Proxmox VE 8.0.9 → 8.4.18
43 releases · 27 breaking changes · 9 security fixes · 0 advisories fixed
9security27breaking6deprecated181feature53fix
Breaking changes
- breaking Remove an outdated warning about entropy starvation when using /dev/random as an entropy source. in 8.4
- breaking Rework and improve the Netbox IPAM plugin to properly synchronize the deletion and updates of addresses and networks (issue 5496). Refactor the code to consistently handle errors reported by Netbox. Delete subnets in Netbox after they are removed in Proxmox VE. Properly return the address after… in 8.4
- breaking Manually create the IP Ranges in Netbox: in 8.4
- breaking Go to IPAM → IP Ranges and add the DHCP ranges you have configured for your subnet manually in 8.4
- breaking Let Proxmox VE recreate the IP Ranges: in 8.4
- breaking Go to SDN → VNets in 8.4
- breaking Edit the Subnet and delete all DHCP ranges, then click OK in 8.4
- breaking Edit the Subnet, re-create the DHCP ranges, then click OK in 8.4
- breaking Apply the SDN configuration in 8.4
- breaking ui: remove warning about entropy starvation of /dev/random, it does not apply since kernel 5.6 anymore. in 8.3.6
- breaking Improvements to Secure Boot management. With the need to update the revocation database embedded in the shim boot loader, some edge-cases were discovered and improved in the proxmox-secure-boot metapackage. Ship an apt pinning snippet to ensure that Proxmox provided packages are installed, even if… in 8.3
- breaking ui: remove experimental from change detection modes description in 8.2.9
- breaking Integrate patches that make it possible to manually install and use the upstream Ceph dashboard. Due to upstream changes, Proxmox VE 8.0 and 8.1 were incompatible with the Ceph dashboard. in 8.2
- breaking Remove deprecated and now forbidden priority field from change request to PowerDNS (issue 5275). in 8.2
- breaking Models using i40e. Their names can get an additional port suffix like p0 added. in 8.2
- breaking d/postinst: make deb-systemd-invoke non-fatal to avoid potentially breaking an update for unrelated reasons in 8.1.11
- breaking Remove the 10-minute timeout for allocating VM disks when restoring from backup, as this timeout may be exceeded if disks are large or network storage is involved (issue 2817). in 8.1
- breaking Using the Console/Shell on a PVE node is now possible for all users with the appropriate permissions (Sys.Console). The restriction to the pam was removed. The users will still need to login as a system user on the shell though. in 8.1
- breaking With Kernel 6.5 and ZFS it can happen that the host hits a kernel bug when starting a VM with hugepages, and the host must be rebooted. More information can be found in the forum and in the bug reports for ZFS and Linux kernel. in 8.1
- breaking Some users with Intel Wi-Fi cards, like the AX201 model, reported that initialization of the card failed with Linux kernel 6.5. This is still being investigated. You should avoid booting into the new kernel if you have no physical access to your server and an Intel Wi-Fi device is used as its only… in 8.1
- breaking Some SAS2008 controllers need a workaround to get detected since kernel 6.2, see the forum thread for details. in 8.1
- breaking For certain Linux VMs with OVMF and guest kernels >= 6.5, there might be issues with SCSI disk hot(un)plug. This is a more general issue and is currently being investigated and will be fixed on Linux upstream. in 8.1
- breaking The TPM (Trusted Platform Module) hardware random number generator (RNG) is now disabled on all AMD systems equipped with a firmware-based TPM (fTPM) device. This change was implemented due to such RNGs causing stutters in many systems. Affected systems should switch the RNG source from /dev/hwrng… in 8.1
- breaking Some Dell models, which appear to include all those using a BCM5720 network card, have a compatibility issue with the tg3 driver in the kernel based on version 6.5.11. From our current understanding 14th Generation Dell Servers (T140, R240, R640,...) are affected, while others (e.g., R630, R620,… in 8.1
- breaking Systems installed on top of Debian or those installed before Proxmox VE 7.0 will be switched by default from the ifupdown network configuration implementation to the modern ifupdown2. This switch occurs because the stabilized SDN package is now marked as a recommendation for various Proxmox VE… in 8.1
- breaking The pve-edk2-firmware package, which provides (U)EFI firmware for virtual machines, has been split up in multiple packages. Users of the fully supported amd64/x86_64 architectures do not need to change anything. The OVMF variants, used for amd64/x86_64 based virtual machines, got moved into… in 8.1
- breaking With the 8.1 machine version, QEMU switched to using SMBIOS 3.0 by default, utilizing a 64-bit entry point. Since the SMBIOS 32-bit and 64-bit entry points can coexist, and most modern operating systems set up both, the general impact should be minimal However, certain operating systems or… in 8.1
Security changes
- security Fix security issues concerning image formats that would allow sufficiently privileged attackers read or read-write access to arbitrary host files. See PSA-2024-00014-1, PSA-2025-00001-1, PSA-2025-00003-1, PSA-2025-00004-1. in 8.4
- security OVA/OVF import: Fix a security issue that would allow a sufficiently privileged attacker to obtain a copy of an arbitrary host file by importing a specifically crafted OVA appliance (PSA-2024-00013-1). in 8.4
- security Skip generating rules in forward chains for security groups bound to an interface, instead of causing an error. Rules in the forward chain operate on multiple interfaces, and binding them to an interface does not make sense. in 8.4
- security Several vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy. in 8.4
- security The selector for security groups now shows a tooltip for comments that are too long to fit within the column width (issue 5879). in 8.3
- security Fix a security issue where an authenticated user with necessary privileges can trick the system into accessing arbitrary host block devices, including passing them through into guests as a volume. in 8.3
- security Fix a security issue where authenticated attackers with Sys.Audit or VM.Monitor privileges could download arbitrary host files via the API. See PSA-2024-00009-1 for details. in 8.3
- security Fix a RCE vulnerability in the shim bootloader used for Secure Boot support. See PSA-2024-00007-1 for details. in 8.3
- security fix #5879: ui: add tooltip to security group comments in 8.2.9
Deprecations
- deprecated Clarify the handling of QEMU machine version deprecations. Starting with QEMU 10.1, machine versions will be removed from upstream QEMU after six years. Proxmox VE will support machine versions from approximately two previous major Proxmox VE releases. This is now documented, and QEMU will warn… in 8.4
- deprecated Avoid passing the deprecated noacl mount option for ext4 formatted volumes (issue 4846). in 8.2
- deprecated Deprecate notification options that were only relevant in a short transition period before the final notification system was introduced. in 8.2
- deprecated Restrict the values of legacy user-keys to the ones that were allowed in the deprecated initial TFA system. in 8.2
- deprecated Log a warning when starting a VM with a deprecated machine version. in 8.1
- deprecated Mark global pg_bits setting as deprecated and make it a no-op. The setting has been deprecated since Ceph 13. in 8.1
Every release in between
8.4.18 Sep 26, 2026
8.4.17 Sep 26, 2026
8.4.16 Sep 26, 2026
8.4.15 Sep 26, 2026
8.4.14 Sep 26, 2026
8.4.13 Sep 26, 2026
8.4.12 Sep 26, 2026
8.4.11 Sep 26, 2026
8.4.10 Sep 26, 2026
8.4.9 Sep 26, 2026
8.4.8 Sep 26, 2026
8.4.7 Sep 26, 2026
8.4.6 Sep 26, 2026
8.4.5 Sep 26, 2026
8.4.3 Sep 26, 2026
8.4.2 Sep 26, 2026
8.4.1 Apr 10, 2025
fixui: fix regression with checking if volume is QEMU backup, which could block some dialogues like file-restore.
otherceph versions: do not try to parse empty string and include raw string in error to make this easier to debug.
otherui: backup: hide change mode detection for VMs and non-PBS storage.
featureLatest 6.8.12-9 Kernel as new stable default
featureLive migration with mediated devices such as NVIDIA vGPU. This allows the migration of running VM guests that use mediated devices. Hardware and driver support is required. Currently, only NVIDIA GPUs are known to support live migration.
featureSupport for external backup providers. Proxmox VE now provides an API that allows developers to write backup provider plugins. A backup provider plugin can implement backup and restore functionality for external backup solutions. This way, external backup solutions can be fully integrated with the…
featureSharing host directories with VM guests using virtiofs. Virtiofs allows sharing directories between the Proxmox VE host and VMs without the overhead of a network filesystem. Modern Linux guests support virtiofs out of the box. Windows guests need to install additional software.
featureLatest Linux 6.14 kernel available as opt-in kernel.
featureCeph Squid 19.2.1 is available as stable option.
featureSeamless upgrade from Proxmox VE 7.4, see Upgrade from 7 to 8.
featureAllow to set a consent banner that users must acknowledge before logging in (issue 5463). This can be required for compliance reasons and is already supported in Proxmox Backup Server. The banner supports Markdown and can be set in Datacenter → Options → Consent Text.
featureSort storage content such as ISO files according to the browser locale and with numeric sorting (issue 6138). This results in a more natural sorting order with respect to capitalization and numbers in filenames.
featureDownloading ISO, CT templates, or OVA appliances from URLs now uses the configured proxy for both HTTP and HTTPS connections (issue 3716).
featureThe migration network in the datacenter options can now be entered with a custom CIDR (issue 6142).
featureTask lists now show an additional action column that opens the task details for better discoverability.
featureConfirmation dialogs now mention the guest name to make it clearer for which guest the action will be applied (issue 3181).
featureBetter align privilege checks for adding PCI, USB, or VirtIO RNG devices in the web UI with the actual privilege checks in the backend.
featureAllow uploading and downloading disk images to storages with content type "Import", in preparation for importing disk images to VMs in the future (issue 2424).
featureFix an issue where clicking on an external link to the GUI would display a login screen, even if the current session was still valid.
featureFix an issue where the PCI mapping editor would preselect the wrong radio button.
featureFix a security issue that allowed XSS via certain QEMU guest agent responses (PSA-2024-00016-1).
featureHTML-encode API results before rendering as additional hardening against XSS (PSA-2025-00002-1).
featureVarious smaller improvements to the GUI.
featureUpdate xterm.js to version 5.5.0.
featureFix an issue where an xterm.js console would not have the correct size on high-latency connections (issue 6223).
featureUpdate noVNC to version 1.6.0.
featureFix some occurrences where strings were not marked as translatable.
featureFix some occurrences where translatable strings were split, which made potentially useful context unavailable for translators.
featureImproved translations, among others:
deprecatedClarify the handling of QEMU machine version deprecations. Starting with QEMU 10.1, machine versions will be removed from upstream QEMU after six years. Proxmox VE will support machine versions from approximately two previous major Proxmox VE releases. This is now documented, and QEMU will warn…
securityFix security issues concerning image formats that would allow sufficiently privileged attackers read or read-write access to arbitrary host files. See PSA-2024-00014-1, PSA-2025-00001-1, PSA-2025-00003-1, PSA-2025-00004-1.
breakingRemove an outdated warning about entropy starvation when using /dev/random as an entropy source.
securityOVA/OVF import: Fix a security issue that would allow a sufficiently privileged attacker to obtain a copy of an arbitrary host file by importing a specifically crafted OVA appliance (PSA-2024-00013-1).
breakingRework and improve the Netbox IPAM plugin to properly synchronize the deletion and updates of addresses and networks (issue 5496). Refactor the code to consistently handle errors reported by Netbox. Delete subnets in Netbox after they are removed in Proxmox VE. Properly return the address after…
securitySkip generating rules in forward chains for security groups bound to an interface, instead of causing an error. Rules in the forward chain operate on multiple interfaces, and binding them to an interface does not make sense.
securitySeveral vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy.
breakingManually create the IP Ranges in Netbox:
breakingGo to IPAM → IP Ranges and add the DHCP ranges you have configured for your subnet manually
breakingLet Proxmox VE recreate the IP Ranges:
breakingGo to SDN → VNets
breakingEdit the Subnet and delete all DHCP ranges, then click OK
breakingEdit the Subnet, re-create the DHCP ranges, then click OK
breakingApply the SDN configuration
+116 more items in the release notes8.3.7 Apr 8, 2025
otherui: directory mapping: use actual words in the title
otherui: virtiofs edit: drop writeback checkbox, this feature is unsafe and behaves in unexpected ways.
otherui: set error mask: ensure that message is html-encoded to avoid glitches.
8.3.6 Apr 7, 2025
fixfix #5175: ui: allow configuring and live-migration of mapped PCI (vGPU) resources.
othermapping: pci: include mdev in config checks.
featureui: qemu: add configuration options for AMD SEV-SNP support.
fixfix #5463: show optional consent-banner before user can login. The banner can be configured in the datacenter options.
fixfix #5936: ui: backup: add CT PBS change detection mode selector for manual container backup dialogue.
fixfix #2413: pvestatd: read ballooning RAM usage target from node config.
fixfix #3716: api: use proxy option for https when querying the metadata for a to be downloaded template or ISO file.
otherui: let non-root users configure VirtIO RNG devices if they have the VM.Config.HWType privilege.
breakingui: remove warning about entropy starvation of /dev/random, it does not apply since kernel 5.6 anymore.
featureui: permissions: add ACL path for hardware RNG.
otherbulk migrate: improve precondition checks to also includes unavailable storages on the target node.
otherui: adapt migration window to precondition api additions.
fixui: fix string used for backup storage content-type for PBS backups.
otherui: lxc create: do not suggest nesting is enabled for privileged CTs, correctly clear the checkbox state when disabling it for that case.
otherui: ceph: use common spelling for metadata servers in title
otherapi subscription: output generic apt-auth stanza for ceph.
fixapi subscription: fix permissions for ceph apt-auth file.
featuresystem report: add WWN column to lsblk output.
fixpve7to8: fix broken pipe warning for dkms status invocation.
otherui: ensure various fields are html-encoded to avoid visual glitches.
fixfix #4411: ui: OpenID Connect realm: add fields for new group-mapping support, where a configured user claim is queried for the list of groups that a users should be set or added to.
featureui: tasks: add icon to better convey that one can open the task log from the list of task entries.
othernotifications: rework and clean-up various templates used to send notifications, including those for apt updates, backups, and replication.
featurenode configuration: add per-node option for memory ballooning target and allow one to edit them through the web UI.
featurebackup: implement backup for external providers with full integration reusing and extending our custom storage plugin architecture.
fixfix #6116: ui: qemu: create wizard: order main ISO CDROM drive before additional added CDROM drives in the boot order.
otheruser: password edit: show hint to clarify that password changes for PAM realm only apply to connected node.
otherui: guest migrate window: make all user-visible strings translatable.
otherui: do not split translatable strings.
otherui: qemu pci edit: select correct radiobutton when editing.
featureui: add human readable description for reloadnetworkall task.
otherclose #3181: ui: display guest name alongside VMID in confirm dialogs of potentially destructive actions.
featureui: storage content: allow upload of guest images for import type.
featureapi: add resource map api endpoints for directories.
featureui: add management for directory mappings in the datacenter view.
featureui: qemu: allow one to add Virtiofs devices to passthrough a directory mapping managed folder to the VM.
8.3.5 Mar 6, 2025
otherupdate shipped appliance info index
fixfix #6138: ui: storage content: use locale for sorting
otherui: sdn ipam: powerDNS, NetBox, phpIPAM: split layout in two columns
featureui: sdn ipam: powerDNS, NetBox, phpIPAM: add fingerprint textfield
featureui: storage pbs: reuse new pmxFingerprintField from widget-toolkit
8.3.4 Feb 18, 2025
fixfix #5699: add support to define a HTTP header from which the real IP of a connection should be parsed from. This can be useful for setups with a reverse proxy in front of the API server. On top of that add support for optionally configuring an allow-list of IP networks that the real source IP…
otherapi: network: improve completeness of return schema.
featureui: qemu: add hint that VMs using the VNC clipboard cannot be live migrated.
fixfix #6142: ui: datacenter options: allow custom CIDRs for migration network to cover cases where the network CIDR is not configured on any network interfaces on the node, like for example in a routed full-mesh configuration.
fixpull metric: fix node 'iowait' metric, return the percentage of time spent on waiting on IO in a certain time frame instead of returning the total amount of time that was spent waiting on IO, similar to how the push based metric servers do.
featured/control: add new pve-nvidia-vgpu-helper package as recommended dependency.
8.3.3 Jan 20, 2025
otherupdate shipped appliance info index
featureadd missing htmlEncode for some UI elements
8.3.2 Dec 16, 2024
featureapi: network: add return schema for interface listing
otherui: ceph pool: indentation clean-up
otherui: ceph: don't set default size/min-size when editing existing pool
featureui: ceph pool: add opt-in column for the configured pool application
otherui: qemu: improve error handling and rendering the QGA provided IP addresses of the guest.
otherapi: node status: complete API return schema
8.3.1 Nov 29, 2024
featureui: sdn firewall: add online help reference
featureui: cluster join info: add clipboard icon to "Copy Information" button
otherexternal metric server: influxdb: always quote tags
fixapi: notification targets: fix permission check for POST/PUT
featureLatest 6.8.12-4 Kernel as new stable default
featureNew Ceph Squid 19.2.0 available as technology preview
featureNew "Tag View" for a quick and customizable overview of virtual guests. Users can already categorize their virtual guests using custom tags. The new "Tag View" view type for the resource tree shows virtual guests grouped according to their tags. This allows for a quick overview of the categories…
featureTighter integration of the Software-Defined Networking (SDN) stack with the firewall. Proxmox VE SDN now generates IP sets for VNets and virtual guests managed by the PVE IP address management plugin. These IP sets can be referenced in firewall rules, making the rules simpler and easier to…
featureMore streamlined guest import from files in Open Virtualization Format (OVF) and Open Virtualization Appliances (OVA). OVF and OVA files can be directly imported from file-based storages in the GUI. This makes it easier to import virtual appliances and simplifies migration from hypervisors…
featureWebhook target for the notification system. The new webhook notification target allows notification events to trigger HTTP requests. Request headers and body can be customized and can contain notification metadata. This allows users to push notifications to any target that supports webhooks.
featureNew change detection modes for speeding up container backups to Proxmox Backup Server. Metadata and data of backup snapshots are now stored in two separate archives. Optionally, files that have not changed since the previous backup snapshot can be identified using the previous backup snapshot's…
featureCeph Squid 19.2.0 is available as a technology preview.
featureSeamless upgrade from Proxmox VE 7.4, see Upgrade from 7 to 8
featureIntroduce a tag view for the resource tree. Users can already assign tags to virtual guests to categorize them according to custom criteria. The new tag view shows virtual guests grouped according to their assigned tags. This allows users to get a quick and structured overview over the virtual…
featureConfirmation dialogs for guest actions now also display the guest name (issue 5787).
featureAllow unprivileged users to create and manage their API tokens via the GUI (issue 5722). The backend already allowed this, but the functionality was not available in the GUI.
featureUnplugging disks from a running VM is now done asynchronously to avoid running into the HTTP timeout of 30 seconds.
featureIncrease the minimum length requirement for new passwords to 8 characters.
featureNodes in maintenance mode are now displayed with a wrench icon in the resource tree.
featureShow only installed services in the node's system panel by default, but optionally allow to show all services (issue 5611).
featureRight-align numbers in the S.M.A.R.T. values table (issue 5831).
featureUpdate the noVNC guest viewer to upstream version 1.5.0.
featureFix an issue where using the noVNC console would cause the browser to attempt storing a VNC password (issue 5639).
featureFix an issue where notes for nodes and virtual guests did not preserve percent encodings (issue 5486).
featureFix an issue where clicking on an external link to the GUI would display a login screen, even if the current session was still valid.
featureFix an issue with reset behavior when editing a Proxmox Backup Server storage.
featureFix inconsistent reporting of host CPU usage in node selectors.
featureFix an issue where editing the PCI mappings for any but the first node would fail.
featureFix an issue where the Datacenter summary would miscalculate the storage size if a cluster node is offline.
featureFix an issue where the backup job details would misreport the backup mode as snapshot mode instead of suspend mode.
featureFix an issue where the permission check for adding the TPM state was overly strict.
featureFix a regression which broke the mobile UI (issue 5734).
featureFix incorrect online help links (issue 5632).
featureDisable the button for regenerating the cloud-init image if the user lacks the necessary privileges. This better aligns the GUI with the privilege check in the backend.
featureImproved translations, among others:
featureBulgarian (NEW!)
featureFrench
featureGerman
featureRussian
securityThe selector for security groups now shows a tooltip for comments that are too long to fit within the column width (issue 5879).
securityFix a security issue where an authenticated user with necessary privileges can trick the system into accessing arbitrary host block devices, including passing them through into guests as a volume.
securityFix a security issue where authenticated attackers with Sys.Audit or VM.Monitor privileges could download arbitrary host files via the API. See PSA-2024-00009-1 for details.
breakingImprovements to Secure Boot management. With the need to update the revocation database embedded in the shim boot loader, some edge-cases were discovered and improved in the proxmox-secure-boot metapackage. Ship an apt pinning snippet to ensure that Proxmox provided packages are installed, even if…
securityFix a RCE vulnerability in the shim bootloader used for Secure Boot support. See PSA-2024-00007-1 for details.
+173 more items in the release notes8.2.10 Nov 19, 2024
featureui: firewall: add sdn as valid scope to IP-set selector
featureui: firewall: add forward direction to rule panel
featureui: sdn: add firewall panel
otherui: firewall: show warning when creating forward rules
otherui: import: clarify working storage emptyText
otherchange recommendation of pve-network packages to hard dependency, it's now pulled in by pve-firewall anyway
otherapi: notifications: require powerful privileges for target management
8.2.9 Nov 18, 2024
otherapi/ui: improve mdev listing for PCI mappings. Extend the parameter for the PCI ID to accept both, PCI IDs or named mappings, and for the latter mappings, iterate over all local PCI devices in it and extract the mdev types.
featureui: implement 'Tag View' for the resource tree, which groups guests by their tags. Guests with multiple tags are visible under each of them. Guests without tags and nodes and storages are added to the end of the tree.
otherui: cloudinit: use cloudinit update api when regenerating images.
otherui: cloudinit: avoid suggesting to unprivileged users that they can re-generate the image, disable the button in this case.
fixfix #5787: ui: display guest name in confirmation dialog for actions like start, stop, shut down, or converting to a template.
featureui: lxc: add readonly option for device passthrough.
featureui: lxc: add the "discard" mount option.
otherui: expose the newly supported BZIP2 as available compressor for backups.
fixfix #5722: ui: api token: allow unprivileged users to create their own api tokens, they are self-service after all.
featureapi: add routes for webhook notification endpoints.
otherui: workspace/user view: change password minimum length to 8 to follow recent NIST recommendations.
otherui: pool: dynamic status update every 10s in members screen
fixui: pbs storage: fix reset behavior when editing existing entry
otherapi/ui: include the node ha status in resources call and show as icon
otherui: acme: switch cluster view items over to those from widget-toolkit
otherui: tree: show tooltips for all entries that have sensible information
fixfix #3893: api/ui: node network: expose bridge VLAN IDs option to allow one to configure VLAN ranges, This can be useful for devices that support hardware offloading them, but only support a limited amount.
breakingui: remove experimental from change detection modes description
featureui: add import content type for file-based storages to allow handling imports of OVA/OVF backed archives more conveniently.
featureui: guest import: add storage selector for overriding the OVA staging storage for the temporary extraction.
otherui: import: show size for dir-based storages
otherui: enable upload/download/remove buttons for 'import' type storages
featureui: qemu: add AMD SEV configuration to Options
securityfix #5879: ui: add tooltip to security group comments
fixfix #5810: ui: show confirmation/warning dialog for sdn apply
featureapi: package repositories: add Ceph Squid to available repos
8.2.8 Oct 24, 2024
fixfix #5734: provide missing methods for Proxmox.Utils for mobile UI
otherapi: subscription update: report error if removing ceph-auth file fails
featureadd module to centrally track Ceph release info for the backend
otherpveceph: prompt user on TTY about installing experimental version
featureceph releases: add 19.2 Squid as available release, currently still as technology preview
fixfix #5753: api: add 'pstart' member to task status return schema
fixfix #5302: ui: vm cpu affinity displayed in hardware overview
fixfix typos in user visible strings
fixfix #5632: ui:storage: correct online help link of backup view
otherui: ceph wizard: show hint for releases that are in tech-preview state
otherui: ceph wizard: filter out enterprise repo for tech-preview releases
featureui: ceph wizard: add Ceph 19.2 Squid as installable release
otherapi: improve the API JSON schema of various API calls
8.2.7 Sep 23, 2024
featureapi: add missing schema annotations for download endpoints and adapt existing ones to renaming the respective property to 'download_allowed'.
otherpvesh: limit download handling to annotated endpoints to unify the behaviour with pve-http-server.
8.2.6 Sep 20, 2024
fixfix #5731: vzdump jobs: fix execution of converted jobs
8.2.5 Sep 12, 2024
otherui: qemu hardware: use background delay for asynchronous remove tasks so that the task log window doesn't get shown if the task already finished.
otherui: qemu hardware: use asynchronous remove API call for disk hot-unplug to expand the task duration timeout from 30 seconds to 10 minutes, helping overloaded and/or slow systems.
featurevzdump config: add fleecing property string to make it clear that fleecing can be configured as a node-wide default too.
fixui: fix align mode of the two-column container widget, which is used for the advanced tab of the backup job edit window.
fixvzdump: fix unit for bandwidth limit in log message, it's in KiB (base 2) not KB (base 10)
featurepve7to8: allow one to run arbitrary newer Proxmox kernels after upgrade
featureapi: replication: add 'job-id' to notification metadata to allow users to create notification match rules for specific replication jobs.
othervzdump: apt: notification: do not include domain in 'hostname' field.
otherapi: replication: include 'hostname' field for notifications.
fixpve7to8: fix typo in log message.
otherui: backup job: clarify experimental change detection modes.
fixui: fix maxcpu validity check in the host CPU renderer to add a missing space, making it consistent with the CPU usage column.
fixui: utils: fix inconsistency in host cpu usage display in search view, adding a missing space between the number of CPUs and the actual label.
fixui: sdn ipam: fix editing custom mappings
featureapi: ceph mds: ensure the ID for a new MDS does not start with a number, as Ceph doesn't supports that.
fixfix #5570 ui: ceph: make the MDS ID fully configurable to avoid a issue when the hostname, which is was used as base for the ID, starts with a number. This also made the "extra ID" field redundant.
fixfix #5010: ceph: pool set only properties that actually changed to avoid false-positive errors.
otherapi: backup jobs: pass the job ID parameter to make it accessible for the notification system.
featureui: backup jobs: allow one to set custom job ID in advanced settings
fixui: resource mappings: fix editing of mapping for non first node
otherui: sdn vnets: hide irrelevant fields depending on zone type
fixui: dc summary: fix calculation of storage size when one or more nodes are offline
featureapi: metrics: add /cluster/metrics/export endpoint
fixui: qemu: hardware: fix permission check for enabling the button to add a TPM-state volume
otherupdate shipped appliance info index
8.2.4 Jun 10, 2024
otherpvestatd: clear trailing newlines
featurewww: advanced backup: add pbs change detection mode selector
featurevzdump: add pbs-change-detection-mode to config template
8.2.3 Jun 4, 2024
otherupdate shipped appliance info index
featureapi: add proxmox-firewall to versions pkg list
othergitignore: ignore any test artifacts
othertests: remove vzdump_notification test
othernotifications: use named templates instead of in-code templates
8.2.2 Apr 23, 2024
fixui: fix form-reset behavior of backup job editor
fixui: backup jobs: fix fleecing parameters for 'run now' button
fixui: mobile: fix login for users that have a TOTP based second factor set up
otherui: mobile: show is setup is lacking the best recommendations for enterprise production set ups
othervzdump: also warn when hook script fails for backup-abort or log-end phase
featureui: user edit: protect user's TFA settings for new factor variants
fixfix #5251: ui: login: set autocomplete on password and user
otherui: esxi importer: try to better convey what live-import does
featureLatest 6.8 Kernel as new stable default
featureNew import wizard to migrate guests directly from other hypervisors. Connect to other hypervisors using their public APIs and directly migrate guests to Proxmox VE. First implementation is for VMware ESXi. Guests can be started on Proxmox VE while their data is still being imported to the target…
featureSupport for automated and unattended installation of Proxmox VE. Proxmox VE now ships a tool that prepares a Proxmox VE ISO for automated installation. The prepared ISO retrieves all required settings for automated installation from an answer file. The answer file can be provided directly in the…
featureBackup fleecing (advanced feature). When creating a backup of a running VM, a slow backup target can negatively impact guest IO during the backup process. Fleecing can reduce this impact by using fast local storage as a buffer for data blocks. However, the fleecing approach requires the use of…
featureModernized Proxmox VE firewall implementation based on nftables (opt-in technology preview). The new implementation is written in Rust and intended to replace the current firewall based on iptables in the future. Moving to nftables will improve robustness and make it possible to fix long-standing…
featureSeamless upgrade from Proxmox VE 7.4, see Upgrade from 7 to 8
featureFix an issue where the VM creation wizard would not allow creating a VM without an ISO.
featureFix an issue that prevented users from seeing accessible replication jobs.
featureFix an issue where the node summary page would not display the version of a running foreign kernel (issue 5121).
featureWhen editing LVM or directory storages, add an explanatory tooltip to the "Shared" checkbox.
featureExpose the saferemove setting for LVM storages in the GUI.
featureAdd some missing packages to the "Package versions" window.
featureWhen editing ZFS storages, display 16k as the blocksize placeholder to reflect the current ZFS defaults.
featureChange "Syslog" button to "System Log" button to better reflect that the log is gathered from the systemd journal.
featureFix an issue where the GUI used an incorrect language code for Korean, and provide a clean transition for users who still have a cookie with the incorrect language code set.
featureImprove documentation of the /nodes/{node}/status API call.
featureFix an issue where the date picker would choose the wrong date after changing to a different month.
featureWhen granting permissions to a group, make the group selector searchable, similar to the user and token selectors.
featureClarify the confirmation prompt for removing a certificate without a name.
featureFix an issue where edit windows would not be correctly masked while loading.
featureFix an issue where adding a storage to a pool would break edit windows of the same browser session, and guard against similar issues in the future.
featureDisplay the end-of-life message as a notice up until three weeks before the end-of-life date, and display it as a warning from that point on.
featureMove the "Reset" button for edit windows to an icon-only button in the title bar (issue 5277). This reduces the risk of misclicking and accidentally resetting form data.
featureFix xterm.js not loading in certain OS+Browser constellations, for example iOS (issue 5063).
featureChange the icon for editing guest notes from a gear to a more fitting pencil.
featureAllow to select note contents by double-clicking. Previously, this was not possible because double-clicking on a note would always open the editor window. This behavior can now be optionally disabled by a browser-local GUI setting.
featureThe TFA input field now sets an autocompletion hint for improved compatibility with password managers (issue 5251).
featureFix an issue where the mobile UI did not allow to log in with TOTP.
featureDisplay the subscription reminder in the mobile UI as well, for improved consistency with the GUI.
featureThe user edit window now disables the "Key IDs" field if the user has TFA configured.
featureThe HTTP server now supports compressing responses using deflate in addition to gzip.
featureImproved translations, among others:
featureFrench
featureGerman
deprecatedAvoid passing the deprecated noacl mount option for ext4 formatted volumes (issue 4846).
deprecatedDeprecate notification options that were only relevant in a short transition period before the final notification system was introduced.
breakingIntegrate patches that make it possible to manually install and use the upstream Ceph dashboard. Due to upstream changes, Proxmox VE 8.0 and 8.1 were incompatible with the Ceph dashboard.
deprecatedRestrict the values of legacy user-keys to the ones that were allowed in the deprecated initial TFA system.
breakingRemove deprecated and now forbidden priority field from change request to PowerDNS (issue 5275).
breakingModels using i40e. Their names can get an additional port suffix like p0 added.
+151 more items in the release notes8.1.11 Apr 19, 2024
fixfix #4136: backup: implement fleecing option for improved guest stability when the backup target is slow
featureapi: notifications: add missing 'smtp' to index
otheruse SSH command helper for pvesh and to get VNC connection info to benefit from improvements like known host key pinning
othersystem report: list held-back and pinned APT packages and priorities of APT sources
othersystem report: avoid printing the contents of certain wrongly named configuration files
othersystem report: output cluster-wide job configuration
othersystem report: output kernel command line from current boot
featureui: acl: allow searching by typing in the group selector
otherapi: apt versions: track optional amd64-/intel-microcode and pve-esxi-import-tools packages
featureui: acme: add External Account Binding (EAB) related fields
fixfix #5093: ui: acme: expose custom directory option
breakingd/postinst: make deb-systemd-invoke non-fatal to avoid potentially breaking an update for unrelated reasons
fixfix #4513: ui: backup job: add tab for advanced options
othervzdump: improve handling performance settings, by using a per-property fallback and honoring the schema defaults
featureui: lxc: add edit window for device passthrough
featureui: lxc: add firewall log view filtering
fixfix #4963: ui: firewall: fix edge case where editing firewall rules using ips / cidrs would be broken
fixfix #1905: ui: VM: allow moving unused disks
fixfix #4759: ceph: configure ceph-crash.service and its key
featuresdn: evpn: allow empty primary exit node in zone form which was broken by a change in libpve-network-perl
8.1.10 Mar 28, 2024
featureguest import: allow setting VLAN-tag for network devices in advanced tab
8.1.8 Mar 27, 2024
otherui: parser: recognize Intel E1000E as network card
featureui: network card selector: add Intel E1000E as choosable model
featureui: guest import: allow setting mac addresses to newly generated unique ones
otherui: guest import: use box-label style for prepare-for-virtio checkbox
otherui: guest import: fine tune icons
otherui: guest import: validate that selected VMID does not exist yet
8.1.5 Mar 14, 2024
otherreport: format iptables output for readability
fixfix #5067: vzdump: include total backup size in notification
otherui: storage: zfs: set blocksize placeholder (empty text) to 16k
featureui: add compat for fix of previously wrongly used Korean language code
otherui: lvm: expose saferemove setting
featurepvesubscription: add missing return statement to avoid a failing null check and its error message.
fixceph: fix edge case of wrong files being deleted on purge
otherui: node: system: avoid using specific and outdated 'Syslog', just call it 'System Log'
fixfix #5106: ui: ceph status: make column wrap the summary text on expand
otherui: qemu: bump max cores to 256 by socket
otherapi: node status: document boot-info and current-kernel in return schema
featureapi: nodes: allow usage of query url metadata with Sys.AccessNetwork
otherui: storage: enable download-url button with Sys.AccessNetwork capability
otherui: IP-set: re-work column widths
8.1.4 Dec 14, 2023
otherapi: apt versions: track dnsmasq and frr-pythontools as optional packages
featureapi: node status: add guard for missing secure-boot efi var
otherui: iso selector: disable all fields to avoid bogus validation where one cannot confirm the dialog even though the values visible are correct
featureapi: replication: allow users to enumerate accessible replication jobs
fixfix #5121: ui: node status: avoid invalid array access for certain foreign kernels
8.1.3 Nov 23, 2023
fixui: pool view: fix editing nested pools
featureLatest 6.5 Kernel as new stable default
featureSecure Boot support. Proxmox VE now includes a signed shim bootloader trusted by most hardware's UEFI implementations. All necessary components of the boot chain are available in variants signed by Proxmox. The Proxmox VE installer can now be run in environments where Secure Boot is required and…
featureThe core of Proxmox VE's Software-Defined Network stack moved from experimental to supported and includes new features. Proxmox VE SDN allows fine-grained control of virtual guest networks at the datacenter level. The new automatic DHCP IP address management (IPAM) plugin can be used to…
featureNew flexible notification system. Send notifications not only via the local Postfix MTA, but also via authenticated SMTP or to Gotify instances. Flexible notification routing with matcher-based rules to decide which targets receive notifications about which events.
featureProxmox Server Solution GmbH, the company behind Proxmox VE development and infrastructure, was assigned an official Organizationally Unique Identifier (OUI) BC:24:11 from the IEEE to use as default MAC prefix for virtual guests. This OUI can be used for virtual guests inside private networks by…
featureCeph Reef is now supported and the default for new installations. Reworked defaults brings improved performance and increased reading speed out of the box, with less tuning required.
featureSeamless upgrade from Proxmox VE 7.4, see Upgrade from 7 to 8.
featureImprovements to bulk actions:
featureAdd a new "Bulk Suspend" action to suspend a selection of guests in one action.
featureAdd a new section above the guest list for configuring guest filters and add a button for clearing filters.
featureAllow to filter guests by their tags.
featureReorder fields and drop obvious warning about local storage to improve on screen-space utilization.
featureReword the message displayed for bulk actions in the task log to "Bulk Start/Stop/Migrate". The message shown previously was "Start/Stop/Migrate all" and could be misleading in case not all guests were affected (issue 2336).
featureThe "Bulk Migrate" action is now hidden on standalone nodes, as there is no valid migration target in that case.
featureImprovements to the node summary panel:
featureThe summary now indicates whether the node was booted in legacy (BIOS) mode, EFI mode, or EFI mode with Secure Boot enabled.
featureThe currently running kernel is now reported more compactly by indicating only the version and the build date.
featureAllow to automatically decompress an ISO file when downloading from a URL to a storage. The decompression algorithm can be set in the GUI (issue 4849).
featureAllow moving VMs and containers from one pool to a different pool in one operation.
featureAvoid needlessly reloading the GUI after ordering a certificate via ACME for a different cluster node.
featureThe permission editor now also shows the ACL paths for notifications and PCI/USB mappings.
featureThe resource tree now displays the usage in percent when hovering over a storage.
featureIf the configured tree shape for tags is not "Full", the resource tree now displays a tooltip with the tag name when hovering over the configured shape.
featureEnsure the SPICE config is downloaded with the correct file extension on Safari to avoid problems with macOS application association (issue 4947)
featureFix an issue where the "Migrate" button stayed disabled even if selecting a valid target node.
featureFix a bug where the backup job editor window would add an invalid entry for VMID 0 when using selection mode "all".
featureImprove error message when creating a VM with an invalid hostname: Clarify that a valid hostname, not a valid DNS name, is expected (issue 4874).
breakingRemove the 10-minute timeout for allocating VM disks when restoring from backup, as this timeout may be exceeded if disks are large or network storage is involved (issue 2817).
deprecatedLog a warning when starting a VM with a deprecated machine version.
deprecatedMark global pg_bits setting as deprecated and make it a no-op. The setting has been deprecated since Ceph 13.
breakingUsing the Console/Shell on a PVE node is now possible for all users with the appropriate permissions (Sys.Console). The restriction to the pam was removed. The users will still need to login as a system user on the shell though.
breakingWith Kernel 6.5 and ZFS it can happen that the host hits a kernel bug when starting a VM with hugepages, and the host must be rebooted. More information can be found in the forum and in the bug reports for ZFS and Linux kernel.
breakingSome users with Intel Wi-Fi cards, like the AX201 model, reported that initialization of the card failed with Linux kernel 6.5. This is still being investigated. You should avoid booting into the new kernel if you have no physical access to your server and an Intel Wi-Fi device is used as its only…
breakingSome SAS2008 controllers need a workaround to get detected since kernel 6.2, see the forum thread for details.
breakingFor certain Linux VMs with OVMF and guest kernels >= 6.5, there might be issues with SCSI disk hot(un)plug. This is a more general issue and is currently being investigated and will be fixed on Linux upstream.
breakingThe TPM (Trusted Platform Module) hardware random number generator (RNG) is now disabled on all AMD systems equipped with a firmware-based TPM (fTPM) device. This change was implemented due to such RNGs causing stutters in many systems. Affected systems should switch the RNG source from /dev/hwrng…
breakingSome Dell models, which appear to include all those using a BCM5720 network card, have a compatibility issue with the tg3 driver in the kernel based on version 6.5.11. From our current understanding 14th Generation Dell Servers (T140, R240, R640,...) are affected, while others (e.g., R630, R620,…
breakingSystems installed on top of Debian or those installed before Proxmox VE 7.0 will be switched by default from the ifupdown network configuration implementation to the modern ifupdown2. This switch occurs because the stabilized SDN package is now marked as a recommendation for various Proxmox VE…
breakingThe pve-edk2-firmware package, which provides (U)EFI firmware for virtual machines, has been split up in multiple packages. Users of the fully supported amd64/x86_64 architectures do not need to change anything. The OVMF variants, used for amd64/x86_64 based virtual machines, got moved into…
breakingWith the 8.1 machine version, QEMU switched to using SMBIOS 3.0 by default, utilizing a 64-bit entry point. Since the SMBIOS 32-bit and 64-bit entry points can coexist, and most modern operating systems set up both, the general impact should be minimal However, certain operating systems or…
+142 more items in the release notes