Proxmox VE 8.3.1 → 8.4.16
22 releases · 10 breaking changes · 4 security fixes · 0 advisories fixed
4security10breaking1deprecated44feature15fix
Breaking changes
- breaking Remove an outdated warning about entropy starvation when using /dev/random as an entropy source. in 8.4
- breaking Rework and improve the Netbox IPAM plugin to properly synchronize the deletion and updates of addresses and networks (issue 5496). Refactor the code to consistently handle errors reported by Netbox. Delete subnets in Netbox after they are removed in Proxmox VE. Properly return the address after… in 8.4
- breaking Manually create the IP Ranges in Netbox: in 8.4
- breaking Go to IPAM → IP Ranges and add the DHCP ranges you have configured for your subnet manually in 8.4
- breaking Let Proxmox VE recreate the IP Ranges: in 8.4
- breaking Go to SDN → VNets in 8.4
- breaking Edit the Subnet and delete all DHCP ranges, then click OK in 8.4
- breaking Edit the Subnet, re-create the DHCP ranges, then click OK in 8.4
- breaking Apply the SDN configuration in 8.4
- breaking ui: remove warning about entropy starvation of /dev/random, it does not apply since kernel 5.6 anymore. in 8.3.6
Security changes
- security Fix security issues concerning image formats that would allow sufficiently privileged attackers read or read-write access to arbitrary host files. See PSA-2024-00014-1, PSA-2025-00001-1, PSA-2025-00003-1, PSA-2025-00004-1. in 8.4
- security OVA/OVF import: Fix a security issue that would allow a sufficiently privileged attacker to obtain a copy of an arbitrary host file by importing a specifically crafted OVA appliance (PSA-2024-00013-1). in 8.4
- security Skip generating rules in forward chains for security groups bound to an interface, instead of causing an error. Rules in the forward chain operate on multiple interfaces, and binding them to an interface does not make sense. in 8.4
- security Several vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy. in 8.4
Deprecations
- deprecated Clarify the handling of QEMU machine version deprecations. Starting with QEMU 10.1, machine versions will be removed from upstream QEMU after six years. Proxmox VE will support machine versions from approximately two previous major Proxmox VE releases. This is now documented, and QEMU will warn… in 8.4
Every release in between
8.4.16 Sep 26, 2026
8.4.15 Sep 26, 2026
8.4.14 Sep 26, 2026
8.4.13 Sep 26, 2026
8.4.12 Sep 26, 2026
8.4.11 Sep 26, 2026
8.4.10 Sep 26, 2026
8.4.9 Sep 26, 2026
8.4.8 Sep 26, 2026
8.4.7 Sep 26, 2026
8.4.6 Sep 26, 2026
8.4.5 Sep 26, 2026
8.4.3 Sep 26, 2026
8.4.2 Sep 26, 2026
8.4.1 Apr 10, 2025
fixui: fix regression with checking if volume is QEMU backup, which could block some dialogues like file-restore.
otherceph versions: do not try to parse empty string and include raw string in error to make this easier to debug.
otherui: backup: hide change mode detection for VMs and non-PBS storage.
featureLatest 6.8.12-9 Kernel as new stable default
featureLive migration with mediated devices such as NVIDIA vGPU. This allows the migration of running VM guests that use mediated devices. Hardware and driver support is required. Currently, only NVIDIA GPUs are known to support live migration.
featureSupport for external backup providers. Proxmox VE now provides an API that allows developers to write backup provider plugins. A backup provider plugin can implement backup and restore functionality for external backup solutions. This way, external backup solutions can be fully integrated with the…
featureSharing host directories with VM guests using virtiofs. Virtiofs allows sharing directories between the Proxmox VE host and VMs without the overhead of a network filesystem. Modern Linux guests support virtiofs out of the box. Windows guests need to install additional software.
featureLatest Linux 6.14 kernel available as opt-in kernel.
featureCeph Squid 19.2.1 is available as stable option.
featureSeamless upgrade from Proxmox VE 7.4, see Upgrade from 7 to 8.
featureAllow to set a consent banner that users must acknowledge before logging in (issue 5463). This can be required for compliance reasons and is already supported in Proxmox Backup Server. The banner supports Markdown and can be set in Datacenter → Options → Consent Text.
featureSort storage content such as ISO files according to the browser locale and with numeric sorting (issue 6138). This results in a more natural sorting order with respect to capitalization and numbers in filenames.
featureDownloading ISO, CT templates, or OVA appliances from URLs now uses the configured proxy for both HTTP and HTTPS connections (issue 3716).
featureThe migration network in the datacenter options can now be entered with a custom CIDR (issue 6142).
featureTask lists now show an additional action column that opens the task details for better discoverability.
featureConfirmation dialogs now mention the guest name to make it clearer for which guest the action will be applied (issue 3181).
featureBetter align privilege checks for adding PCI, USB, or VirtIO RNG devices in the web UI with the actual privilege checks in the backend.
featureAllow uploading and downloading disk images to storages with content type "Import", in preparation for importing disk images to VMs in the future (issue 2424).
featureFix an issue where clicking on an external link to the GUI would display a login screen, even if the current session was still valid.
featureFix an issue where the PCI mapping editor would preselect the wrong radio button.
featureFix a security issue that allowed XSS via certain QEMU guest agent responses (PSA-2024-00016-1).
featureHTML-encode API results before rendering as additional hardening against XSS (PSA-2025-00002-1).
featureVarious smaller improvements to the GUI.
featureUpdate xterm.js to version 5.5.0.
featureFix an issue where an xterm.js console would not have the correct size on high-latency connections (issue 6223).
featureUpdate noVNC to version 1.6.0.
featureFix some occurrences where strings were not marked as translatable.
featureFix some occurrences where translatable strings were split, which made potentially useful context unavailable for translators.
featureImproved translations, among others:
deprecatedClarify the handling of QEMU machine version deprecations. Starting with QEMU 10.1, machine versions will be removed from upstream QEMU after six years. Proxmox VE will support machine versions from approximately two previous major Proxmox VE releases. This is now documented, and QEMU will warn…
securityFix security issues concerning image formats that would allow sufficiently privileged attackers read or read-write access to arbitrary host files. See PSA-2024-00014-1, PSA-2025-00001-1, PSA-2025-00003-1, PSA-2025-00004-1.
breakingRemove an outdated warning about entropy starvation when using /dev/random as an entropy source.
securityOVA/OVF import: Fix a security issue that would allow a sufficiently privileged attacker to obtain a copy of an arbitrary host file by importing a specifically crafted OVA appliance (PSA-2024-00013-1).
breakingRework and improve the Netbox IPAM plugin to properly synchronize the deletion and updates of addresses and networks (issue 5496). Refactor the code to consistently handle errors reported by Netbox. Delete subnets in Netbox after they are removed in Proxmox VE. Properly return the address after…
securitySkip generating rules in forward chains for security groups bound to an interface, instead of causing an error. Rules in the forward chain operate on multiple interfaces, and binding them to an interface does not make sense.
securitySeveral vulnerabilities in GRUB that could be used to bypass SecureBoot were discovered and fixed (PSA-2025-00005-1) The Documentation for SecureBoot now includes instructions to prevent using vulnerable components for booting via a revocation policy.
breakingManually create the IP Ranges in Netbox:
breakingGo to IPAM → IP Ranges and add the DHCP ranges you have configured for your subnet manually
breakingLet Proxmox VE recreate the IP Ranges:
breakingGo to SDN → VNets
breakingEdit the Subnet and delete all DHCP ranges, then click OK
breakingEdit the Subnet, re-create the DHCP ranges, then click OK
breakingApply the SDN configuration
+116 more items in the release notes8.3.7 Apr 8, 2025
otherui: directory mapping: use actual words in the title
otherui: virtiofs edit: drop writeback checkbox, this feature is unsafe and behaves in unexpected ways.
otherui: set error mask: ensure that message is html-encoded to avoid glitches.
8.3.6 Apr 7, 2025
fixfix #5175: ui: allow configuring and live-migration of mapped PCI (vGPU) resources.
othermapping: pci: include mdev in config checks.
featureui: qemu: add configuration options for AMD SEV-SNP support.
fixfix #5463: show optional consent-banner before user can login. The banner can be configured in the datacenter options.
fixfix #5936: ui: backup: add CT PBS change detection mode selector for manual container backup dialogue.
fixfix #2413: pvestatd: read ballooning RAM usage target from node config.
fixfix #3716: api: use proxy option for https when querying the metadata for a to be downloaded template or ISO file.
otherui: let non-root users configure VirtIO RNG devices if they have the VM.Config.HWType privilege.
breakingui: remove warning about entropy starvation of /dev/random, it does not apply since kernel 5.6 anymore.
featureui: permissions: add ACL path for hardware RNG.
otherbulk migrate: improve precondition checks to also includes unavailable storages on the target node.
otherui: adapt migration window to precondition api additions.
fixui: fix string used for backup storage content-type for PBS backups.
otherui: lxc create: do not suggest nesting is enabled for privileged CTs, correctly clear the checkbox state when disabling it for that case.
otherui: ceph: use common spelling for metadata servers in title
otherapi subscription: output generic apt-auth stanza for ceph.
fixapi subscription: fix permissions for ceph apt-auth file.
featuresystem report: add WWN column to lsblk output.
fixpve7to8: fix broken pipe warning for dkms status invocation.
otherui: ensure various fields are html-encoded to avoid visual glitches.
fixfix #4411: ui: OpenID Connect realm: add fields for new group-mapping support, where a configured user claim is queried for the list of groups that a users should be set or added to.
featureui: tasks: add icon to better convey that one can open the task log from the list of task entries.
othernotifications: rework and clean-up various templates used to send notifications, including those for apt updates, backups, and replication.
featurenode configuration: add per-node option for memory ballooning target and allow one to edit them through the web UI.
featurebackup: implement backup for external providers with full integration reusing and extending our custom storage plugin architecture.
fixfix #6116: ui: qemu: create wizard: order main ISO CDROM drive before additional added CDROM drives in the boot order.
otheruser: password edit: show hint to clarify that password changes for PAM realm only apply to connected node.
otherui: guest migrate window: make all user-visible strings translatable.
otherui: do not split translatable strings.
otherui: qemu pci edit: select correct radiobutton when editing.
featureui: add human readable description for reloadnetworkall task.
otherclose #3181: ui: display guest name alongside VMID in confirm dialogs of potentially destructive actions.
featureui: storage content: allow upload of guest images for import type.
featureapi: add resource map api endpoints for directories.
featureui: add management for directory mappings in the datacenter view.
featureui: qemu: allow one to add Virtiofs devices to passthrough a directory mapping managed folder to the VM.
8.3.5 Mar 6, 2025
otherupdate shipped appliance info index
fixfix #6138: ui: storage content: use locale for sorting
otherui: sdn ipam: powerDNS, NetBox, phpIPAM: split layout in two columns
featureui: sdn ipam: powerDNS, NetBox, phpIPAM: add fingerprint textfield
featureui: storage pbs: reuse new pmxFingerprintField from widget-toolkit
8.3.4 Feb 18, 2025
fixfix #5699: add support to define a HTTP header from which the real IP of a connection should be parsed from. This can be useful for setups with a reverse proxy in front of the API server. On top of that add support for optionally configuring an allow-list of IP networks that the real source IP…
otherapi: network: improve completeness of return schema.
featureui: qemu: add hint that VMs using the VNC clipboard cannot be live migrated.
fixfix #6142: ui: datacenter options: allow custom CIDRs for migration network to cover cases where the network CIDR is not configured on any network interfaces on the node, like for example in a routed full-mesh configuration.
fixpull metric: fix node 'iowait' metric, return the percentage of time spent on waiting on IO in a certain time frame instead of returning the total amount of time that was spent waiting on IO, similar to how the push based metric servers do.
featured/control: add new pve-nvidia-vgpu-helper package as recommended dependency.
8.3.3 Jan 20, 2025
otherupdate shipped appliance info index
featureadd missing htmlEncode for some UI elements
8.3.2 Dec 16, 2024
featureapi: network: add return schema for interface listing
otherui: ceph pool: indentation clean-up
otherui: ceph: don't set default size/min-size when editing existing pool
featureui: ceph pool: add opt-in column for the configured pool application
otherui: qemu: improve error handling and rendering the QGA provided IP addresses of the guest.
otherapi: node status: complete API return schema