Proxmox Backup Server 4.2.5 → 4.2.9
4 releases · 1 breaking change · 1 security fix · 0 advisories fixed
1security1breaking1deprecated3feature7fix
Breaking changes
- breaking fix #6267: remove old task logs and archives again on busy systems. in 4.2.7
Security changes
- security backup-manager cli: document that cert update create auth and csrf key if they are missing in 4.2.6
Deprecations
- deprecated update proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice. in 4.2.7
Every release in between
4.2.9 Nov 3, 2026
otherdocs: installer: document the advanced network options
othersnapshot locking: improve error contexts, prefer short human readable format instead of struct-debug printing
otherdatastore: prefer standard library over custom unsafe code
otherdatastore: rephrase error messages for failed chunk insert, to direct users at running verification if required
fixfix #7746: cli: manager: show installed instead of candidate version
otherGC: fail on abnormal system time drifted between phase 1 and 2, to avoid dataloss in case of manual or automatic system clock adjustments during GC runtime
otherbackup API: reject snapshots created using future timestamps outside of configured "time skew" acceptance window
otherprune: ignore snapshots with backup timestamp in the future
otherapi: sync jobs: extend privilege checks when modifying sync job to cover pre-update configuration
featureauth: ldap/ad: reject empty passwords, which might be interpreted as unauthenticated binds if the backend server allows them
4.2.8 Oct 2, 2026
othertape: labeling: improve error message for tapes with existing data, making the need for formatting them easier to understand.
fixfix #8003: sync: pull: log skipped chunk reuse in case of failed verification. When the previous snapshot is marked as failed, the chunks referenced by it are not reused, but this fact was not logged before.
fixfix #6251: api: list tasks: skip running tasks when failed ones are requested, since a task that is still running cannot have failed.
othersync: refactor and improve ACL checks when setting up local pull sync jobs, encrypting or decrypting sync jobs and prune jobs.
featureapi: admin: add missing ACL check for GC status endpoint, correctly limiting it to users with audit or backup privs.
fixfixed index files: prevent out-of-bounds memory access in FixedIndexReader and restrict fixed index files to a chunk size of 4MB in general. The backup API only allowed creating fixed index files with such a chunk size in the first place, now this is enforced across the board.
othersync: pull: refactor handling of reusable chunks to include checking of chunk sizes, in addition to chunk digests. This prevents a misbehaving pull source from potentially creating inconsistent index files on the target.
4.2.7 Sep 23, 2026
otherdocs: warn in the FAQ that apt upgrade can leave a partial upgrade, as only apt full-upgrade can remove packages to satisfy dependencies. Also fix a typo in the pcat1 file format description.
otheropenid auth: log the full error chain if getting the authorization URL fails, to ease diagnosing connection problems.
fixfix #7823: tape: do not announce a data-in transfer for SCSI commands without a data phase, which targets such as SCST rejected with an ILLEGAL REQUEST error.
othertape: configuration: also reject drive or changer device paths already used by another entry of the same type on update. Enforce unique drive numbers within each changer on creation and update. Existing duplicates can block edits until they are resolved.
othertape: permissions:
othercheck '/tape/device/{drive}' for backup, restore and the drive list, as grants on this documented path were previously ignored.
otherrequire Datastore.Read on the datastore and Tape.Write on the media pool and drive when creating or updating tape backup jobs. Scheduled jobs run as root@pam, so job editors could otherwise get a datastore written to tape without having read access to it.
othertape restore: validate the datastore name read from tape and require the snapshot name to match the one selected for restore, so corrupt or crafted media cannot place temporary files outside of the restore directory.
others3: validate object keys against the datastore layout when refreshing the contents from the bucket, instead of using them as file paths unchecked. Directory marker objects returned by some providers are now skipped.
otherclient: pxar: harden restore and extraction against crafted archives that could write or link files outside of the target directory. Symlinks are no longer followed when entering existing directories or overwriting files, also for symlinks already in the target, and hardlink targets must resolve…
otherupdate proxmox-rest-server to 1.1.1:
otheronly abort a worker task if its whole UPID matches. Previously, users allowed to stop their own tasks could stop others' tasks through a crafted UPID.
breakingfix #6267: remove old task logs and archives again on busy systems.
otherharden authentication: mask the credential check runtime in the delay for failed logins, skip malformed cookie pairs and prefer a ticket over an API token in the same request.
otheraccept quoted and unquoted Forwarded header addresses with optional ports, use the last proxy element and reject unterminated quotes.
otherhonor zero deflate weights in Accept-Encoding, stop logging redirects and unchanged responses as failures, and log client errors as warnings.
otherrun all API authentication and permission checks through one shared code path.
deprecatedupdate proxmox-s3-client to 1.4.2: prevent the passive request limit from overriding the active one, and name 'limit-active-requests' as the replacement in the 'put-rate-limit' deprecation notice.
otherupdate proxmox-network-api to 1.0.6:
fixfix #7329: allow listing interfaces configured with the IPv6 'auto' method.
otherkeep dhcp, auto and loopback methods on unrelated updates instead of switching to manual, which could drop IPv6 settings.
otherreject non-static methods while an address or gateway is set for the same address family.
otherupdate proxmox-rate-limiter to 1.0.1: prevent frequent refill updates from stalling low-rate traffic, and fix opening the shared limiter on aarch64.
4.2.6 Sep 16, 2026
securitybackup-manager cli: document that cert update create auth and csrf key if they are missing
othernotifications: use Severity::Error for acme renewal failures
otherconfig: invalidate CachedUserInfo after ACL changes, to reduce the time it takes for ACL changes to become active
fixfix #7911: api: report: mark endpoint as protected, since it calls commands that require root privileges
otherclient: improve handling of encryption/signing key configuration and manifest signature state
otherbackup: change misleading log message in sign-only mode
othermanifest: reject unsigned manifests when a key is set
otherreuse chunks across compatible crypt modes, e.g. when transitioning from unsigned to signed
featurerestore: allow explicitly trusting unsigned backups, even if the client has a key configured