Proxmox Backup Server 4.2 → 4.2.9
9 releases · 2 breaking changes · 1 security fix · 0 advisories fixed
1security2breaking3deprecated8feature26fix
Breaking changes
- breaking fix #6267: remove old task logs and archives again on busy systems. in 4.2.7
- breaking css: remove x-grid-row-loading class, replace it with non-blurry SVG variant from proxmox-widget-toolkit in 4.2.3
Security changes
- security backup-manager cli: document that cert update create auth and csrf key if they are missing in 4.2.6
Deprecations
- deprecated update proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice. in 4.2.7
- deprecated api schema/section config: add support for declaring deprecated property aliases, to allow renaming properties without showing the old name in the documentation in 4.2.3
- deprecated rest server: accept deprecated property aliases in JSON request bodies by rewriting them to the canonical name before verification and dispatch, like the CLI and query-string handling already do. in 4.2.3
Every release in between
4.2.9 Nov 3, 2026
otherdocs: installer: document the advanced network options
othersnapshot locking: improve error contexts, prefer short human readable format instead of struct-debug printing
otherdatastore: prefer standard library over custom unsafe code
otherdatastore: rephrase error messages for failed chunk insert, to direct users at running verification if required
fixfix #7746: cli: manager: show installed instead of candidate version
otherGC: fail on abnormal system time drifted between phase 1 and 2, to avoid dataloss in case of manual or automatic system clock adjustments during GC runtime
otherbackup API: reject snapshots created using future timestamps outside of configured "time skew" acceptance window
otherprune: ignore snapshots with backup timestamp in the future
otherapi: sync jobs: extend privilege checks when modifying sync job to cover pre-update configuration
featureauth: ldap/ad: reject empty passwords, which might be interpreted as unauthenticated binds if the backend server allows them
4.2.8 Oct 2, 2026
othertape: labeling: improve error message for tapes with existing data, making the need for formatting them easier to understand.
fixfix #8003: sync: pull: log skipped chunk reuse in case of failed verification. When the previous snapshot is marked as failed, the chunks referenced by it are not reused, but this fact was not logged before.
fixfix #6251: api: list tasks: skip running tasks when failed ones are requested, since a task that is still running cannot have failed.
othersync: refactor and improve ACL checks when setting up local pull sync jobs, encrypting or decrypting sync jobs and prune jobs.
featureapi: admin: add missing ACL check for GC status endpoint, correctly limiting it to users with audit or backup privs.
fixfixed index files: prevent out-of-bounds memory access in FixedIndexReader and restrict fixed index files to a chunk size of 4MB in general. The backup API only allowed creating fixed index files with such a chunk size in the first place, now this is enforced across the board.
othersync: pull: refactor handling of reusable chunks to include checking of chunk sizes, in addition to chunk digests. This prevents a misbehaving pull source from potentially creating inconsistent index files on the target.
4.2.7 Sep 23, 2026
otherdocs: warn in the FAQ that apt upgrade can leave a partial upgrade, as only apt full-upgrade can remove packages to satisfy dependencies. Also fix a typo in the pcat1 file format description.
otheropenid auth: log the full error chain if getting the authorization URL fails, to ease diagnosing connection problems.
fixfix #7823: tape: do not announce a data-in transfer for SCSI commands without a data phase, which targets such as SCST rejected with an ILLEGAL REQUEST error.
othertape: configuration: also reject drive or changer device paths already used by another entry of the same type on update. Enforce unique drive numbers within each changer on creation and update. Existing duplicates can block edits until they are resolved.
othertape: permissions:
othercheck '/tape/device/{drive}' for backup, restore and the drive list, as grants on this documented path were previously ignored.
otherrequire Datastore.Read on the datastore and Tape.Write on the media pool and drive when creating or updating tape backup jobs. Scheduled jobs run as root@pam, so job editors could otherwise get a datastore written to tape without having read access to it.
othertape restore: validate the datastore name read from tape and require the snapshot name to match the one selected for restore, so corrupt or crafted media cannot place temporary files outside of the restore directory.
others3: validate object keys against the datastore layout when refreshing the contents from the bucket, instead of using them as file paths unchecked. Directory marker objects returned by some providers are now skipped.
otherclient: pxar: harden restore and extraction against crafted archives that could write or link files outside of the target directory. Symlinks are no longer followed when entering existing directories or overwriting files, also for symlinks already in the target, and hardlink targets must resolve…
otherupdate proxmox-rest-server to 1.1.1:
otheronly abort a worker task if its whole UPID matches. Previously, users allowed to stop their own tasks could stop others' tasks through a crafted UPID.
breakingfix #6267: remove old task logs and archives again on busy systems.
otherharden authentication: mask the credential check runtime in the delay for failed logins, skip malformed cookie pairs and prefer a ticket over an API token in the same request.
otheraccept quoted and unquoted Forwarded header addresses with optional ports, use the last proxy element and reject unterminated quotes.
otherhonor zero deflate weights in Accept-Encoding, stop logging redirects and unchanged responses as failures, and log client errors as warnings.
otherrun all API authentication and permission checks through one shared code path.
deprecatedupdate proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice.
otherupdate proxmox-network-api to 1.0.6:
fixfix #7329: allow listing interfaces configured with the IPv6 'auto' method.
otherkeep dhcp, auto and loopback methods on unrelated updates instead of switching to manual, which could drop IPv6 settings.
otherreject non-static methods while an address or gateway is set for the same address family.
otherupdate proxmox-rate-limiter to 1.0.1: prevent frequent refill updates from stalling low-rate traffic, and fix opening the shared limiter on aarch64.
4.2.6 Sep 16, 2026
securitybackup-manager cli: document that cert update create auth and csrf key if they are missing
othernotifications: use Severity::Error for acme renewal failures
otherconfig: invalidate CachedUserInfo after ACL changes, to reduce the time it takes for ACL changes to become active
fixfix #7911: api: report: mark endpoint as protected, since it calls commands that require root privileges
otherclient: improve handling of encryption/signing key configuration and manifest signature state
otherbackup: change misleading log message in sign-only mode
othermanifest: reject unsigned manifests when a key is set
otherreuse chunks across compatible crypt modes, e.g. when transitioning from unsigned to signed
featurerestore: allow explicitly trusting unsigned backups, even if the client has a key configured
4.2.5 Aug 5, 2026
otherbackup: harden the handling of client supplied backup manifests:
otheronly accept archive names that are plain file names carrying a server side type extension. A crafted name in a manifest could previously make a sync job read or write outside of the snapshot directory, running as the unprivileged 'backup' user. Reaching this needed a manifest from a configured…
otherkeep an uploaded manifest in memory and only persist it on backup finish, checking that every archive it lists was really uploaded during that session and that the checksums match the ones computed server side. A client uploading a manifest that references archives it did not upload now gets an…
fixfix #7878: sync: push: reuse the manifest of a previous snapshot on a non-encrypting push if the source snapshot was encrypted with a matching key, restoring chunk reuse and thus avoiding needlessly long sync runs.
othersync: push: keep the sign-only crypt mode of a source archive instead of reducing it to unencrypted when pushing without server side encryption.
othersubscription: reject a subscription key issued for a different architecture than the host, as arm64 keys carry an explicit marker, so a wrong key fails fast instead of only erroring during the online check.
fixupdate to proxmox-upgrade-checks 1.1, which accepts the 7.0 kernel, tells a bookworm backport apart from a trixie build and fixes the dkms check.
otherdocs: clarify in the backup protocol description that the manifest is uploaded by the client and only persisted on backup finish.
4.2.4 Jul 29, 2026
otherdocs: document the debug symbol repository
fixdatastore: fix wrong local path used for S3 bad chunk handling during garbage collection
otherrefactor file creation/mode/ownership helpers to proxmox-product-config crate
fixfix #7642: avoid expensive user lookups on file locking by caching the backup user/group ID
otherdepend on proxmox-enterprise-support-keyring, and track its version in the package version API endpoint
fixfix #5748: docs: add catalog.pcat1 format specification
otherdocs: system requirements: document we recommend local storage
fixS3: fix #6841: allow configuring request rate limits by updating to proxmox-s3-client 1.4.1. these rate limits are split into active and passive methods, allowing separate handling of POST/PUT/DELETE and GET/HEAD request limits.
featureS3: config: allow editing the use-node-config flag that controls whether requests S3 endpoints honor the node's proxy settings or not
othersync: push: gracefully handle previous manifest signature mismatches, which can happen when enabling or disabling push-encryption on an already synced backup group
4.2.3 Jul 14, 2026
breakingcss: remove x-grid-row-loading class, replace it with non-blurry SVG variant from proxmox-widget-toolkit
featurepbs-client: add backoff log throttle, to ensure progress and similar output appears quickly initially, but does not create overly long logs
otherclient: report progress during restore
featureapi: journal: adopt proxmox-syslog-api and stream the output, making the implementation consistent with the one from Proxmox Datacenter Manager
otherui: enable the structured journal view and per-service logs, including colored output and filtering capabilities
otherui: always use arrays for 'delete' property, instead of manually converting
fixfix #5971: tape: don't warn on custom MAM attribute write failures
fixfix #7175: api: time: use timedatectl instead of /etc/timezone
fixfix #7187: report: add ethtool output for physical interfaces
featureprune jobs: schedule jobs that do not prune anything, but warn during their execution. such jobs allow testing scheduling options, but make no sense for production use.
fixfix #6691: allow search by comment in datastore content, make search case-insensitive and correctly reset content view after empty searches
otherui: datastore: disable various action tooltips for actions which cannot be triggered
otherldap: escape the user-provided user name when using it in the LDAP search filter that looks up the user DN.
otherldap sync: log which user properties change when synchronizing an existing user, instead of only reporting that the user was updated.
deprecatedapi schema/section config: add support for declaring deprecated property aliases, to allow renaming properties without showing the old name in the documentation
deprecatedrest server: accept deprecated property aliases in JSON request bodies by rewriting them to the canonical name before verification and dispatch, like the CLI and query-string handling already do.
fixfix #7690: fs: replace_file: close the temporary file before renaming or unlinking it, fixing the replacement on WORM file systems and avoiding leftover .fuse_hidden files on FUSE mounts.
otherfs: make_tmp_file: append the temporary suffix instead of replacing the file extension, keeping the original file name intact for easier debugging of leftover temporary files.
4.2.2 Jun 18, 2026
otherapi: backup: run synchronous chunk-insert operations off the asynchronous runtime's worker threads. Blocking those threads, most notably during S3 uploads that can wait up to three hours for a chunk lock, could stall the I/O and timer drivers of the entire runtime and starve other backup workers.
otherclient: backup: make the file-based backup more robust against files that cannot be accessed or that vanish while the backup is running:
fixfix #7658: skip a file and log a warning instead of aborting the whole backup when querying its metadata fails with a permission error, matching the existing handling of permission errors when opening files. Such files can also still be excluded explicitly.
otherconsistently ignore files that disappear during the backup and warn about them, instead of treating this as a fatal error in some cases.
fixtape: backup: fix the command-line group filter, which was passed to the API under the wrong parameter name and thus had no effect.
otherapi: do not log a spurious error when listing the files of a snapshot whose manifest does not exist yet, which is expected while a backup to that snapshot is still running.
fixui: datastore summary: fix the per-datastore sync and prune job counts, which were derived from an incorrectly parsed datastore ID; the prune count in particular was always shown as zero.
fixtape: fix two typos in log and informational messages.
4.2.1 May 26, 2026
fixfix #5076: api: support an 'audiences' property on OpenID realms, listing additional trusted audience values besides the configured client-id. Improves compatibility with providers that issue tokens with multiple audiences.
fixfix #7562: api/ui: tape: separate the format-media 'load-barcode' parameter from the existing 'label-text' verification, so the web interface can load and format empty or previously-unrelated tapes from a changer slot in one step. The old shared parameter aborted formatting after a successful load…
othersync: pull: refuse to overwrite a locally encrypted snapshot from an unencrypted source or one using a different key, and detect content differences between two unencrypted snapshots that share a backup time. Previously such mismatches silently triggered a resync that overwrote the local snapshot.
fixdatastore: fix tuning option changes not propagating the updated sync level to the chunk store until the service was restarted.
otherdatastore: improve the error message when prune cannot acquire a snapshot lock for deletion, by showing the snapshot directory and lock file paths instead of an internal debug dump.
fixapi: backup: fix benchmark, finish-failed, and backup-failed cleanups leaving an orphaned empty backup group behind on the datastore.
otherapi: node: tasks status: return the task end time as an optional field once the task is finished, so the task viewer can render the correct duration without an extra API call.
featureapi/ui: node: add a 'location' property to the node config, exposed through the node options panel.
othersubscription: reuse the server ID from an existing subscription info when multiple candidates are detected, falling back to the first candidate only when no prior info exists.
otherchunk store: include the filesystem backing path in the syncfs log output for easier identification of which directory is being synced.
othertree-wide: print error chains as a colon-separated single line and stop quoting simple errors without context, making logs and CLI output easier to read at a glance.
otherui: encryption keys: extract the error message from API2 responses before displaying the alert, so permission and other endpoint errors no longer surface as an empty popup.
otherremovable device attach service: clarify the systemd unit description so it no longer suggests that mount is attempted for every device or that every device is a datastore.
otherdocs: faq: correct the Debian Bookworm end-of-life date; the last point release is planned for July 2026.