
4.1.6 Mar 19, 2026
fixfix #3723: api: remote: optionally use node proxy config for http client
fixfix #7078: ui: S3: expose "DeleteObjects via DeleteObject" provider quirk
otherapi: status/datastore: expose backend type in datastore status/list
otherui: Set datastore usage related titles based on backend
otherbump proxmox-fuse to 3
fixfix #7017: cache token.shadow verification results
4.1.5 Mar 10, 2026
fixapi: backup: don't verify total file size for incremental backups to fix a critical regression with the previous version bump and incremental qemu backups. As there, the submitted value is currently the upload size instead of the total size.
otherapi: backup: disallow incremental backups with different index length again. Currently, fixed index files are only reused for qemu backups where the total size never changes at the moment.
4.1.4 Feb 17, 2026
fixupdate proxmox-rest-server to 1.0.5 addressing a minor regression that resulted in some requests with auth issues being answered with HTTP code 400 "bad request" instead of the correct HTTP code 401 "unauthorized". The new rest-server also defaults to only checking the forwarded header in the…
featureproxy daemon: support configuration of real peer-ip header and allowed source through the PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM environment variables. These variables can currently be set through overriding the proxmox-backup-proxy.service systemd unit. For example, to check the…
4.1.2 Jan 29, 2026
fixfix #7149: ui: user create: do not leak changing the realm for a new user into the pre-selected realm of the currently logged in user, as that might cause some UX friction and confusion on their next login.
fixfix recent regression that failed s3 refresh.
fixfix #7219: client: mount: align encryption key loading behavior to fallback to the default key location, just like all other commands.
featurepartially fix #6049: datastore: implement various optimizations for handling large datastore configs, including a cache for the datastore config to avoid re-parsing the whole config if not necessary.
otherchunk store: various code clean-ups for the chunk store iterator, chunk filename checks and "bad chunk" handling.
featureadd basic multiarch support to resulting package and executable locations.
featureswitch ACME implementation over to factored out one.
fixfix #6939: acme: support servers returning 204 for nonce requests.
4.1.1 Dec 22, 2025
otherdatastore: s3: use owner from local store cache instead of refetching to reduce the time and amount of request needed for listing backup contents.
featuregarbage collection: add task-cancellation points during phase 2 for s3 stores after each processed s3 object key.
othertape: cope with drives that aligned buffer sizes when setting up encryption.
otherapi: notification: correctly enumerate known push-sync-jobs.
fixapi: config: fix push sync jobs cleanup on datastore destroy.
otherupdate proxmox-apt and related api-types for more robust package name handling.
featureLatest 6.17.2-1 Kernel as new stable default
featureTraffic control based on the authenticated user. Traffic control already allows limiting backup and restore traffic for specific client networks. Now, traffic control can also take the authenticated Proxmox Backup Server user into account. This allows more convenient and fine-grained…
featureAllow to control parallelism of verify jobs. Backup snapshot verification is both an IO- and CPU-heavy workload, as it needs to read chunks from disk and verify their checksums. The number of threads used for reading from disk and for checksum verification can now be customized. In some setups,…
featureBandwidth rate limiting for S3 endpoints. Since Proxmox Backup Server 4.0, backup metadata and chunks can be stored in S3-compatible object stores (technology preview). It is now possible to enforce bandwidth rate limits on incoming and outgoing connections from or to S3 endpoints. This can avoid…
featureKernel 6.17 as the new stable default.
featureAllow users outside the pam realm to access the shell (issue 6398). Accessing the shell requires the Sys.Console privilege. Non-PAM users are required to enter valid PAM credentials to access the shell.
featureFix a sorting issue where the "Last comment" field was not considered (issue 6592).
featureImprove appearance with high-resolution displays.
featureFix an issue where the WebAuthn setting dialog, which is only accessible for the root user, was susceptible to XSS (PSA-2025-00014-1).
featureUpdated translations, among others:
featureCzech
featureFrench
featureGeorgian
featureGerman
featureItalian
featureJapanese
featureKorean
featurePolish
featureSpanish
featureSwedish
featureTraditional Chinese
featureUkrainian
featureAllow to control parallelism of verify jobs. Backup snapshot verification is both an IO- and CPU-heavy workload, as it needs to read chunks from disk and verify their checksums. The number of threads used for reading from disk and for checksum verification can now be customized in the datastore…
featureAllow to automatically unmount removable datastores after an automatic sync job is completed. A removable datastore can be configured to trigger a sync job when it is mounted. In addition, the removable datastore can now be unmounted automatically after the sync job has finished.
featureAllow removable datastore creation on the device's root directory.
featureImprove performance of the API endpoint for listing backup groups.
featureEnsure proper cleanup if setting the backup group owner fails.
featureClarify task log messages for protected backup snapshots when pruning (issue 6624).
featureMount a dedicated tmpfs under /run/proxmox-backup to avoid exceeding the maximum number of inodes on low-memory hosts. This will only take effect after a reboot.
featureFix an issue where Proxmox Backup Server would stop accepting incoming connections in certain error cases. This could be caused by health checks, for example when running behind HAProxy.
featureFix a regression where pull sync jobs would not resync all corrupt snapshots.
featureFix an issue where authenticating against a Remote running some versions of Proxmox Backup Server 3.4 would fail.
featureFix an issue where backup snapshot creation would not drop locks in time and cause an immediately following backup snapshot creation to fail (issue 6566). This could, for example, happen for push sync jobs.
featureFix a race condition during long-running garbage collection and pruning of recent snapshots that could lead to backup corruption before Proxmox Backup Server 3.4 (PSA-2025-00019-1).
featureImprove the efficiency of fingerprint validation.
featureFix a verification error message that mentioned S3 even in case of a local datastores.
featureFix a locking issue where a backup would not be prioritized over garbage collection during a server reload.
featureAvoid slowdowns when waiting for chunk insertion to finish during pull sync jobs.
featureEnsure correct reuse of pre-existing chunks for backup snapshots created by a pull sync job.
featureFix a race condition between deleting a datastore and modifying the configuration of unrelated datastores.
+42 more items in the release notes4.0.22 Nov 24, 2025
fixs3 garbage-collection: fix local marker cleanup for unreferenced chunks that are only available on the s3 storage itself.
otherprovide and enable dedicated mount unit for /run/proxmox-backup, avoiding the (inode) limits of /run.
featuredatastore config: add default-verification-workers and default-verification-readers to the tuning options.
featureui, docs: integrate new verification related thread-count options.
featureui: traffic-control: rename add-timeframe button to "Add Timeframe" to avoid having two buttons with an "Add" label visible at the same time.