Proxmox Backup Server 4.0.7 → 4.1.9
24 releases · 1 breaking change · 1 security fix · 0 advisories fixed
1security1breaking0deprecated75feature34fix
Breaking changes
- breaking fix #6714: docs: remove wrong --drive parameter from cli example. in 4.0.15
Security changes
- security re-build with proxmox-tfa 6.0.2 to cope with both possible states of backup-eligibility for WebAuthn credentials to fix a regression with (hardware) security keys from the previous version. in 4.0.11
Every release in between
4.1.9 Apr 23, 2026
others3: graduate the S3 datastore backend from technology preview to a fully supported feature; drop the corresponding preview note from the docs.
fixfix #7251: sync jobs: support server-side encryption of snapshots using encryption keys stored on the datastore server. Push sync jobs can encrypt previously unencrypted source snapshots on the fly while uploading to the remote; pull sync jobs can decrypt snapshots with a matching key and store…
featureconfig: add 'encryption-keys' as ACL subpath under 'system' for more granular access control over individual encryption keys.
featureui: expose encryption key management via a new menu (list, create, archive/unarchive and delete keys) and allow assigning an active encryption key and associated decryption keys in the sync job editors.
fixfix: sync: pull: also upload the client log to s3-backed target datastores in the "no data changes" fast-path; this was previously only done on full resync.
otherdocs: add chapter on server-side encryption for sync jobs, covering key management, associated keys and requirements for removing keys.
otherui: sync job edit: show a direction-specific hint in the encryption panel, since pull sync jobs only use configured keys to decrypt and never encrypt, which is easy to miss without an explicit note.
otherapi/ui: sync job: reject setting the active encryption key on pull sync jobs (including switching a push job with an active key over to pull without clearing it first), since the active key is only consumed by the push side and would otherwise be silently ignored.
featureadd move operations for backup groups and entire namespace subtrees within the same datastore, covering both filesystem and S3 backends and preserving group notes. Snapshots can be merged into an existing target group when ownership matches and source snapshots are strictly newer. Exposed via new…
featuredatastore: add a per-datastore move journal consumed by the mark phase of garbage collection, closing a race where a concurrent move-group or move-namespace could cause the mark phase to miss a relocated index, which would let the sweep phase remove its still-referenced chunks.
otherdocs: add section on moving namespaces and groups.
otherui: show empty backup groups. Previously, removing the last snapshot of a group also removed the group itself, discarding group-level metadata like notes; it also prevented cleaning up groups left behind by a partially failed move on an S3-backed datastore without going through the API.
otherpartially fix #6372: acme: scale certificate renewal check cadence with certificate lifetime. Start renewing once 2/3 of the total lifetime have passed instead of the hard-coded 30 days, with a minimum of 3 days remaining to still cope with transient failures. This lets short-lived (e.g. 7-day…
otherdocs: sync: document the new 'worker-threads' option for parallel sync jobs.
otherdocs: storage: document the 'gc-on-unmount' flag for removable datastores.
4.1.8 Apr 22, 2026
fixfix #4182: sync jobs: allow pulling or pushing backup groups in parallel, configurable via the new 'worker-threads' sync job property (1 to 32, defaults to 1 for sequential). Significantly improves throughput on high-latency connections where the single HTTP/2 connection to the source was limited…
othersync jobs: in parallel mode prefix log messages by group and buffer them briefly, so lines from concurrent groups stay readable and do not interleave excessively.
featureui: sync job edit: expose the new parallel group worker count setting.
featureapi: datastore: add 'gc-on-unmount' option for removable datastores, which runs garbage collection automatically before unmounting. This gives setups relying on auto-unmount a natural point to run GC. The unmount waits for the GC run, or an already running one, to complete. Rejected on…
featureui: datastore options: expose the new 'gc-on-unmount' toggle for removable datastores.
featuretools: move ParallelHandler to the new proxmox-parallel-handler crate in the proxmox-rs workspace, for reuse across Proxmox products.
otherbump proxmox-shared-memory to 1.0.2, which immediately flushes the contents of newly created mmap files, avoiding a possible race between a file being initialized and another consumer opening it while checking its header.
featureclient: add --server, --port, --datastore, --auth-id and --ns as per-field alternatives to the compound --repository URL across all client tools (proxmox-backup-client, proxmox-file-restore, proxmox-backup-debug). Each has a matching PBS_SERVER, PBS_PORT, PBS_DATASTORE, PBS_AUTH_ID environment…
fixfix #5340: client: add PBS_NAMESPACE environment variable as a per-tool fallback for --ns, consistent with the other PBS_* atom environment variables.
otherdocs: document the new per-field client repository options, their mutual exclusion with --repository, and the corresponding PBS_* environment variables.
fixfix #7337: ui: preserve the target deep link when redirecting through an OpenID login round-trip. The hash was previously dropped, sending users to the dashboard instead of their originally requested view after logging in.
fixfix #7400: handle corrupted or missing job statefiles gracefully. The API no longer errors out when the statefile cannot be parsed (a default schedule status is returned instead), and the scheduler loops actively overwrite corrupted statefiles on the next run so affected jobs resume normally.
fixpbs-key-config: fsync() newly stored encryption keys to match the replace path, so a crash between key creation and the next filesystem flush cannot leave the key partially written on disk.
4.1.7 Apr 15, 2026
otherbump pxar dependency, adding a consistency check for payload reference offsets in split archives.
fixfix #7382: correctly anchor nested paths for include/exclude patterns. Anchored patterns in subdirectories were not matched because the leading slash was not prepended to the match path.
fixfix #7329: api: avoid overwriting existing IPv6 config method. Setting IPv4 configuration could silently reset the IPv6 method to manual, causing the inet6 stanza to be dropped from the interfaces file.
othersystem report: adapt to the ZFS arcstat CLI tool getting renamed to zarcstat.
fixfix #7412: ui: dashboard: persist datastore usage column configuration across page reloads and navigations.
otherui: task descriptions: use title case also for 'Format Media' task.
others3: bump proxmox-s3-client to 1.4.0, fixing the Content-Type for object upload and copy requests to application/octet-stream instead of the non-standard binary/octet.
fixfix #6716: pass node http proxy config to s3 backend, so that S3 operations respect the configured HTTP proxy.
features3: add request statistics with configurable notification thresholds and scheduled counter resets, allowing to monitor and alert on S3 backend traffic.
otherpartially fix #6563: ui: expose s3 rrd charts in datastore summary.
otherapi: metrics: support sub-path metric object IDs, so that S3 sub-metrics inherit their parent datastore's permissions.
otherapi: datastore: include backend type in listing response, allowing the UI to distinguish backends without loading the full config.
otherui: s3: hide S3-only options for non-S3 datastores.
otherui: datastore summary improvements:
othergive notes panel its own full row.
otheruse backend-type from datastore list API for immediate S3 detection.
4.1.6 Mar 19, 2026
fixfix #3723: api: remote: optionally use node proxy config for http client
fixfix #7078: ui: S3: expose "DeleteObjects via DeleteObject" provider quirk
otherapi: status/datastore: expose backend type in datastore status/list
otherui: Set datastore usage related titles based on backend
otherbump proxmox-fuse to 3
fixfix #7017: cache token.shadow verification results
4.1.5 Mar 10, 2026
fixapi: backup: don't verify total file size for incremental backups to fix a critical regression with the previous version bump and incremental qemu backups. As there, the submitted value is currently the upload size instead of the total size.
otherapi: backup: disallow incremental backups with different index length again. Currently, fixed index files are only reused for qemu backups where the total size never changes at the moment.
4.1.4 Feb 17, 2026
fixupdate proxmox-rest-server to 1.0.5 addressing a minor regression that resulted in some requests with auth issues being answered with HTTP code 400 "bad request" instead of the correct HTTP code 401 "unauthorized". The new rest-server also defaults to only checking the forwarded header in the…
featureproxy daemon: support configuration of real peer-ip header and allowed source through the PROXY_REAL_IP_HEADER and PROXY_REAL_IP_ALLOW_FROM environment variables. These variables can currently be set through overriding the proxmox-backup-proxy.service systemd unit. For example, to check the…
4.1.2 Jan 29, 2026
fixfix #7149: ui: user create: do not leak changing the realm for a new user into the pre-selected realm of the currently logged in user, as that might cause some UX friction and confusion on their next login.
fixfix recent regression that failed s3 refresh.
fixfix #7219: client: mount: align encryption key loading behavior to fallback to the default key location, just like all other commands.
featurepartially fix #6049: datastore: implement various optimizations for handling large datastore configs, including a cache for the datastore config to avoid re-parsing the whole config if not necessary.
otherchunk store: various code clean-ups for the chunk store iterator, chunk filename checks and "bad chunk" handling.
featureadd basic multiarch support to resulting package and executable locations.
featureswitch ACME implementation over to factored out one.
fixfix #6939: acme: support servers returning 204 for nonce requests.
4.1.1 Dec 22, 2025
otherdatastore: s3: use owner from local store cache instead of refetching to reduce the time and amount of request needed for listing backup contents.
featuregarbage collection: add task-cancellation points during phase 2 for s3 stores after each processed s3 object key.
othertape: cope with drives that aligned buffer sizes when setting up encryption.
otherapi: notification: correctly enumerate known push-sync-jobs.
fixapi: config: fix push sync jobs cleanup on datastore destroy.
otherupdate proxmox-apt and related api-types for more robust package name handling.
featureLatest 6.17.2-1 Kernel as new stable default
featureTraffic control based on the authenticated user. Traffic control already allows limiting backup and restore traffic for specific client networks. Now, traffic control can also take the authenticated Proxmox Backup Server user into account. This allows more convenient and fine-grained…
featureAllow to control parallelism of verify jobs. Backup snapshot verification is both an IO- and CPU-heavy workload, as it needs to read chunks from disk and verify their checksums. The number of threads used for reading from disk and for checksum verification can now be customized. In some setups,…
featureBandwidth rate limiting for S3 endpoints. Since Proxmox Backup Server 4.0, backup metadata and chunks can be stored in S3-compatible object stores (technology preview). It is now possible to enforce bandwidth rate limits on incoming and outgoing connections from or to S3 endpoints. This can avoid…
featureKernel 6.17 as the new stable default.
featureAllow users outside the pam realm to access the shell (issue 6398). Accessing the shell requires the Sys.Console privilege. Non-PAM users are required to enter valid PAM credentials to access the shell.
featureFix a sorting issue where the "Last comment" field was not considered (issue 6592).
featureImprove appearance with high-resolution displays.
featureFix an issue where the WebAuthn setting dialog, which is only accessible for the root user, was susceptible to XSS (PSA-2025-00014-1).
featureUpdated translations, among others:
featureCzech
featureFrench
featureGeorgian
featureGerman
featureItalian
featureJapanese
featureKorean
featurePolish
featureSpanish
featureSwedish
featureTraditional Chinese
featureUkrainian
featureAllow to control parallelism of verify jobs. Backup snapshot verification is both an IO- and CPU-heavy workload, as it needs to read chunks from disk and verify their checksums. The number of threads used for reading from disk and for checksum verification can now be customized in the datastore…
featureAllow to automatically unmount removable datastores after an automatic sync job is completed. A removable datastore can be configured to trigger a sync job when it is mounted. In addition, the removable datastore can now be unmounted automatically after the sync job has finished.
featureAllow removable datastore creation on the device's root directory.
featureImprove performance of the API endpoint for listing backup groups.
featureEnsure proper cleanup if setting the backup group owner fails.
featureClarify task log messages for protected backup snapshots when pruning (issue 6624).
featureMount a dedicated tmpfs under /run/proxmox-backup to avoid exceeding the maximum number of inodes on low-memory hosts. This will only take effect after a reboot.
featureFix an issue where Proxmox Backup Server would stop accepting incoming connections in certain error cases. This could be caused by health checks, for example when running behind HAProxy.
featureFix a regression where pull sync jobs would not resync all corrupt snapshots.
featureFix an issue where authenticating against a Remote running some versions of Proxmox Backup Server 3.4 would fail.
featureFix an issue where backup snapshot creation would not drop locks in time and cause an immediately following backup snapshot creation to fail (issue 6566). This could, for example, happen for push sync jobs.
featureFix a race condition during long-running garbage collection and pruning of recent snapshots that could lead to backup corruption before Proxmox Backup Server 3.4 (PSA-2025-00019-1).
featureImprove the efficiency of fingerprint validation.
featureFix a verification error message that mentioned S3 even in case of a local datastores.
featureFix a locking issue where a backup would not be prioritized over garbage collection during a server reload.
featureAvoid slowdowns when waiting for chunk insertion to finish during pull sync jobs.
featureEnsure correct reuse of pre-existing chunks for backup snapshots created by a pull sync job.
featureFix a race condition between deleting a datastore and modifying the configuration of unrelated datastores.
+42 more items in the release notes4.0.22 Nov 24, 2025
fixs3 garbage-collection: fix local marker cleanup for unreferenced chunks that are only available on the s3 storage itself.
otherprovide and enable dedicated mount unit for /run/proxmox-backup, avoiding the (inode) limits of /run.
featuredatastore config: add default-verification-workers and default-verification-readers to the tuning options.
featureui, docs: integrate new verification related thread-count options.
featureui: traffic-control: rename add-timeframe button to "Add Timeframe" to avoid having two buttons with an "Add" label visible at the same time.
4.0.21 Nov 21, 2025
fixtask tracking: fix adding new entry if other PID is tracked.
otherGC: S3: reduce number of open FDs for to-be-deleted objects to avoid running into soft FD count limits, as we cannot just increase that due to some libraries still potentially using the ancient select syscall.
othersystem report: better hardware and system utilization overview.
otherpulling sync: ensure that all chunks of a synced index files can be downloaded from the remote.
otherpulling sync: mark chunks referenced in last backup snapshot as reusable.
otherpulling sync: keep one "encountered chunks" map for a full backup group to avoid frequently reinstating that map.
otherdocs: storage: fix "persistent" typo
featuretraffic-control: add user-specific rule matching and precedence. Introduce user-aware rule lookup by accepting an optional user and preferring rules that specify 'users' over IP-only matches.
featureui: traffic-control: add users field in edit form and list.
features3 datastore: add support for configuring bandwidth rate-limiting for clients, reusing the token bucket filter that the API server uses for rate limiting.
otherui: expose rate and burst limits for s3 endpoints.
4.0.20 Nov 14, 2025
otherverify: distinguish s3 object fetching and chunk loading error, as loading chunks from the object store might be cause by transient issues, and must therefore handled so they do not incorrectly mark chunks as corrupt.
otherapi: admin: rework waiting on active operations and maintenance locking.
otherapi: datastore: wait for active operations to clear before s3 refresh.
othernotifications/pbsXtoX: adapt to proxmox-apt making old_version optional.
featureapi: access: add vncticket verification endpoint.
featureapi: node shell: allow access for tokens.
otherui: replace Proxmox logo with slightly bigger SVG version to make it crisper on HiDPI displays.
otherdatastore: GC: drop overly verbose info message during s3 chunk sweep.
fixdatastore: various concurrency fixes for GC and handling corrupt chunks.
otherverify: never hold mutex lock in async scope on corrupt chunk rename to avoid rare deadlock potential.
othercleanup chunk markers from cache in phase 3 on s3 backends.
featureverification: add option to set number of {read,verify}-threads for jobs, allowing one to potentially increase verification throughput as long as the system does not gets IO starved.
featureapi: datastore: auto-unmount after mount-triggered sync for a removable datastore. This can be configured through a new 'unmount-on-done' option for sync jobs.
4.0.19 Nov 7, 2025
featuresync: pull: instantiate backend only once per sync job to avoid establishing a new connection for each chunk that gets inserted.
otherapi, datastore: ensure that the exclusive lock on the backup group is acquired before updating the notes, in order to avoid possible race conditions, e.g. with backup group destruction.
otherbackup log upload: avoid calling a blocking function in async context.
otherverify: improve logs and behavior on errors.
otherdatastore: avoid potential loss of concurrent config changes that happened during datastore deletion.
fixfix #4995: pxar: Include symlinks in zip file creation.
fixchunk store: fix theoretical race window between chunk stat and GC cleanup, for a case where a chunk must be older than the cutoff time and not be referenced by any index file and also uploaded at the exact same time that the GC passed over it in phase 2.
othervarious code style fixes, partially automated through rust clippy, upgrading from rust 1.85 to 1.90..
4.0.18 Oct 22, 2025
otherapi: chunk upload: extend consistency checks for s3 backend
4.0.17 Oct 15, 2025
fixfix #6665: never rename chunks on s3 client fetch errors
fixfix #6398: api: allow non-pam users to access shell
otherapi: admin: datastore: optimize groups api call
othersync job: pull: avoid blocking future during thread pool completion
otherrefactor GC helpers
otherS3 chunk cache: rework fetching and caching logic
fixfix #6906: s3-client: conditionally set Content-Length header
otherGC: refactor chunk removal helper
4.0.16 Oct 2, 2025
fixsync: pull: fix regression in resync of corrupt snapshots
fixfix #6750: api: avoid possible deadlock on datastores with s3 backend
fixfix #6566: backup: api: conditionally drop group and snapshot locks
otherGC: rework locking logic to avoid deadlock with s3 backend
otherverify: silence incorrect backend error message for filesystem stores
4.0.15 Sep 15, 2025
otherpbs3to4: sync to changes made on bookworm PBS 3 branch.
othernotification: don't deserialize notification config when there is nothing to send.
otherapi: do not block current thread during s3 backup log upload.
others3: pass now optional default request timeout for s3 api calls.
breakingfix #6714: docs: remove wrong --drive parameter from cli example.
fixfix #6624: ui: improve task log output for protected entry.
featureupdate proxmox-s3-client to 1.2.2 to benefit from the higher request timeout of 30 minutes and the new retry logic for transient client errors using an exponentially increasing back-off time and a maximum of 3 tries for the retries.
featureapi: allow creation of removable datastore at device's root.
otherdocs: network-management: use correct syntax for code-blocks.
otherdocs: network-management: link to systemd.link documentation.
fixfix #6592: ui: add custom sort function to comment column.
4.0.14 Aug 13, 2025
otherui: webauthn view: make sure renderers are html encoded
4.0.13 Aug 11, 2025
otherbin: pbs3to4: adapt boot-loader checks to trixie
otherdatastore: cleanup newly created group dir if setting owner failed
4.0.12 Aug 7, 2025
otherupdate proxmox-tfa dependency to 0.6.3 to also keep old passkeys created with PBS 3 or earlier working, where the backup eligible state was not yet exposed.
featureapi: openid connect: allow users of OIDC realms to opt into the HttpOnly cookies.
featureui: opt OpenID connect authentication flows into the new http only flow.
otherproxy: avoid exiting connection acceptor loop in error case, like some monitoring and health checks of reverse proxies or load balancer cause.
4.0.11 Aug 6, 2025
securityre-build with proxmox-tfa 6.0.2 to cope with both possible states of backup-eligibility for WebAuthn credentials to fix a regression with (hardware) security keys from the previous version.
4.0.10 Aug 5, 2025
featurenotifications templates: adapt to whitespace handling changes with new handlebars version to ensure lists are not placed on a single line.
featureS3 Endpoints: allow one to set quirks to adapt to provider specific behavior, like not understanding the If-None-Match HTTP header.
othermetric collection: use ip link for determining the type of interfaces.
otherd/control: recommend proxmox-network-interface-pinning package for the Proxmox Backup Server package.
otherdocs: add documentation for proxmox-network-interface-pinning.
4.0.9 Aug 4, 2025
othersync: conditionally pre-filter source list by verified or encrypted state.
otherapi: return s3 client errors during datastore create with context.
featureacls: add s3-endpoint as valid 'system' subpath and expose on the web UI.
others3 endpoint: make required permissions specific to acl sub-paths in '/system/s3-endpoint/{id}' to allowing one to provide only access to a specific S3 endpoint.
4.0.8 Jul 31, 2025
featureadd pbs-network-config-commit systemd service to apply pending network changes on boot.
otherdatastore: delete all objects on datastore destroy when the remove data flag was set.
otherui: switch datastore destroy label text depending on the backend type.
otherdocs: s3: extend recommendations and limitations for local cache.
otherdatastore: destroy: delete s3 in-use marker unconditionally to make re-adding the bucket as datastore easier.
otherdatastore: wrap bucket name, as in is now optional in the s3 client.
otherapi: admin s3: make store prefix for check command optional.
featureapi: config s3: add bucket list api endpoint.
otherui: replace bucket field by bucket selector