Proxmox VE 9.2.23 → 9.2.25
2 releases · 0 breaking changes · 0 security fixes · 0 advisories fixed
0security0breaking0deprecated1feature4fix
Breaking changes
None in the release notes.
Security changes
None in the release notes.
Every release in between
9.2.25 Oct 27, 2026
featureceph: allow the installation wizard to select any Ceph release supported by the target node, even when the node serving the web interface has a different architecture or Proxmox VE major version.
otherui: virtual machines: only offer TPM 2.0 for aarch64 guests, as TPM 1.2 is not supported by their QEMU device and firmware.
othercertificates:
otherrenew the cluster CA during the daily update before its remaining validity shortens node certificates, and log the expiry of renewed node certificates. Clients trusting the CA directly must import the renewed CA certificate before the previous one expires.
otherre-issue node certificates signed by a replaced cluster CA, so nodes that were offline during CA rotation recover on their next daily update.
othermark expired and near-expiry certificates in the web interface, with a shorter warning window for short-lived certificates to avoid warning before their normal renewal time.
fixfix #8195: ceph: lock configuration updates when creating or removing metadata servers, preventing concurrent tasks from overwriting each other's changes or leaving stale MDS sections behind.
fixfix #8184: ui: settings: allow Remote Resizing as the default noVNC scaling mode, so the guest display can follow the console window size when supported.
otherceph: order all ceph-* services, RBD mappings and CephFS mirroring after the cluster filesystem at boot, avoiding failures from reading their configuration before /etc/pve is mounted.
fixfix #8006: acme: base automatic renewal and the API renewal threshold on the certificate lifetime instead of a fixed 30 days. This avoids unnecessary daily renewals and CA rate limits for shorter-lived certificates while retaining at least three days for retries.
9.2.24 Oct 23, 2026
otherapi: node shell: harden the console against crafted parameters by only passing the known Ceph version and repository options to the command of the Ceph installation wizard, rejecting any other parameter.
fixui: consent banner: fix loading the web interface when the consent text contains a single quote, which broke the JavaScript of the page. This only affected texts set outside the web interface, for example through the API, as the web interface stores them base64-encoded.