Release Notes

v1.5.0

Released 2026-11-15

PegaProx 1.5.0 brings Corporate Redesigned, a second corporate layout each user can switch to, VM blueprints that deploy a VM's hardware and Cloud-Init settings to any Proxmox VE cluster, a QDevice for 2-node clusters that PegaProx sets up against a QNetd host once you agreed to its plan, ESXi migrations with a network per NIC, a storage per disk, a review step, a full disk check and bulk runs, an interface lock for the layout and the language, custom node hardening profiles, Russian as the tenth UI language and full-database encryption on more platforms. Rolling updates wait for proof that a node really restarted, failed Proxmox reads show as errors instead of empty lists or green tiles, and a long list of security fixes closes issues reported to us privately and found in our own reviews.

Please read the behaviour changes before updating, and take a backup first. Updating is recommended for every install: several of the security fixes concern 1.4.1 and older. The first start encrypts the database on the Debian package, on pip and deploy.sh installs on aarch64 Linux, macOS and Windows and in the arm64 Docker image, and 1.4.1 opens it afterwards only with SQLCipher installed. The steps before the update and for going back are on Upgrading to 1.5.

The in-app update and update.sh install the new requirements by themselves. Docker users get them with the new image; Debian and appliance users run apt update && apt upgrade.

✨ New

Corporate Redesigned, a second corporate layout, opt-in per user in My Profile and offered at the first login. It draws its own views over the same data, from the dashboard and the datacenter to the node pages, and a read that failed or was refused says so. Classic Corporate is deprecated and only gets fixes.
VM blueprints (#1220): a blueprint keeps cores, memory, disk size, CPU type, up to four NICs and the Cloud-Init settings (no password) for a template library image or an existing Proxmox VE template, Windows included, and deploys them to any Proxmox VE cluster, node and storage as a job with steps and a log.
QDevice for 2-node clusters: PegaProx sets up the corosync QDevice of an even-sized Proxmox VE cluster against a QNetd host: this PegaProx host, any Linux host over SSH or a Docker sidecar. Set up QDevice lists every change and starts only after you agreed to that plan; no node needs a login on the QNetd host, and pvecm qdevice remove keeps working. Administrators only.
ESXi migrations, step by step: a bridge and VLAN per NIC, a storage per disk, a review step against the target node, and a Full verification that compares every block of each copied disk before the target starts. Bulk migration moves up to 200 guests of one ESXi server in one run, one to five at a time.
Interface lock (#1189, #1167): under Settings > Server > Interface defaults an admin can pin the layout and the language for everyone.
Custom node hardening profiles: a named pick of the built-in controls with values for their parameters, scored over its own controls by the compliance dashboard.
Russian is the tenth UI language (#1235).
Database encryption on more platforms (#1226): the Debian package, pip and deploy.sh installs on aarch64 Linux, macOS and Windows and the arm64 Docker image encrypt the whole database with SQLCipher, and the VM and LXC appliance images run an encrypted database.
Rolling updates count a node as back only once it was seen down or its uptime shows it restarted, scheduled runs use the same engine as manual ones, and an evacuation that cannot prove the node empty fails.
Failed reads say so: node and storage reads answer 502 or 503 when Proxmox refuses or does not answer, and the UI shows a failed read instead of nothing, 0 percent or a green tile.
A bookmarkable SSO link (#768), EVPN prerequisite checks (#1154), Copy as text for the pending updates of a cluster (#1192), push sync jobs on the PBS Jobs tab (#801), Ceph in the cluster health score (#948) and a warning for container replicas with root-only feature flags (#457).

🔒 Security

Issues reported to us privately and found in our own reviews:

Containers created through the API need a root password or an SSH key. Containers that an earlier version created through the API without a root password, and their clones, templates and backups, should get a new root password.
Accounts confined to some guests see only the nodes their guests run on (#1218). Host, datacenter and PBS server reads are refused to them, and they see only the affinity rules of their own guests.
Portal-only accounts are held to the Client Portal by the server, and the portal shows guest, ISO and snapshot names safely.
SSO checks the ID token's signature, audience, issuer, validity window and nonce, and OIDC and Entra ID accounts stay bound to their identity provider subject.
LDAP checks the directory's certificate against a CA you can paste, and new setups start with STARTTLS.
No redirects are followed by the Proxmox VE, PBS and ESXi connections, the console logins and the websocket upgrades.
Names in API calls to Proxmox VE, PBS and ESXi are checked before anything is sent.
Stored secrets stay with the server they were typed for, also in a settings restore, and show masked in lists, logs, exports and the support bundle.
Node shell: the cluster credentials go only to PegaProx's own console server.
The notifications plugin no longer ships with a public ntfy topic.
Smaller fixes in ACME, the audit log, plugin configs and the BMC endpoints.

🐛 Fixes

Console: the upgrade to Proxmox sends one Host header, so the console no longer closes right after opening on pveproxy versions that refuse duplicate headers (#1329).
SSH: every SSH login PegaProx makes to a node on its own uses the cluster's SSH user, set in a new field of the cluster dialog (#1322), and the sensor, cluster health and NIC counter reads use the cluster's SSH key (#601).
Migrations: Remove source VM deletes the source only once the target runs; Firmware Auto gives an EFI guest its efidisk0 (#1268); IO Thread, cache mode, Discard and SSD emulation reach the migrated disks (#1270, #1246); a Live Mirror pauses the guest only until QEMU takes the pivot (#1250); VirtIO driver injection works on Ceph RBD targets (#1245).
Storage, backups and replication: storage totals count each storage once (#1159); snapshot replications every 15 or 30 minutes run that often; scheduled backups go to the storage they were given; cross-cluster migrations, Site Recovery and replication keep their temporary token until their task ends (#1349, #1350).
Server: an update rollback restores the files the updater saved, or refuses (#1340); plain HTTP on the HTTPS port gets a redirect to HTTPS again; a renewed ACME certificate is served without a restart; the HA status no longer waits for a lock it holds (#1341).
UI: a drag out of a dialog no longer closes it (#1228); a guest picked in All Guests opens in Modern (#1229); the Client Portal's Reboot button follows vm.restart (#1239).

⚡ Faster

Database commits in WAL mode no longer wait for the disk each time, while audit entries, key rotation, failover marks and HA state steps are still synced at once.
Every language but English is a file of its own, loaded when it is used, and the topology looks guest links up in linear time.

⚠️ Behaviour changes

The update dialog lists all of them, and Upgrading to 1.5 explains the ones most installations notice, with the steps for going back to 1.4.1:

Database encryption at the first start on the Debian package, on aarch64 Linux, macOS and Windows pip installs and in the arm64 Docker image. A rollback to 1.4.1 has to keep SQLCipher installed (on the Debian package, run apt-mark manual python3-sqlcipher3 libsqlcipher1 sqlcipher before the downgrade), or restore the plain copy within the hour it is kept.
Portal-only and confined accounts get 403 or a reduced answer outside what they are confined to, including the reads of a PBS server itself and the affinity rules of other guests.
Failed Proxmox reads answer 502 or 503 instead of 200 with [] or zeros, and redirects are no longer followed.
Credentials typed again when the SMTP or LDAP server, a SIEM endpoint, an SDN IPAM or DNS URL or a plugin's address moves.
Password expiry of existing local accounts counts from the update.
SSH user: nodes are reached as the cluster's SSH user, root when none is set.
OIDC accounts stay bound to their subject; after a move to another identity provider, reset each binding in User Management.
New LDAP setups start with STARTTLS and the certificate check on.
Classic Corporate is deprecated and no longer offered in the layout choice.
Plain HTTP on the HTTPS port is redirected to HTTPS.
Coming from 1.4.0 or 1.3.x: the behaviour changes of 1.4.1 and 1.4.0 apply as well. See Upgrading to 1.4.

🧭 Known issues

Snapshot-Iterative (zero downtime) ESXi migration is still experimental. Use Live Clone or Live Mirror for guests whose data matters.
Automatic failover for PegaProx itself is a beta. Try it in your setup before relying on it; manual failover stays one switch away.
arm64 hosts on the Debian repository in the README stay on plain SQLite with a warning; field encryption stays on.
Container console: on a Proxmox VE node where another listener holds port 5900, a container's noVNC console can stay black on the first try. Opening it again after a few seconds works.
QDevice: setting a cluster up again after PegaProx removed its QDevice needs Replace.
Windows guest agent: if the agent is missing after a migration, install it from the VirtIO ISO.
Tested with fakes: several fixes, among them migration fixes, the rolling update's reboot proof, the XCP-ng host proof, the Ceph gate and Start after creation, were tested with fakes, not against a real host or cluster. Try them on a non-critical guest or node first.

✅ Quality

The automated suite runs more than 19,800 tests on every change, and more than 4,700 browser tests render every layout in Chromium before a release. The update from 1.4.1 was tested on a seeded encrypted database with 3,000 guests and a week of history and on a plain one that 1.5.0 encrypted at its first start, and a downgrade to 1.4.1 with SQLCipher installed and the update again worked.

Thank you to everyone who filed, fixed, translated and sponsored along the way, and to the researchers who reported security issues to us privately. 💚

v1.4.1 🔒

PegaProx 1.4.1 is a security and fix release on top of 1.4.0. It ships a patched Brotli decoder and Pillow, makes IPv6 work across SSH, HA and PBS, keeps the history pages fast at 3,000 and 10,000 guests, and adds an OVA appliance for ESXi.

Updating is recommended for every install. The in-app update and update.sh pull the new library versions by themselves. Docker users get them with the new image; Debian and appliance users also run apt update && apt upgrade, which brings Debian's own Brotli fix (DSA-6582-1).

🔒 Security

Brotli 1.2.1 or newer is required. The decoder before it has an out-of-bounds write (CVE-2026-111497). PegaProx decodes Brotli in the replies of the systems it talks to (Proxmox VE, PBS, ESXi, the IdP, webhook targets), so a malicious or impersonated peer could reach it. The PegaProx web interface itself never decodes Brotli from a browser.
Pillow 13.0 on Python 3.11 and newer closes a heap overflow in its FlashPix decoder. Python 3.10 keeps Pillow 12.3.0, the last release built for it.
Open alerts and their mutes show a node's incidents (ZFS pools and their devices, OSDs, clock, QDevice, node tasks) only to callers with node.view, as the node pages do.
The CSRF origin check accepts a bracketed IPv6 host, and only one (#1155).

🌐 IPv6

Nodes are reached over SSH at their plain IPv6 address, and PegaProx's HA group works out node addresses, quorum and the gateway check on IPv6 (#1158).
An IPv6 PBS gets its URL brackets, also through the port 80 redirect (#1158).
The VM appliance no longer stops at the theme picker when it is opened over IPv6 (#1155).

⚡ History pages at scale

The metrics history is stored per cluster in parts. Reports, insights, right-sizing, costs, power and the node and guest charts read only what they show.
At 3,000 guests over 30 days the slowest history page went from 16 s to 1.9 s, the largest request from 2.5 GB to 86 MB of memory, and the database grows by about 7.5 MB a day instead of 98 MB. At 10,000 guests over 7 days the slowest page went from 33 s to 8.5 s.
History written by 1.4.0 and older is converted in the background after the update, newest first, with the same results to the bit.
Resolved and superseded drift events are pruned after a year.

🐛 Fixes

A live migration hands the guest's conntrack state over when both nodes support it, as Proxmox's own dialog does (#1172).
Restore tests put a container back on the storages its backup names, and a subvolume without a size limit back on its own pool (#1168).
The Hosts view of a node shows a failed read with a retry instead of an empty list (#1164).
A support bundle no longer stalls on a long token in the logs.
ESXi migrations keep the TPM state, use a guessed volume path only where the node has it, and refuse a folder copy that would leave a disk out or copy an old state of it.
A host PegaProx cannot place is not dialled at another host's address, and the agent address probe closes its socket.

🌍 Translations

The ESXi migrations and events panels in all nine languages, Polish terminology throughout, and the migration phase tooltips.

📦 Images

OVA appliance for ESXi next to the qcow2 image.
The qemu guest agent is in the VM image, so Proxmox VE shows the appliance's address once the guest agent option is on (#1180).
The Docker image is also on Docker Hub as docker.io/pegaprox/pegaprox.
Release images carry a signed build provenance; the README shows how to check it.

⚠️ Behaviour changes

History format: a downgrade to 1.4.0 or older shows only the history written after the downgrade. Nothing is deleted, and the next update reads and converts all of it again. Details: docs/history-retention.md.
Drift events: resolved and superseded ones are deleted after 365 days (PEGAPROX_DRIFT_EVENT_RETENTION_DAYS) and beyond 200,000 per cluster (PEGAPROX_DRIFT_EVENT_CAP). Open and acknowledged events and those linked to an incident or a change are always kept.
Coming from 1.3.x: the behaviour changes of 1.4.0 apply as well, first among them that 100.64.0.0/10 (CGNAT, tailnets) is refused wherever private addresses are refused. See Upgrading to 1.4.

🧭 Known issues

Snapshot-Iterative (zero downtime) ESXi migration is still experimental. Use Live Clone or Live Mirror for guests whose data matters.
Automatic failover for PegaProx itself is a beta. Try it in your setup before relying on it; manual failover stays one switch away.
Change plans are an optional record without an approval gate.

✅ Quality

The automated suite runs more than 13,900 tests on every change. The update from 1.4.0 was tested against a seeded database with 3,000 guests, also while the history was being converted, and against a copy of a real 30-day history: every history route answered byte for byte as 1.4.0 did.

Thank you to everyone who filed, fixed, translated and sponsored along the way. 💚

Thanks in particular to @mdobprv-lab, @omrzk, @hvisage, @nvaert1986, @m4nifest0-tech, @bgatestmg and @gyptazy, who filed, fixed or translated the issues in this release.

v1.4.0

PegaProx 1.4.0 is about knowing before you act: a migration preflight with one verdict per guest, a what-if simulator for failures and maintenance, restore tests that really restore, a timeline of every cluster, node and guest with a signed evidence bundle, and a hash-chained audit log. Next to that come an All Guests table across all clusters, a search language, automatic failover for PegaProx's own HA group as a beta, and two security passes, one of them a whitebox penetration test.

Please read the behaviour changes before updating. There are thirty-three, several refuse something that worked before, and the update dialog lists them as well. The full list with explanations is on the docs: Upgrading to 1.4. The most likely to bite: 100.64.0.0/10 (CGNAT, Tailscale and other tailnets) is now refused wherever private addresses are refused, including the OIDC sign-in unless "Internal IdP / Private Network" is on. See Outbound Requests and Private Addresses.

🧭 Know before you act

Migration preflight for bulk and cross-cluster migration: a verdict per guest (ready, warning, blocked) with the reasons, ordered steps, what an abort would leave behind, a dry run and a Check step in the migrate dialogs. A block can be overridden with a confirmation that is audited.
What-if simulator per cluster: node loss, maintenance placement, N+1/N+2 headroom, storage, bridge, VLAN, VNet and PBS failures, each statement marked as known, calculated or assumed. A risk view weighs critical guests, tenants and proven restores, ranks single failures, and gives one verdict; the maintenance dialog runs it before a node goes down.
Restore tests that run: on a weekly schedule PegaProx restores real backups into isolated test copies (new MACs, links down or on a test bridge), checks the guest agent, ports and commands, measures the RTO, and reports per guest, cluster and tenant. Real restores need a confirmation, with a size cap and a free space check.
Recovery assurance: coverage of critical guests, a gap list, manual confirmations and a signed evidence export that can be verified later.
Timeline per cluster, node and guest: audit, alerts, migrations, drift, tasks, backups, node states, Site Recovery, rolling updates and syslog errors in one view, with "shortly before" marked as correlation, not cause. The window can be exported as a signed evidence bundle.
Audit log hash-chained and checkpointed, verified by the compliance check, which now scores only the controls it could check and says why the others were not.

✨ New

All Guests: one paged, filterable table of every guest across all clusters, with column picker, guest agent and disk I/O columns and the actions each guest allows.
Search language: AND, OR, NOT, groups and quotes, with name:, id: (ranges), type:, cluster: and pool: next to tag:, node:, ip:, status:, mac: and notes:. Queries that found something before still find the same.
Automatic failover for PegaProx's own HA group (#625), as a beta: a majority lease with Make leader, Force leader and a witness. Every group still starts in manual mode.
Tenant quotas apply on every way a guest can land on a cluster: clone, restore, template deploy, cross-hypervisor, ESXi and cross-cluster landings, replicas, resizes, new disks and snapshot rollbacks.
Power & Carbon per host (#965): idle and full-load watts per host, costed per host and interval, with the power no guest explains shown as unallocated. Power, costs and right-sizing are worked out in the background and say how old they are.
File level restore from PBS backups into running guests (#1139).
Site Recovery fails over and back single guests, and a cancel stops a run before its next guest.
Rolling updates survive a restart or HA switchover, pause for quorum (QDevice votes included) and can be continued or cancelled.
Backups: a run history per backup job, and a restore of several guests at once from the datastore browser.
Balancer: every move is recorded with its reason and kept across restarts; the cooldown between two moves of one guest is set per cluster.
The all-clusters overview shows the pending updates of every node and PBS server and a Ceph panel per Ceph cluster.
Transfer network per cluster for cross-cluster migration, replication, Site Recovery and the balancer.
Change plans with four-eyes approval, linked into config drift. An optional record: a plan runs and blocks nothing.
Config drift reads firewall rules, HA rules, backup jobs and access, with optional policy checks.
New event alerts for Ceph OSD latency, the RPO of PegaProx's own replications, node clock drift, guest restart loops and old restore tests; more Prometheus series and two Grafana dashboards.
QDevice state in the tree, details and alerts (#1137); a least-privilege role recipe for Proxmox VE; node root passwords of their own per node (#1136); an OIDC username claim for AD FS (#1149).
PBS: every sync, verify, prune and GC job per datastore with its schedule, its last run and the next one (#804); GC state from the server.
Charts show gaps instead of a measured zero, take a time range by dragging, and read from PegaProx's own 5-minute history.
The SMTP settings can verify the relay's certificate.

🔒 Security

Two passes: a review of everything since 1.3.0, and a whitebox penetration test by CodeAnt AI, who also give PegaProx their code review tool. Thank you.

Task log, status and cancel requests for Proxmox VE and PBS check the task id before the call, and the API sessions refuse paths with dot segments. This flaw is also in 1.3.0 and older; updating is strongly recommended. Advisory: GHSA-c25f-58q4-978j.
Template deploys check every redirect of the image URL; the outbound guard treats 100.64.0.0/10 as private again; ESXi servers get the address check PBS has.
Users confined to pools or single guests no longer read a node's system journal or Ceph log, the Ceph mirroring, cluster-wide guest counts in the reports, node incidents, snapshot policies that match none of their guests, or other guests' scheduled tasks.
A tenant's user admin reads only their own tenant's permissions; IP lockouts are cleared by a global admin only.
SSH does not trust a host key on first use when it cannot be recorded, and writes known_hosts atomically.
Restores over a guest that is gone keep to the tenant's VMID range; a manual restore test places its copy only where the caller may.
The node shell takes the node address from the server only; the global search no longer shows the notes, IPs or MACs of a deleted guest on a new guest with its VMID; recovery evidence verifies only as written.
Smaller: HA quorum values, power rates, the alert pattern guard, the WebSocket subscription, in-app update paths, TLS key writes, change plan approvers, OIDC fallback accounts and mail addresses in the support bundle.

⚠️ Behaviour changes

Thirty-three; the update dialog lists them and Upgrading to 1.4 explains each. The ones most installations notice:

100.64.0.0/10 is refused where private addresses are refused: OIDC sign-in (unless "Internal IdP / Private Network" is on), ACME (unless the private CA switch is on), alert and Site Recovery webhooks, SIEM, ntfy and Apprise, push subscriptions and downloads from a URL into a storage.
SMTP: fresh installs verify the relay certificate; existing ones keep sending without the check until it is turned on.
Power & Carbon figures drop after the update (the old formula counted idle power several times); reports before and after are not comparable.
The weekly restore test really restores now, after a confirmation.
A 401 or 403 from Proxmox VE, PBS, ESXi or the HA plugin reaches the browser as 502 UPSTREAM_AUTH and no longer signs the user out; API clients that matched on the upstream status check the code.
Tenant quotas can refuse clones, restores, resizes and landings that went through before.
Rolling updates do not start beside another run and pause as "interrupted" after a restart.

🐛 Fixes

Syslog timestamps carry their UTC offset (#1131); PBS dialogs stack above the corporate table headers (#1150); the task bar arrow points the right way (#1125).
The node shell opens on the clicked node and works behind a reverse proxy (#1143); an ESXi server that refuses its credentials no longer signs the user out (#1142).
The Debian package, the Docker image and the scripts ship and keep the bundled plugins and their settings (#1134); accounts made by OIDC with a fallback name can be managed (#1141).
ACME trusts the system CA store for a custom CA (#314) and names a certificate without CN by its first host.
Container restore from vzdump, the live backup pane, cloud backup failure counts, scheduled tasks that stepped over a minute, scheduled rolling updates in a late pass, drift repeats and baseline notes, XCP-ng rolling updates, PBS GC figures and partial job lists.
At 10k guests the what-if ranking, the preflight, long searches, chart ranges and the power, cost and right-sizing reports no longer hold up the server.

🧭 Known issues

Snapshot-Iterative (zero downtime) ESXi migration is still experimental. Use Live Clone or Live Mirror for guests whose data matters.
Automatic failover for PegaProx itself is a beta. Try it in your setup before relying on it; manual failover stays one switch away.
Change plans are an optional record without an approval gate: nothing runs and nothing is blocked by a plan.
The QDevice view sees the QNetd host only through the nodes; pending security update counts exist for XCP-ng only.

✅ Quality

The automated suite runs more than 13,400 tests on every change. The release was checked live on a lab instance with Proxmox VE clusters, an XCP-ng pool and an ESXi host connected, at a simulated scale of 200 nodes and 10,000 guests for the heavy paths, and an update from 1.3.0 was tested against a copy of a 1.3.0 database.

Thank you to everyone who filed, fixed, translated and sponsored along the way. 💚

Thanks in particular to @brngates98, @Clankcoll, @CKeckNorthIO, @SystemFuchs, @MartinMDS, @lordkill61, @omrzk, @si458 and @gyptazy, who filed or fixed the issues in this release.

v1.3.0 🪽

PegaProx 1.3.0 makes PegaProx itself highly available: up to four instances form a group with one leader and warm standbys. Next to that come automated Proxmox VE installations, bulk actions on guests, a set of new alert sources, a second security pass after 1.2.0 and a fix for a silent data loss in the ESXi live clone migration.

Please read the behaviour changes before updating. There are thirty-eight, several take something away from a setup that works today, and the update dialog lists them as well. The full list with explanations is on the docs: Upgrading to 1.3.

PegaProx High Availability (#625)

A second PegaProx can run as a warm standby of the first. It is paired once with a one-time code, pulls the shared configuration every 30 seconds, shows the clusters live and read only, and is promoted to leader by an admin when the leader is gone. The old leader steps aside as soon as it sees it was replaced, also when it comes back later.
A group holds up to four instances: one leader that runs all automation and holds the configuration, up to two members the leader makes active to serve users (consoles, shells and SPICE open there, every change goes to the leader), and standbys that wait to take over.
A standby hands a signed-in user's changes to the leader, which checks the account against its own users and names the standby in the audit log (on by default, switchable per instance).
Members talk over calls signed with Ed25519 that are useless anywhere else or later. A removed member is refused everywhere and goes passive. A sync never silently wipes what a member holds: whatever it would replace is kept as an encrypted copy an admin can download or dismiss.
Schedules run in the group's time zone. LDAP and OIDC sign-ins on a standby go by the synced account and write nothing there.
Everything lives in a new High Availability tab in the settings, with a banner for every user on a standby, in all three layouts and all nine languages. Failover is manual and confirmed; the groundwork for automatic failover is included but not enabled.
Docs: PegaProx High Availability

Node recovery

PegaProx's own node recovery moves a guest only when every volume it starts with is on shared storage, and reads a dead node's guest configs from the cluster file system on other nodes instead of guessing.
A node that returns during its recovery keeps what is left and no guest runs twice. A recovery that could not finish is listed in the cluster's HA settings.
A new self-fence agent (its own unit, pegaprox-fence-agent) decides by quorum first and asks PegaProx only where quorum cannot decide.
Two-node and forced-quorum clusters set up from now on are recovered only after a fence per node that was read back; existing setups keep their behaviour behind an explicit "unsafe two-node recovery" switch.

New

Automated Proxmox VE installations: PegaProx serves the answer file to the Proxmox installer, each profile with its own fetch token and every run tracked from the first fetch to the installer's post-installation webhook. A six-step guided setup hashes the root password on the server, the answer file editor refuses what the installer would refuse, and it has a page of its own in all three layouts. Docs
Bulk actions on selected guests (start, shut down, stop, reboot, snapshot, tags) in every layout, each guest checked on its own and the result shown per guest. A node can start, stop or migrate all its guests at once.
Bulk migration runs on the server, one guest at a time, a few at once or all at once, follows each guest and can be cancelled, also across page reloads (#952).
New alert sources: failed Proxmox tasks such as a failed vzdump, Ceph health, failing or lagging replication, a ZFS pool that is not ONLINE or shows errors, snapshots older than a set age, guests that no backup job covers, and rolling update start, finish and reboot hand-over (#716). Each is raised once, with a resolved notice, and can be muted per rule or per object.
Rolling updates can move a node's templates with its guests (#763) and let negative affinity rules give way for the run, switched back on afterwards (#954), in scheduled runs and in a node's maintenance as well. ProxLB pin tags rank a drain's targets instead of blocking it, with switches for strict pins and an automatic move back (#811).
Containers from OCI images on PVE 9.1 and newer, from a small catalog or any image reference (a technology preview, as in Proxmox).
Check connection runs read-only probes against a cluster (API and fallback hosts, TLS fingerprint, the token's privileges, versions, clock, quorum, SSH) and names a fix for each failed item.
Directory mappings and virtiofs shares, container features after creation, PCI and USB passthrough through resource mappings (also on API-token clusters) and a VirtIO RNG, each checked before it reaches PVE.
The All Clusters overview lists the storage of every cluster, guests without backup, and exports the guest inventory. Node temperatures work without lm-sensors, ZFS pools show their device tree with error counts and the last scrub.
A metrics.view permission lets a Prometheus scrape run without an admin token (#818); the exporter also reports storage, replication state, backup age per guest and guest disk I/O.
The HTTP API is described in OpenAPI, generated from the routes and naming the permission each one demands, and can be browsed inside PegaProx from the user menu (#104, #693).
Also: favorites as a group at the top of the sidebar, search by MAC address, IP and notes, a broadcast banner for everyone or chosen tenants and roles, Cloud as a layout choice at first login, a System theme (#743), plugins limited to chosen clusters (#642), PEGAPROX_CONFIG_DIR and PEGAPROX_LOG_DIR (#826), a per-cluster switch that turns SSH off entirely (#941), PBS servers with an API token (#805), Site Recovery boot screenshots as test evidence, a refreshed cloud image catalog, a release Docker image for 32-bit ARM and snapshot .deb builds of the Testing branch (#973).

Security

A second and a third pass after 1.2.0, over the remaining findings of the penetration test and the daily code scans, including defects in 1.2.0's own fixes. Among them:

The PVE console ticket goes only to PegaProx's own console server, and an API token secret is never offered as an SSH password.
A cluster edit can no longer send its stored credential to a new address or inject an SSH option.
A delegate with admin.users could demote an administrator and replace their password in one request.
Read routes next to gated write routes handed out every tenant's custom roles, pool permissions, VM ACLs and the cluster security audit.
An API token with a lower role than its account got its privileges back through VM ACLs, list routes and the cluster gate.
A deleted VM's ACL went to the next guest on that VMID.
Accounts limited to pools or guests could change root@pam, write shared storage content and place guests.
Migration paths passed credentials where others could read them, left node files readable and could destroy more than they copied.
storage.create was never enforced, replacing a second factor needed no password, and host key pins could be lost under concurrent writes.
CI actions and images are pinned, static downloads are verified, and the release images verify the packages they install.

Every fix ships with a regression test and a counter-proof against the unpatched code.

Behaviour changes

Thirty-eight, listed in the update dialog and explained on Upgrading to 1.3. The ones most likely to be noticed:

Adding storage needs storage.create; a deleted or unreadable custom role grants nothing instead of the viewer set.
Pool grants on directory groups take effect: a user whose LDAP or OIDC group holds a pool grant is now confined to that pool.
API tokens stay at their own role everywhere, and can no longer create tokens or manage 2FA.
Accounts limited to pools or VM ACLs no longer get whole-cluster data, no longer upload ISOs or create guests, and clone only onto nodes of their own guests.
Changing a cluster's host, port, fallback hosts or TLS verification needs the password or token secret again.
Node recovery leaves a guest with a local volume where it is (a local ISO included), and new two-node clusters need a read-back fence.
The ESXi live clone switchover now takes longer: it stops the source, carries over every block changed since the snapshot and only then starts the target, so the downtime grows with disk size (see Fixes, #1124).
The cloud image ids fedora-40, debian-11 and alpine-319 are gone.

Fixes

ESXi live clone migration lost every write made after its snapshot (#1124). In "Live Clone" and "Auto" mode the copy came from a snapshot, and nothing written on the source during the copy or the confirmation hold reached the target. The switchover now stops the source, folds the snapshot back, compares every block and copies what changed, and only then runs the post-copy steps and starts the target. If anything fails before the target runs, the source is powered back on.
The block delta of the pre-sync migration copied only the head of each changed block and still reported success. Changed blocks now arrive whole and are read back before the run continues.
VirtIO SCSI guests failed with INACCESSIBLE_BOOT_DEVICE after driver injection (#823): vioscsi gets its own bus type and the device ids it really has, and the drivers go into the control set Windows boots from.
An Entra sign-in failed with HTTP 500 when a group had no display name (#962).
Console behind a reverse proxy fixed end to end (#945, #955, #956); token-only clusters open consoles (#955); a TLS error from another connection no longer ends a healthy console (#713); paste types the right characters on non-US keymaps (#959); the terminal follows the bind address (#957) and no longer writes its script to /tmp (#958); the node shell no longer pans the page sideways (#727).
Updates: Check for updates refreshes apt first; rolling updates reboot once (#953), evacuate only to nodes allowed by HA affinity and storage (#647) and read the debsecan urgency correctly (#827).
Config drift no longer reports an offline node's objects as removed (#968), and a failed read is not a removal. Reports load a whole week for Last Week and show times in browser time (#963, #939).
Container migration with a target storage (#808); V2P disks on block storage as raw on Proxmox 9 (#816); the SMBIOS auto-configurator no longer rewrites running VMs (#943, #969); pool grants on LDAP and OIDC groups reach the user (#940); a slow answer no longer overwrites the next detail view (#828); several dialog and login buttons work again (#810); rolling updates on XCP-ng no longer stop at the first node; the container dialog lists templates again; answers on kept-alive connections no longer wait for a delayed ACK; the cluster health check reads all storage in one call (#946).

Known issues

Snapshot-Iterative (zero downtime) ESXi migration is experimental and can report success with missing or wrong data on the target. Do not use it for guests whose data matters; use Live Clone or Live Mirror instead. A fix is planned.

Quality

The automated suite runs more than 9,800 tests on every change (authorization, integration, SSRF, crypto rotation, i18n, frontend invariants). The release was verified against live PVE 9.2 and PVE 9.1 clusters and an ESXi 8.0.3 host.

v1.2.0 🔒

A security release built on a full AI-assisted penetration test of the whole codebase (558 findings triaged, every critical and high one verified against the code by hand), plus the tenant work that was queued behind it. It is a minor release rather than a patch because of the sixteen behaviour changes below. If you run a multi-tenant installation, read them before updating.

Security

Empty is no longer read as permissive. Most findings came from one class: a store that failed to load answered with an empty result, and empty was treated as the allowing answer. An unreadable tenant table, ACL store, schedule table or settings read now refuses instead of guessing.
Log injection is neutralised at the sink, and URLs written into logs have their credentials stripped (for a webhook the URL is the credential).
SDN object ids are validated before they are used as a path segment.
The OIDC discovery address is pinned to the address it resolved to, and a group mapping that matches only on a display name says so in the log.
LDAP warns when neither TLS nor STARTTLS is configured.
Request lists are bounded, rate limiters can no longer grow without bound, and a managed node can no longer send output until memory runs out.
The second-factor probe fails closed on login and on re-authentication.

Behaviour changes

OIDC group revocation takes effect at the next login: permissions no longer covered by an IdP group are dropped.
Alert channels need admin.settings to change. Reading the masked list stays on alert.manage.
PBS resource-wide actions (garbage collection, prune, verify, datastore create and delete, job management, host upgrade) need every cluster linked to that PBS.
PBS keeps linked_clusters when an update omits the field. Send an explicit empty list to clear it.
PBS certificate pinning is enforced when a fingerprint is configured. Without a fingerprint nothing changes.
API tokens with their own role are capped at their owner. A token whose owner lost a permission loses it too.
inherit_role on a VM ACL is checked against the permissions the delegate actually holds.
Drift events and SDN changes are cluster-wide operations. The drift status tile (counts only) stays visible to everyone.
Restoring into a new VMID respects the tenant's VMID range, when one is configured.
ESXi delete and rename need vmware.vm.manage instead of vmware.vm.power.
ESXi servers keep linked_clusters when an update omits the field.
A resource-pool grant no longer opens an ESXi server; the cluster's tenant assignment is required.
A node reboot needs node.reboot, also inside manual and scheduled rolling updates.
A node name carried by two clusters no longer filters in syslog, so one tenant's node name cannot match another tenant's host.
ESXi transfers follow the strict host-key setting. With strict mode on, the PVE node needs the ESXi host in its known_hosts.
Smaller tightenings: an unreadable tenant table yields no clusters; admin.api stays inside its own tenant; cluster groups check the token rather than its owner; node shell credentials only for cluster-wide holders; template deployment respects the tenant's VMID range; ESXi ACL rows stay inside their tenant; push subscriptions are interactive only; custom StarWind repository URLs are global-admin only; PEGAPROX_VERSION pins the Docker image.

Deliberately unchanged: console access for viewers, the drift status tile, and the TLS defaults for PVE, XCP-ng, LDAP and ESXi (PBS has certificate pinning instead).

Tenants

A per-tenant disk ceiling and a per-tenant VMID slice that restore and template deployment both respect.
Self-service container creation is serialised per tenant, so two requests cannot clear the same quota check.

Fixes

ESXi to Proxmox migration gets past VMID allocation again (broken since 0.9.2).
Drift events reach the configured webhook channels (#815).
Client-portal container quota and failed creations, schedule table rewrites on a failed read, and the compliance report's tool name.
SSH credential handling, node hardening checks, CVE scan messages (#825, #827) and V2P injection messages (#824).
Rolling updates wait for an HA migration to finish before judging it (#647); node maintenance survives a restart when PVE HA accepted it (#720).
VNC reconnect rides out longer interruptions; snapshot API errors show in toasts (#812); PBS and syslog panels report refusals instead of empty results (#802, #803).
Cross-cluster replication confirms the replica tag (#799); Corporate mass actions work (#798, #795); OIDC and Entra logins record last_login (#794); clusters are labelled by display name (#787); the Add Cluster dialog resets and offers qcow2 on LVM (#788, #785).
The full Proxmox boot-order format is parsed (#755); a failed test failover leaves the clone stopped.

CI

The APT repository workflow can no longer be dispatched from an arbitrary branch, the release version is validated before it reaches a shell, and build jobs carry no token that can write to the repository.

Quality

2040 automated tests run on every PR. Every security fix ships with a regression test and a counter-proof. The release was verified end to end against a live PVE 9.2.10 cluster.

v1.1.1 🔒

A security + reliability release on top of 1.1.0. Every 1.1.0 install should update.

Security

Cluster root ticket exposed to any authenticated user (GHSA-pwhc-r276-gp73, critical) - the WebSocket token-validation endpoint returned the managed cluster's stored root@pam ticket to any signed-in account, bypassing every PegaProx permission below it. It now answers only our own console subprocess, authenticated with a per-run secret. Clusters configured with an API token were not affected.
Snapshot name path traversal (GHSA-w8c9-r5cx-7rfh, critical) - snapshot names were interpolated into the Proxmox API path while the gate above them checked only the VM id, so dot-segments in a name could reach a different endpoint entirely. Names are now validated centrally before any path is built.
SSRF guard bypass via IPv6 transition addresses (GHSA-ffhp-cpm8-4mpv, high) - 6to4, NAT64, Teredo and v4-mapped addresses embed an IPv4 address the outbound-URL guard never decoded. It is decoded and classified now. Thanks @tonghuaroot.
Object-level authorization sweep - the recurring class where reaching a cluster was treated as reaching everything on it is closed across the console, LXC terminal, PBS, node task logs, global search, tags, reports and the per-VM read endpoints. Pool- and ACL-scoped accounts stay inside their scope on all of them, and a tenant-scoped custom role resolves against its own tenant instead of falling back to the viewer defaults.
Live streams re-check the account behind them on their own clock, so a disabled or demoted account loses an open stream instead of keeping it until it disconnects.
Encryption-key rotation was rebuilt - it committed re-encrypted rows before the new key reached disk, missed the PBS / ESXi / VAPID secrets and clusters.ha_settings, and left the audit trail reading as tampered. It is one transaction now, and a damaged key file refuses startup instead of being regenerated over.

New

External window VM console (#767) - a console can be opened in its own browser window, so several guests can be watched side by side. See VM Management.
The interface carries its copyright, license and source references on every screen, with the full notice under Settings → About.

Console

Pointer latency cut by roughly an order of magnitude at a realistic event rate, and the connection-pool churn behind the intermittent disconnects removed (#713). The estate-wide IP sweep no longer competes with opening a console on large environments.

Fixes

Clean systemd stop that also takes the console subprocess with it (#780, #784). PR by @si458.
Request-pool slots are reclaimed from idle keep-alive connections instead of starving the server (#777); an idle tab dropped from about four REST calls a second to well under one (#782).
Node shell over IPv6 (#778); deleting a cluster purges every table keyed by it (#779); pool assignment is gated on pool.assign rather than admin.users (#766).
Three XCP-ng and ESXi endpoints that raised instead of answering (#781); container create and destroy in the client portal (#765); cluster settings surviving a reconfigure (#762).
The compliance dashboard now says why a node check could not run - no SSH credentials, node in backoff, or a failed connection - instead of showing an error code next to every node (#717).

Quality

1270 automated tests run on every PR. The console work was verified against a live PVE 9.2.10 cluster, including a 22-minute session soak with zero drops.

v1.1.0

A security-hardening + reliability release.

Security

Closed 15 BOLA / IDOR / token-scope findings from a full penetration-test re-triage, plus a follow-up hardening batch. An API token's effective_role propagates into cluster / search / ESXi access (#491), and a token's custom-role name is preserved so its tenant scope resolves correctly.
The auto-balance worker, cluster VM inventory and PBS auto-attach can no longer be reached through a pool / ACL fallback on a cluster the tenant does not own.
The live resources SSE stream is scoped to each client's per-VM ACLs (#736).

New

Usable phone layout - off-canvas sidebar drawer and a responsive shell (#189).
WebAuthn / passkey login (#746).
Re-pin SSH host keys after a node's key changes, e.g. post-CIS-hardening (#717).
Optional node FQDN suffix for "Open in Proxmox" links (#689), and reversible umask-027 plus lockout warnings on the sshd-hardening controls.

Fixes

Rolling updates: evacuation no longer false-fails on VM is locked (migrate) when a guest is already migrating (#647); a benign Ceph HEALTH_WARN no longer burns the full 120 s wait (#747); a node that needs no reboot is not announced as rebooting, and soft maintenance survives a restart (#715, #720).
Migration: ESXi→Proxmox with non-krbd Ceph RBD targets maps librbd URIs to a block device and routes the EFI fallback through them (#722).
Console: the PVE VNC leg serialises SSL access to stop intermittent disconnects (#713), and the noVNC proxy works under gevent on Python ≥ 3.13 (#740).
PBS "passed" disks no longer show red, and the overview stopped-VM count uses the explicit stopped status (#751, #749). Corporate light / dark theme handling (#742). iLO 4 stale SEL assertions no longer latch a node Critical (#714).

Languages

A new Polish translation (#737) and a backfill of every language to full English parity.

Quality

662 automated tests run on every PR, and contributions carry a PR template plus an AI-review bar.

v1.0.2 🔒

A security + maintenance release on top of 1.0.1.

Security

Console / per-VM access control (GHSA-pfjc-gjmc-89c9) - a Client-Portal user scoped to specific VMs via a VM-ACL could reach any VM on a cluster their tenant owned. The per-VM check now enforces the ACL / pool scope even on tenant-owned clusters. Reported by Jörg Morasch (SYMPLASSON Informationstechnik GmbH).
Broad authorization audit - the same object-level gap is closed across bulk and cross-cluster migrate, PBS restore / protect / notes / prune, migration history and the HA plugin. Tenant-delegate privilege-escalation paths are closed: a delegate can no longer grant permissions it does not hold, reset a higher-privileged peer's password or 2FA, or keep console access after being disabled.
SSRF DNS-rebinding (GHSA-hmcf-9q7f-vx35) - the outbound-URL guard validated the host but did not pin it, so a low-TTL rebinding domain could pass the check and connect to an internal address. The validated IP is pinned now. Reported by @senti-man.

New

Rolling updates reboot a node only when needrestart -p reports a required restart (#694). PR by @gyptazy.
Internal / private ACME CA support, opt-in (#685), and Cloudflare DNS-01 as a first-class Let's Encrypt provider (#687).
Hardware-health rollups are based on live sensor / SEL state and name the contributor (#686).
Self-update is install-method aware (apt / docker / source).

Fixes

Adding a cluster whose Proxmox account has two-factor auth now shows a clear, localized message instead of a silent "connected then offline" (#683).
SMART health shows for HDDs without a wearout value (#690); snapshot overview gained multi-select and bulk delete (#696); EFI / TPM disks accept a raw / qcow2 format (#678).
OIDC no longer races itself to a logout mid-callback in Firefox (#681), and group → role mappings apply custom roles (#682).

Quality

555 automated tests run on every PR.

v1.0.1

A maintenance + feature release on top of 1.0.

Languages

Simplified Chinese (简体中文) - the web UI is available in Simplified Chinese. Thanks @ranydb.

New

SPICE is offered in every VM console entry point - a downloadable virt-viewer .vv for audio / USB / multi-monitor sessions, alongside the built-in noVNC.
ARM64 / aarch64 build artifacts are published (#674). Thanks @gyptazy.

Security

Another penetration-test pass closed a set of authorization / IDOR gaps: power- and cost-rate reads are scoped to the caller's clusters, and the client portal's reboot action is gated on vm.restart instead of vm.start.
The CIS SSH-hardening control no longer disables TCP forwarding - the built-in VNC console tunnels through it - and applied hardening controls are selectable for rollback.

Fixes

Adding a disk to a container targets a container mountpoint (mpN) instead of a QEMU disk key, and never overwrites an occupied slot.
A locked VM/CT can be unlocked even on token-authenticated clusters, falling back to qm / pct unlock over SSH.
OIDC keeps the full preferred_username instead of truncating at @ (#486). The storage / snapshot / backup / update action bars follow their backend permissions (#644).
Scheduled rolling and maintenance updates evacuate local disks by default (#630, #629); node temperature parsing falls back to plain sensors text (#601); in-band BMC reads fall back key → agent → password (#609).

Quality

438 automated tests run on every PR.

v1.0 🎉

PegaProx is out of Beta. The full 0.9.x line, hardened and rounded out into the first stable release.

Security

A post-release penetration test closed a BMC-credential exfiltration on the test-BMC endpoint, an ESXi/XCP password ever appearing on a process argv (now passed over stdin / SSHPASS), a BMC/Redfish SSRF oracle, and an SSH-amplification path in the Ceph mirror views.
The TLS bootstrap now fails closed (#633) - if TLS is the intended posture and a usable certificate cannot be loaded or generated, PegaProx refuses to start with an actionable error instead of silently serving plaintext on the port meant for TLS. Escape hatches remain for reverse-proxy termination and an explicit PEGAPROX_ALLOW_PLAINTEXT=1. Thanks @SpyrosPsarras. See SSL/TLS.

New

Cross-cluster EVPN vNets (#612) - define a vNet that spans several clusters in the same AS: create / edit / membership / drift-detection, with optional reconcile and drift → alert fan-out. Thanks @cybrwerk. See Multi-Cluster Management.
V2P / ESXi cutover confirmation (#562) - migrations gain an opt-in "wait for confirmation before cutover" gate, so you control the exact switchover moment. Thanks @ajoergensen. See ESXi to Proxmox.
Sortable Top Resources (#621) - the Top Resources overview sorts by any column. Thanks @ccesario.
Per-schedule reboot timeout (#630) - scheduled rolling updates carry their own reboot/online timeout instead of a fixed 10 minutes.

Fixes

Nested / hierarchical resource pools now show their members and VM counts (#634, thanks @prasannak81).
ESXi→PVE migrations of multi-disk VMs to classic LVM no longer abort when a target volume already exists (#636, thanks @shepart).
XCP-ng→PVE transfers resume by HTTP range instead of failing on a broken pipe (#546).

Quality

The SSL-bootstrap, authorization and full-stack integration test suites run on every PR.

v0.9.15

Security - a large hardening pass

Per-VM ACL enforcement and tenant-isolation IDOR/BOLA gates across the API, SSRF guards on outbound fetches, RCE-hardening of the ISO/template and ESXi-VMDK paths, CSRF/CSP tightening, and dependency CVE bumps (Flask 3.1.3, PyJWT 2.13, and more).
Adds an AGPL §7(b) attribution term (NOTICE + client-portal footer).

Cloud (Preview) layout - full parity with Corporate

The Cloud layout now mirrors Corporate end to end: complete SDN CRUD, Plugins / Scripts / Schedules, Config Drift / SIEM / Alert Channels / Update Manager, HA / Networks / Storage / Site-Recovery, a Reports group, Automation (Snapshot Policies, Templates), and Topology + Compliance.

New

Temperature monitoring - history + alerting (#601) - the per-node lm-sensors panel stores the hottest temperature over time (sparkline + min/max/avg), plus a new temperature alert metric in °C wired into the existing alert/webhook pipeline. Thanks @jostrasser.
Optional VM IDs in the sidebar (opt-in per profile, translated in all 7 languages).

Performance & scale

Sidebar filter debounce + native windowing so 1000+-VM trees stay smooth; TTL-cached VM-ACL and cluster-topology lookups; capped concurrent syslog TCP handlers.

Quality

A full-stack integration-test harness (real app + faked managers) plus blueprint and route-authz contract tests, now run on every PR.

Community

PR #617 - snapshot-name validation against PVE's rules (thanks @MatrixNeoKozak). Welcome TechniData AG Limited (Silver)! 🎉

v0.9.14.1

New

Per-disk aio mode in the migration wizard (#598) - the ESXi→PVE wizard lets you pick the QEMU async-IO backend (threads / native / io_uring) for the migrated target disk. The default is unchanged (PVE's io_uring). See ESXi to Proxmox.
Maintenance-Mode RAM pre-check (#611) - before evacuating a node, PegaProx simulates the migration and warns you (non-blocking) if it would push a remaining node past ~90 % memory, or if the cluster lacks the headroom. You can always proceed - it's a heads-up, not a hard block.
Client Portal self-service teardown (#556) - quota-bound portal users can now destroy their own CTs/VMs, not just create them. Opt-in per hoster (allow_destroy), gated strictly to the caller's own guests, with a type-the-name confirm and full audit trail. See Client Portal.

Fixes

The VM-creation wizard's OVMF quick-templates no longer fail with efidisk0: unable to parse volume ID ':1' when the EFI-storage field is left blank; they now fall back to the VM's main storage (#607).
Behind a reverse proxy the container no longer spams TLS-handshake noise into the logs, and PEGAPROX_BEHIND_PROXY=true now also routes the console (VNC/SSH) WebSockets through the proxy - no separate Settings toggle needed (#614). See Reverse Proxy.

Security

Dependency floors raised to clear Aikido findings - cryptography 49 + fido2 2.2.1, pillow 12.3, setuptools 83, requests 2.34 (all as >= floors so future patch bumps roll in cleanly). The remaining request-controlled Site-Recovery log lines are sanitised (CWE-117).

v0.9.14

New

StarWind VSAN LVM (starlvm) storage - PegaProx now recognises, creates, edits and rescans StarWind's starlvm type as first-class shared block storage, with thin-provisioned snapshots on a shared LUN. A one-click installer deploys the StarWind SAN plugin across your cluster nodes over SSH (signed apt source, admin-gated). See StarWind VSAN LVM.
ProxLB VM tags drive placement (#426) - an opt-in per-cluster option to derive affinity / anti-affinity / ignore / pin rules from ProxLB-style VM tags (plb_affinity_*, plb_anti_affinity_*, plb_ignore, plb_pin_<node>). See Predictive Load Balancing.
Extra CPU Flags editor (#410) - a tri-state (+enabled / −disabled / default) toggle panel in the VM Hardware tab for the standard Proxmox CPU flag set. See VM & Container Management.
Site Recovery - NIC isolation on Test Failover (#413): test-failover clones can be brought up with every NIC disconnected so a DR test can't collide with production IPs; and planned/failback now fails fast with clear guidance when the target VMID is already replication-seeded. See Site Recovery & DR.
Self-service container creation in the Client Portal (#556) - portal users can create LXC containers within their tenant quota, from an admin-curated template/target set. See Client Portal.
Ceph metrics in the Prometheus exporter (#540) - pegaprox_ceph_health_status, pegaprox_ceph_osd_up, pegaprox_ceph_osd_in. See Prometheus Exporter.
French compliance frameworks - Diffusion Restreinte (II 901) and RGS, both mapped to the ANSSI-BP-028 control set. See Compliance & Hardening.
ESXi migration wizard: expose the ESXi SSH user (non-root, #602) and set a VLAN tag on the target NIC (#598). See ESXi to Proxmox.
LXC containers now show their OS type and IP address in the VM detail views (#560).

Fixes

Single-node maintenance mode no longer hangs ~5 minutes when there is no other node to evacuate to.
The datastore browser no longer shows 0 bytes for a disk whose owning VM lives on another node (shared/SAN storage).
The task bar now attributes a VNC console session to the PegaProx user who opened it.
The console screenshot tile falls back to an RFB frame grab, fixing blank Windows-VM previews.
Site Recovery cross-cluster failover now maps source→target storage correctly (it previously fell back to the default target storage on every run).
Offline / air-gapped browsers: the UI auto-detects the air-gap and no longer routes cluster API calls through an ambient proxy, and the update check no longer spins.

Security

The VMs-backup-status endpoint is now scoped to the caller (cluster access + per-VM ACL) - closes a read BOLA.

Performance

Real-time SSE resource/metrics broadcasts are de-duplicated (bucketed change-hash), the heavy poll aggregates gained short-TTL caches, datacenter/status is parallelised, the unused 3 MB @babel/standalone bundle was dropped from production, and several VM-list / VM-config-modal render paths were made much lighter. The WebUI is noticeably snappier at scale.

v0.9.13.3

Flexible snapshot schedules (#586): cron (5-field), monthly (clamped to the month length) or one-time policies, each with a "run now" and a prune-only mode, plus retention pruning.
Replication overview tab (#430): every replication job across your connected clusters - local PVE and cross-cluster - in one view, with OK / failed / never-run health, KPI tiles and CSV / PDF export.
Offline-mode responsiveness: one slow or unreachable cluster no longer wedges the whole UI (#594); a node no longer stays stuck at "(Updating)" in the sidebar after a successful update (#592).
Fixes: boot-order changes no longer send an empty config (#580); sessions/tokens record the real client IP behind a proxy (#583); Update Manager guards a non-string PBS log line (#584); PVE-native tags are surfaced in the VM list (#585); failed tasks show in red (#590); SSO admins are re-prompted for sensitive actions (#587); resource-pool group grants now match case-insensitively (#555).
Hardening: the CIS profile now bounds journald / auditd / process-accounting log growth (#595); log-injection hardening in the Site Recovery plan flow.

v0.9.13.2

Security hardening from an external audit: API tokens now keep their scoped role on object-level checks (an admin-owned, lower-scoped token can't regain admin access); cluster-access gate on PBS backup restore; per-VM authorization on the ESXi console endpoint; cluster-access checks on ESXi→Proxmox migration; per-VM vm.snapshot checks on snapshot policies; tenant isolation + role hierarchy in user/role administration; per-action permissions on scheduled actions.
Sessions and API-token history now record the real client IP behind a reverse proxy (#583).
Fixes: boot-order changes no longer send an empty config to Proxmox (#580); the Update Manager no longer white-screens on a non-string PBS log line (#584); ESXi migration (vmkfstools clone) handles disks across multiple datastores (#561).

v0.9.13.1

Cross-cluster replication: per-NIC target bridge map + pin replica VMID / delete-target toggle (#532, #552).
Corporate layout warns before "Fix QEMU args" (it can block live / cross-cluster migration, #424).
Two rounds of security hardening; Netzware added to the Platinum sponsors.

v0.9.13

New Cloud (Preview) layout with full per-cluster parity.
Resource-pool membership honoured in cluster/VM visibility incl. the client portal (#555).
Portal VNC + reverse-proxy fixes (#547); external console link corrected (#551).

v0.9.12.3

VDDK-free near-zero-downtime ESXi migration via vmkfstools clone - now the default.
Per-tenant quotas + chargeback; alert escalation chains (#501); CIS rollback (#386/#433/#434); numeric IP sorting (#431).