Proxmox Backup Server 4.2.4 → 4.2.9
5 releases · 1 breaking change · 1 security fix · 0 advisories fixed
1security1breaking1deprecated3feature9fix
Breaking changes
- breaking fix #6267: remove old task logs and archives again on busy systems. in 4.2.7
Security changes
- security backup-manager cli: document that cert update create auth and csrf key if they are missing in 4.2.6
Deprecations
- deprecated update proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice. in 4.2.7
Every release in between
4.2.9 Nov 3, 2026
otherdocs: installer: document the advanced network options
othersnapshot locking: improve error contexts, prefer short human readable format instead of struct-debug printing
otherdatastore: prefer standard library over custom unsafe code
otherdatastore: rephrase error messages for failed chunk insert, to direct users at running verification if required
fixfix #7746: cli: manager: show installed instead of candidate version
otherGC: fail on abnormal system time drifted between phase 1 and 2, to avoid dataloss in case of manual or automatic system clock adjustments during GC runtime
otherbackup API: reject snapshots created using future timestamps outside of configured "time skew" acceptance window
otherprune: ignore snapshots with backup timestamp in the future
otherapi: sync jobs: extend privilege checks when modifying sync job to cover pre-update configuration
featureauth: ldap/ad: reject empty passwords, which might be interpreted as unauthenticated binds if the backend server allows them
4.2.8 Oct 2, 2026
othertape: labeling: improve error message for tapes with existing data, making the need for formatting them easier to understand.
fixfix #8003: sync: pull: log skipped chunk reuse in case of failed verification. When the previous snapshot is marked as failed, the chunks referenced by it are not reused, but this fact was not logged before.
fixfix #6251: api: list tasks: skip running tasks when failed ones are requested, since a task that is still running cannot have failed.
othersync: refactor and improve ACL checks when setting up local pull sync jobs, encrypting or decrypting sync jobs and prune jobs.
featureapi: admin: add missing ACL check for GC status endpoint, correctly limiting it to users with audit or backup privs.
fixfixed index files: prevent out-of-bounds memory access in FixedIndexReader and restrict fixed index files to a chunk size of 4MB in general. The backup API only allowed creating fixed index files with such a chunk size in the first place, now this is enforced across the board.
othersync: pull: refactor handling of reusable chunks to include checking of chunk sizes, in addition to chunk digests. This prevents a misbehaving pull source from potentially creating inconsistent index files on the target.
4.2.7 Sep 23, 2026
otherdocs: warn in the FAQ that apt upgrade can leave a partial upgrade, as only apt full-upgrade can remove packages to satisfy dependencies. Also fix a typo in the pcat1 file format description.
otheropenid auth: log the full error chain if getting the authorization URL fails, to ease diagnosing connection problems.
fixfix #7823: tape: do not announce a data-in transfer for SCSI commands without a data phase, which targets such as SCST rejected with an ILLEGAL REQUEST error.
othertape: configuration: also reject drive or changer device paths already used by another entry of the same type on update. Enforce unique drive numbers within each changer on creation and update. Existing duplicates can block edits until they are resolved.
othertape: permissions:
othercheck '/tape/device/{drive}' for backup, restore and the drive list, as grants on this documented path were previously ignored.
otherrequire Datastore.Read on the datastore and Tape.Write on the media pool and drive when creating or updating tape backup jobs. Scheduled jobs run as root@pam, so job editors could otherwise get a datastore written to tape without having read access to it.
othertape restore: validate the datastore name read from tape and require the snapshot name to match the one selected for restore, so corrupt or crafted media cannot place temporary files outside of the restore directory.
others3: validate object keys against the datastore layout when refreshing the contents from the bucket, instead of using them as file paths unchecked. Directory marker objects returned by some providers are now skipped.
otherclient: pxar: harden restore and extraction against crafted archives that could write or link files outside of the target directory. Symlinks are no longer followed when entering existing directories or overwriting files, also for symlinks already in the target, and hardlink targets must resolve…
otherupdate proxmox-rest-server to 1.1.1:
otheronly abort a worker task if its whole UPID matches. Previously, users allowed to stop their own tasks could stop others' tasks through a crafted UPID.
breakingfix #6267: remove old task logs and archives again on busy systems.
otherharden authentication: mask the credential check runtime in the delay for failed logins, skip malformed cookie pairs and prefer a ticket over an API token in the same request.
otheraccept quoted and unquoted Forwarded header addresses with optional ports, use the last proxy element and reject unterminated quotes.
otherhonor zero deflate weights in Accept-Encoding, stop logging redirects and unchanged responses as failures, and log client errors as warnings.
otherrun all API authentication and permission checks through one shared code path.
deprecatedupdate proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice.
otherupdate proxmox-network-api to 1.0.6:
fixfix #7329: allow listing interfaces configured with the IPv6 'auto' method.
otherkeep dhcp, auto and loopback methods on unrelated updates instead of switching to manual, which could drop IPv6 settings.
otherreject non-static methods while an address or gateway is set for the same address family.
otherupdate proxmox-rate-limiter to 1.0.1: prevent frequent refill updates from stalling low-rate traffic, and fix opening the shared limiter on aarch64.
4.2.6 Sep 16, 2026
securitybackup-manager cli: document that cert update create auth and csrf key if they are missing
othernotifications: use Severity::Error for acme renewal failures
otherconfig: invalidate CachedUserInfo after ACL changes, to reduce the time it takes for ACL changes to become active
fixfix #7911: api: report: mark endpoint as protected, since it calls commands that require root privileges
otherclient: improve handling of encryption/signing key configuration and manifest signature state
otherbackup: change misleading log message in sign-only mode
othermanifest: reject unsigned manifests when a key is set
otherreuse chunks across compatible crypt modes, e.g. when transitioning from unsigned to signed
featurerestore: allow explicitly trusting unsigned backups, even if the client has a key configured
4.2.5 Aug 5, 2026
otherbackup: harden the handling of client supplied backup manifests:
otheronly accept archive names that are plain file names carrying a server side type extension. A crafted name in a manifest could previously make a sync job read or write outside of the snapshot directory, running as the unprivileged 'backup' user. Reaching this needed a manifest from a configured…
otherkeep an uploaded manifest in memory and only persist it on backup finish, checking that every archive it lists was really uploaded during that session and that the checksums match the ones computed server side. A client uploading a manifest that references archives it did not upload now gets an…
fixfix #7878: sync: push: reuse the manifest of a previous snapshot on a non-encrypting push if the source snapshot was encrypted with a matching key, restoring chunk reuse and thus avoiding needlessly long sync runs.
othersync: push: keep the sign-only crypt mode of a source archive instead of reducing it to unencrypted when pushing without server side encryption.
othersubscription: reject a subscription key issued for a different architecture than the host, as arm64 keys carry an explicit marker, so a wrong key fails fast instead of only erroring during the online check.
fixupdate to proxmox-upgrade-checks 1.1, which accepts the 7.0 kernel, tells a bookworm backport apart from a trixie build and fixes the dkms check.
otherdocs: clarify in the backup protocol description that the manifest is uploaded by the client and only persisted on backup finish.