Skip to main content

Changelog

All notable changes to ProxCenter are documented here. This changelog follows the Keep a Changelog format.

v1.4.8 -- 2026-08-24​

vDC storage policies and tenant VLAN networks. A provider now governs tenant storage with QoS caps and per-tier quotas, and hands each vDC its own VLAN ranges to build networks in, self-service. Alongside them: a Task Center that finally shows every job, migrations included, warm migration nodes the product prepares itself, replication RPO and Ceph OSD latency alerts, and a large batch of Site Recovery, migration, and access control fixes.

Added​

  • vDC storage policies with QoS caps and per-tier quotas -- A provider declares a policy on a connection and one of its storages, sets read and write IOPS and bandwidth caps and a quota for that tier, then assigns policies to vDCs. The caps are stamped on the virtual machine disks a tenant creates, deploys, clones, restores, rolls back, imports, or moves, and per-tier usage is metered from the storage content listing rather than from the declared size, so an import-from allocation is counted for what Proxmox really allocates. Changing a policy's caps re-applies them to the disks already governed by it, with live progress, and the deploy wizard is gated on the tier quota instead of failing on its last step. The storage a policy governs has to be shared and to advertise disk images or container volumes. See Virtual Datacenters. (Enterprise)
  • Tenant VLAN networks with provider-managed pools -- A provider hands each vDC one or more VLAN pools, each a bridge paired with a tag range, and the tenant then creates its own networks inside them, self-service, with the tag allocated from its pool. ProxCenter derives and creates the SDN zone itself, one per connection and bridge, on the first tenant VLAN network. A pool also authorises the tags a tenant may set on a guest NIC attached directly to that shared bridge. VXLAN allocation is floored at VNI 10000 so a VLAN tag can never collide with it, and external addressing is offered on VLAN networks only. See Virtual Datacenters. (Enterprise)
  • Optional VMID ranges for vDC tenants -- The restriction to MSP tenants was purely application side. A vDC tenant on a shared provider cluster can now carry a range, with the used-VMID scan resolved through its vDCs so uniqueness and the next free id stay correct across tenants on the same cluster. The range is also a column of the tenants table, sorted on its lower bound. See Multi-Tenancy. (Enterprise)
  • Migrations in the Task Center -- The page aggregated four orchestrator sources and never the migration jobs table, so the Migration filter it offered could never match anything. Migration jobs join as a fifth source, scoped by target connection so a vDC tenant sees its own migrations even though it does not own the source hypervisor connection, and a migration can be cancelled from there. The ProxCenter tab of the tasks bar carries the same jobs over the whole history, and a double click on a row opens that job's details. See Task Center.
  • ProxCenter prepares a warm migration node -- Broadcom closed the public VDDK download in August 2026, so the portal URL the node-setup guide pointed at now returns 404 for everyone. The VDDK ships through a private registry package instead, and the migrate dialog gains a Prepare the node action that installs nbdkit, nbd-client, and the nbdkit VDDK plugin, enables the Debian non-free component, unpacks the VDDK, adds the symlink the nbdkit shipped with Proxmox 9 needs, and loads the nbd module. Every step is idempotent, and the manual guide stays as the fallback for a node without registry egress. See Migration. (Enterprise)
  • The operator chooses the warm cutover moment -- A warm migration used to switch over as soon as the projected downtime fitted its budget. In manual mode the run keeps issuing delta passes, paced at one per minute, with no expiry, until the operator asks for the switchover or cancels, and the downtime shown at the moment of the click is the real one. The downtime budget itself is settable from the migrate dialog, as a curated slider paired with an exact seconds field. See Migration. (Enterprise)
  • Replication RPO and Ceph OSD latency alerts -- Thresholds could only describe how full a resource was. Three types join them: a job whose last successful sync fell behind its own RPO target, a job that failed outright, and an OSD answering slower than the operator tolerates. The RPO grace is a percentage of each job's own target rather than a fixed delay, since ten minutes late is harmless against a 24 hour target and unacceptable against a 15 minute one. The OSD check ships disabled, because no latency threshold suits every disk and an upgrade must not start alerting on its own. See Alerts.
  • Recovery notifications when an alert clears -- The mail carries when the alert fired, when it cleared, how long it lasted, and the value it came back to, and it bypasses the minimum severity filter, since a recovery ranks below any threshold and would otherwise be dropped in silence. Resolution now waits for hysteresis, so a value oscillating around its threshold no longer mails once a minute, and both knobs, the margin and the number of confirmations, are exposed under Settings > Alert thresholds. See Alerts.
  • A configurable boot screenshot delay and non-isolated DR tests -- The stabilization wait before a console capture was a constant 45 seconds, so a guest that boots slower was photographed mid-boot; the delay is now a test failover option, from 5 to 600 seconds, persisted on the execution. A DR test can also leave the NICs connected instead of always isolating them: it is a switch, on by default, with a warning about colliding production addresses, and the mode the run used stays visible on a chip. See Site Recovery. (Enterprise)
  • Pool-based selection for backup jobs -- A provider can now point a job at a Proxmox resource pool instead of naming guests, fed by the pools endpoint so a scoped caller sees its own perimeter, and the inventory panel resolves the pool instead of showing a dash. A vDC tenant was already restricted to pool selection and is unaffected. See Backups.
  • Disk health, ZFS pool state, and node temperatures -- SMART attributes are shown when a disk row is expanded, including the NVMe text form Proxmox returns on real hardware, parsed into labelled rows whose direction is explicit so remaining life is never colored like consumed life. The node view gains ZFS pool state, scrub, and the vdev tree. Node temperatures are read from the kernel hwmon tree over SSH, since Proxmox exposes none and a stock node has neither lm-sensors nor ipmitool, aggregated per role with a threshold per role, and a node that reports nothing simply shows no temperature instead of an error. See Inventory.
  • A ZFS ARC dashboard widget -- ARC was only visible overlaid on memory available in the node summary, where three orders of magnitude flatten it onto the baseline. The widget gives ARC its own auto scaled axis plus a percentage view, excludes the nodes that report none, and names its requirement, Proxmox 9 with ZFS in use on the node, rather than showing an empty frame. See First Steps.
  • Free widget placement and a theme logo widget -- Dashboard widgets stay where they are dropped instead of being compacted upwards, and a new widget shows the branding logo, the ProxCenter logo, or the theme badge. See First Steps.
  • Appearance preferences are stored in the user account -- Color scheme, layout, density and typography, per tenant and per user, resolved server side so the restored palette is already in the first HTML. An existing cookie is imported once, carrying the id of the account that wrote it so a shared browser never copies one person's look into another's.

Improved​

  • Logs and actions are handled per job type in the Task Center -- Rolling updates and replication are read from the orchestrator, migrations from the shared task history, DRS from the Proxmox task log rebuilt out of the UPID, and Site Recovery is synthesized from the per-VM results. Actions are routed the same way, a migration cancellation is confirmed, action errors are surfaced, the buttons the orchestrator cannot honour are gone, deleted connections are named instead of printing a raw id, and a recovery plan execution is reported as Site Recovery instead of being filed under maintenance. See Task Center.
  • A refused guest shutdown is recoverable during a cutover -- The cutover asked the guest to shut down and then polled in silence for five minutes, so a guest that refused cost the whole transfer. The wait is now a step of its own, it restates the time left every minute, and it offers a hard power off, which stays the operator's decision because it makes the final delta crash-consistent. The budget grows to 30 minutes, a host that refuses the hard power off, as an ESXi licence restriction does, is logged instead of crashing the job, and vSphere SOAP faults carry the concrete fault type and message instead of the generic wrapper. See Migration. (Enterprise)
  • The Proxmox request budgets are settings -- PVE_TIMEOUT_MS covers a regular call and PVE_SLOW_READ_TIMEOUT_MS the reads that enumerate every storage, so a datacenter declaring many Proxmox Backup Server targets can be given the time it needs. A response timeout on a read no longer trips the failover circuit breaker like an unreachable host does. See Installation.
  • Virtual machine configuration writes follow the Proxmox task instead of racing the request budget, and the saved message follows the pending keys Proxmox reports rather than the power state, so a hotplugged change reads as applied and a pending one names the stop and start it needs. See Inventory.
  • The real disk format is reported. Proxmox deletes the optional format= property right after allocating a volume, so falling back to raw mislabelled every qcow2 and vmdk disk; the format is derived from the volume name instead. Which formats a storage accepts stopped being a function of its type in Proxmox 9, so both storage routes compute it from the cluster storage configuration and the disk dialogs follow that answer. The Cloud-Init drive is labelled as such rather than appearing as a CD-ROM, which also keeps the ISO editor from detaching its volume. See Inventory.
  • Text stays readable on a light branding color, and the tooltip hover band on bar charts follows the theme instead of painting a white block over the hovered bar in dark mode. See White Label.

Fixed​

  • A powered-off VM can be replicated -- Replication is pure Ceph RBD and the only power-dependent step is already guarded per VM, yet the create-job dialog and the API route both filtered on the running state. On a tag-based job, a guest that was powered off was also silently dropped from the protected set at the next re-resolution while the job kept reporting success. Tag resolution no longer looks at power state, every VM that leaves or joins the protected set is logged, and the per-VM rows that no longer belong are pruned. Templates stay excluded, since a replica of one could not start at failover. See Site Recovery. (Enterprise)
  • A tag-based job whose tags stop matching says so -- A job whose protected set empties at a later re-resolution lands in an explicit no match status instead of the error and retry path: no failure mail, the next sync stays scheduled, and the status is rendered on the protection chip and filter, the emergency DR chip, and the dashboard job distribution. RPO alerts deliberately keep firing, because a job protecting nothing must keep nagging. See Site Recovery. (Enterprise)
  • Community installs grant the super-admin role again -- Since v1.4.7, an account created from Security & Access > Users on a Community install received no RBAC grant at all: the auto-grant was gated on a resolved licence verdict, which a Community install running the frontend alone can never establish. Its owner saw an empty dashboard, and the operator could not repair it because the role picker is Enterprise gated. The gate now keys on the deployment shape, and a sign-in backfill repairs the accounts already created without one. See Users.
  • A pool or tag scoped user can create a guest -- A grant whose only scope is flat can never satisfy a connection-scoped check, so six of the routes the Create VM wizard calls refused it: the pool and storage pickers came back empty and the submit was denied. Such a caller now gets a perimeter derived from the guests they already see on one connection, nothing wider than what the inventory stream already sends them, and creation forces the accessible pool so a guest cannot be created invisible to its own creator. See RBAC.
  • An unparseable branding color no longer turns every page into a 500 -- A White Label primary color typed without its leading # was stored as is and handed to the theme, which throws on anything it cannot parse, in a provider that wraps the dashboard and the login page alike. The value is normalized on the way in and on the way out, the field explains the expected format and blocks Save, and both branding reads repair what is already stored, so an instance stuck on the 500 page recovers on its own after the update instead of needing a database edit. See White Label.
  • VMID availability is scoped to the target connection -- With two clusters connected, cloning a template was impossible: the dialogs were fed the merged inventory of every connection, so an id used on the second cluster was refused on the first. Proxmox only requires uniqueness inside a cluster. MSP and vDC tenants keep their cross-cluster range, which is an explicit contract enforced server side. See Inventory.
  • virt-v2v never prompts for the root filesystem -- The conversion is launched detached, so an interactive root prompt died on end of file after the whole transfer had completed. This is not limited to dual-boot guests: a btrfs guest with snapper snapshots inspects as one system per subvolume, and one reported guest listed sixteen candidates. Conversion now runs with stdin closed, drops snapshot subvolumes from the candidate list, retries once with an explicit root, and parks the job for an operator choice when several real systems remain. A root filesystem can also be pinned up front in the dialog. See Migration. (Enterprise)
  • A cancelled migration that was parked really stops. The virt-v2v cancel registry was never wired into the cancel route, so the row changed state while the pipeline kept waiting. (Enterprise)
  • A failed create no longer destroys a pre-existing VM -- The VMID is reserved before the guest exists, so a failure in between made the cleanup call DELETE on a VMID it had never created, and with a user-supplied id that was already taken it purged the guest holding that id. Destruction now happens only when the job actually created the VM. (Enterprise)
  • A slow storage listing no longer empties the migration Target Storage field. A datacenter declaring many Proxmox Backup Server storages needs 20 seconds or more to answer, well past the 8 second budget that was hardcoded in two literals. The dialog now surfaces the server reason with a retry instead of swallowing it. See Migration.
  • A slow RAM hotplug no longer reports a failed save. Removing memory unplugs one DIMM at a time and Proxmox sleeps 3 seconds per module, so dropping a running guest from 8G to 4G costs 24 seconds at best, well past the request budget: the write aborted on our side while Proxmox went on applying it. See Inventory.
  • Alert mails keep the severity the engine established. The notifier re-derived it from value against threshold, so an alert with no measured quantity, a failed replication job for instance, was always classed as a warning and never reached an operator whose minimum severity is critical. Stale snapshot alerts can also finally resolve: a deleted snapshot never comes back through the checker, so its alert stayed active for ever. See Alerts.
  • Presentation fixes. An unrecognised disk health string is no longer painted green, and a disk that reports no wearout says so instead of showing an empty bar. The tree context menus share one paper with theme-aware icons, the disk tables use the product typography instead of hardcoded monospace, and three list items no longer nest a block element under a paragraph.

Security​

  • API token offboarding, scope audit, and real deletion -- Disabling or deleting a user left the tokens they had minted behind with no way to see them. The user dialogs now list them and offer to delete them in the same gesture, unchecked by default, with the deletion running before the account write, and the creator is frozen on the token so provenance survives the account being deleted. Deleting a token now removes the row instead of stamping it revoked, which had left legacy revoked tokens stuck in the table. The compliance:read scope, which mapped to a write-capable permission and granted nothing today, is gone, and the scope test now fails on any scope mapping a dangerous or non-read permission. See API Tokens.
  • Two unguarded routes -- Creating an alert now requires alerts.manage, checked before the body is read, like the other writes on the resource. Upload progress is scoped to the user who opened the transfer, so the upload id is no longer the only thing standing between a signed-in user and someone else's counters.
  • The orchestrator no longer trusts X-Forwarded-For blindly on every request, where any caller could pick the IP it was recorded as (GO-2026-5777), and it builds on a Go toolchain that still receives patches.
  • CVE-2026-40345 -- A deepmerge-ts >= 8.0.2 floor, since the vulnerable version is pinned exactly by @prisma/config and no Prisma release ships the fix yet.
  • Dependency batches -- Eight updates batched, including Next 16.3 and MUI X Data Grid 9.12, plus concurrently 10, and the earlier batches of thirteen and five updates. Continuous integration runs on Node 26 and the package declares its Node floor.

Upgrade notes​

  • Pull the images. Four schema migrations ship with this release and are applied by the frontend entrypoint at first boot under an advisory lock: the user appearance preferences table, the API token creator provenance column, the vDC VLAN support tables, and the vDC storage policy tables.
  • Six optional settings are new, all empty by default, so an installation that sets none of them behaves exactly as before. PVE_TIMEOUT_MS and PVE_SLOW_READ_TIMEOUT_MS are the Proxmox request budgets and reach every edition. GHCR_TOKEN, PROXCENTER_VDDK_PACKAGE, PROXCENTER_VDDK_TAG, and V2V_ROOT_CHOICE_TIMEOUT_MS reach the Enterprise and high availability stacks, since migration is an Enterprise feature. See Installation.
  • Warm migration node preparation needs GHCR_TOKEN in the frontend container. The Enterprise installer already writes it to the stack environment file; on an installation upgraded by hand, add it there before using the Prepare the node action. See Migration.
  • The Ceph OSD latency alert ships disabled and no threshold is created for it, so an upgrade never starts alerting on latency by itself. Enable it and set the threshold that suits your disks. See Alerts.

v1.4.7 -- 2026-08-14​

Security release: two authentication fixes, revocable sessions, and disaster recovery failback. Two privately reported authentication issues are fixed, sessions are now tracked server side and can be revoked, Site Recovery gains a real failback flow along with boot screenshots on test failovers, and a large batch of migration, tenancy, and interface fixes lands. Upgrading is strongly recommended for every installation.

Added​

  • Revocable server-side sessions -- Sessions are tracked server side and can be revoked: from an Active sessions card on your profile for your own sessions, and from an All sessions tab on the Users page for everyone else's. Session cookies carry secure flags, and idle and absolute lifetimes are configurable through SESSION_IDLE_TIMEOUT and SESSION_ABSOLUTE_TIMEOUT. See Users.
  • Read-only API tokens -- pxc_ tokens grant read-only access to a set of aggregated endpoints, scoped and quota limited, for dashboards and external monitoring. See API Tokens. (Enterprise, API Access add-on)
  • Site Recovery failback -- A plan that has failed over can now fail back: a reverse incremental sync brings the source back up to date, then an operator-driven cutover switches back, with per-VM rollback and re-protect. Failed-over plans and their replication jobs stay locked until failback completes. See Site Recovery. (Enterprise)
  • Boot screenshots on a test failover -- Each recovered VM's console is captured while the test runs and kept with the execution, so you can see what a guest actually booted into instead of trusting a power state. The captures are listed and served from the execution view. See Site Recovery. (Enterprise)
  • Restore point selection and configurable snapshot retention -- A test or real failover can recover a VM from an older DR snapshot instead of the latest one, and retention is set per replication job for the source and the DR side separately. Per-VM failover steps are surfaced on the execution results. See Site Recovery. (Enterprise)
  • Several vDCs per tenant -- A tenant is no longer limited to a single virtual datacenter: it can hold one vDC per provider-pool cluster, and a global vDC context switches the interface between them. See Virtual Datacenters. (Enterprise)
  • Optional VMID ranges for MSP tenants, so guests created by a tenant stay inside a reserved numbering window. See Multi-Tenancy. (Enterprise)
  • Pre-migration check for HA affinity rules -- The node picker of the Proxmox migrate dialog flags a target that would break an affinity rule, and blocks it outright when the conflicting guest is running. See Migration.
  • Migrated disks can be converted to qcow2 after the move, an option offered on thick LVM targets so the guest gains Proxmox snapshots. See Migration.
  • vzdump archives are listed in a guest's Backups tab, alongside the Proxmox Backup Server snapshots, and can be restored from there. See Backups.
  • Security groups can be attached to several guests at once from the group view, with a corrected membership count. See Network. (Enterprise)
  • A CIS Controls v8.1 card joins the compliance Frameworks tab, next to NIST 800-53, NIST 800-171, CMMC Level 2, and ISO/IEC 27001. See Compliance. (Enterprise)
  • A provider-configurable broadcast banner announces planned maintenance to every tenant, or to selected tenants and roles, from one place. See Notifications.
  • A tenant filter on the storage overview, so a provider can read one tenant's storage without leaving the page. See Storage. (Enterprise)

Improved​

  • The orchestrator survives the loss of the node it was configured with -- its Proxmox API calls fail over to another node of the cluster instead of dying with that node, and guest commands are addressed to the node that actually owns the guest. The SSH and RBD data path still uses the configured address. See Site Recovery.
  • Warm migrations warn before falling back to CBT and report live progress during the pre-zero and copy phases instead of showing an indeterminate bar. See Migration.
  • Reports carry the tenant's white label, including the compliance PDF export, its logo, and its footer. See Reports.
  • AI prompts are answered in the language of the interface, whichever provider serves them. See AI.
  • The Proxmox rule log level is exposed in the firewall dialogs and rules tables. See Network.
  • The PVE node is shown in filtered flat VM lists, and console windows lead with the VM name instead of the connection identifier. See Inventory.

Fixed​

  • Tag and pool scoped users see their guests again -- a user whose only grant was a tag or a pool had an empty inventory since v1.4.6. The visible perimeter is now derived from the guests that remain after filtering. See RBAC.
  • A vSphere snapshot task is followed with per-phase budgets instead of failing at a fixed 120 second deadline, which blocked warm migrations of multi-terabyte guests. See Migration.
  • A fully copied warm target is kept instead of being freed when cleanup runs.
  • Migrated Windows and UEFI guests take their boot disk on SATA instead of LSI SCSI, so they boot without a driver injection.
  • The i440fx machine type is sent to Proxmox as pc, its real name, instead of the rejected i440fx, which unblocks guests pinned to that chipset. See Inventory.
  • Custom CPU models are handled in the CPU type selects and in the cross-cluster migration pre-check.
  • Migration jobs orphaned by a server restart fail cleanly instead of staying stuck in a running state.
  • The virt-v2v temporary storage requirement is hidden in warm mode, where it does not apply, and no longer reports a false lack of space. See Migration.
  • A real failover fences the source VMs before starting their replicas, so the same guest cannot run on both sides. The fencing is best effort and is skipped when the source cluster is unreachable. See Site Recovery. (Enterprise)
  • A failover no longer erases the recorded address of a node that stopped answering. (Enterprise)
  • Firewall data is read from and written directly to Proxmox when no orchestrator is reachable, instead of leaving the firewall views empty. See Network.
  • The infrastructure report includes every VM instead of stopping at an internal cap. See Reports.
  • Numeric fields can be cleared instead of snapping back to a default value while you type.
  • Snapshot rows follow the Proxmox task instead of claiming success before it finishes. See Inventory.
  • The tasks bar keeps the page content reachable when it expands, dashboard widget filters stay reachable when a filter empties the view, and batch actions stay available when alerts are selected from the header checkbox. See Task Center.

Security​

  • A dotted API path no longer skips authentication -- the middleware classified any request path containing a dot as a static asset and answered before the session check ran, so an API path carrying a dot reached its route handler unauthenticated. Proxmox node names accept dots and the guest routes carry the node name in their path, so a cluster with an FQDN node name exposed guest notes and task data to unauthenticated callers. Reported privately as GHSA-79j6-v2r5-5pw5.
  • Defense in depth on the guest routes -- notes, tasks, and features now carry their own permission checks, evaluated before the Proxmox connection is resolved, so a refused caller never causes the stored API token to be decrypted.
  • First-run setup is bounded -- the setup endpoint stays reachable while no account exists, which is how a self-hosted install bootstraps, but it now enforces a rate limit, accepts an optional PROXCENTER_SETUP_TOKEN shared secret, and decides that no account exists inside a serializable transaction, so two concurrent bootstraps can no longer both create an administrator. Reported privately as GHSA-qxgh-pw46-6pw6. See Installation.
  • Dependency batch -- seventeen updates consolidated into one pass: otplib 12 to 13 for TOTP, MUI X Data Grid raised to 9.9, the checkout, setup-node, and setup-go GitHub Actions raised to v7, and the fast-uri and brace-expansion advisories patched within their major branches.

Upgrade notes​

  • No manual migration step is required beyond the usual image pull: the schema migrations apply themselves when the container starts.
  • One of those migrations refuses to run if an installation somehow holds two vDCs sharing the same cluster, or two vDCs sharing the same slug, within one tenant. Only direct API calls could create such a pair, since the interface never allowed it. If the container stops on that message, remove the duplicate vDC and start it again.
  • Two optional settings are new and unset by default, which preserves the current behavior. PROXCENTER_SETUP_TOKEN guards the first-run setup endpoint, and SESSION_IDLE_TIMEOUT and SESSION_ABSOLUTE_TIMEOUT override the default session lifetimes of 12 hours idle and 7 days absolute. See Installation.
  • Setting PROXCENTER_SETUP_TOKEN means the browser setup wizard can no longer create the first account, since it does not send the header. Bootstrap that installation with a direct API call instead, as documented in Installation.

v1.4.6 -- 2026-07-27​

Control-plane HA, warm migration reliability, and license add-ons. ProxCenter can now convert a standalone installation into a three-node highly available control plane, warm migration gets a round of reliability fixes for block allocation and NBD device handling, and license add-ons let you stack extra paid capabilities on top of your edition license.

Added​

  • ProxCenter HA -- Turn a standalone installation into a three-node control plane with replicated PostgreSQL, etcd quorum, and a virtual IP that fails over. Operationally, this means the ProxCenter application itself keeps running if a node goes down: the virtual IP moves to a surviving node, etcd handles leader election so exactly one node is active, and PostgreSQL replication keeps application data consistent across all three nodes. (required license)
  • HA deployment wizard and cluster dashboard -- A guided wizard converts a standalone install into a three-node cluster, running prerequisite checks up front and showing live progress through each conversion step. Once converted, a cluster dashboard shows per-node status, a service grid, and an operations panel for day-to-day HA management. (required license)
  • Branding assets moved to PostgreSQL -- Logos and login backgrounds are stored in the database instead of on local disk, so they are identical on every node of an HA cluster instead of needing to be uploaded separately to each one. See White Label.
  • License add-ons -- Option licenses stack on top of your edition license to unlock a specific paid capability without replacing or regenerating your main license. Add-ons appear in the license table alongside the capabilities they unlock and are purchased and issued from the customer portal. See Licensing.
  • Interactive warm cutover -- Choose the exact moment a warm migration cuts over, with a live downtime estimate, instead of letting ProxCenter switch the guest over on its own once the delta sync is ready. See Migration. (Enterprise)
  • Delete all snapshots in one action -- Remove every snapshot of a VM in a single action instead of one at a time. A new guard also blocks a cross-cluster migration while snapshots still exist on the source VM, preventing a move that would silently leave orphaned snapshot data behind. See Migration.
  • Batch alert actions -- Select several alerts in the table and acknowledge or delete them in one action instead of one at a time. See Alerts.
  • Blueprints gain custom images and full deploy configuration -- Blueprints can now use custom uploaded images in addition to the catalog, and the deploy flow adds cloud-init configuration, hardware sliders (CPU, memory, disk), and IP and bridge selectors. See Templates & Cloud Images. (Enterprise)
  • Inventory, topology, and connections scoped to RBAC grants -- The inventory tree, the network topology view, and the connections list now filter down to the connections a user's role actually grants access to, instead of listing every connection in the tenant. See RBAC.
  • Korean and Spanish interface languages, plus KRW currency support for cost and billing displays.
  • VMs grouped by SDN VNet in the inventory -- Guests attached to an SDN VNet are grouped under that VNet in the inventory tree, with the VXLAN ID and zone shown alongside it. See Inventory.

Improved​

  • Cloning suggests the next available VMID instead of a random one, so sequential VMIDs stay predictable across a cluster.
  • The external hypervisor VM table can be sorted by column, making it practical to pick the right guest out of a large vCenter or ESXi inventory during migration. See Migration.
  • Users created on a Community installation are granted full super-admin rights, since Community has no RBAC roles to assign a more restricted permission set to.
  • Remaining hardcoded French strings in the alerting UI moved to translation keys, so the Alerts page is consistent in every supported language instead of showing French text regardless of the selected locale. See Alerts.

Fixed​

  • Warm migration allocates block volumes as raw instead of qcow2 -- this removes a large allocation delay on LVM and Fibre Channel targets, and a failed allocation no longer leaves an orphan volume behind that poisoned every subsequent retry. See Migration.
  • Warm migration allocates a free NBD device instead of assuming a fixed one, so a second concurrent warm migration on the same node no longer collides with the first.
  • Warm copy over SSH keeps the connection alive and applies an inactivity timeout, so a long-running copy can no longer hang indefinitely on a stalled connection.
  • A cross-cluster migration no longer fires two destroy tasks on the source VM, which could report a spurious failure even after the guest had already moved successfully. See Migration.
  • Node Local Time no longer applies the UTC offset twice in the inventory node detail panel. See Inventory.
  • Storage capacity in the Overview is aggregated per cluster, so shared storage (NFS, Ceph, etc.) is counted once per cluster instead of once per node, which previously inflated total capacity on multi-node clusters. See Storage.
  • The SSH-command and task-log copy buttons fall back gracefully when the browser blocks the Clipboard API outside a secure (HTTPS) context, instead of failing silently.
  • The migration log console keeps its last line visible above the tasks footer instead of it being hidden underneath. See Task Center.
  • A scheduled backup job runs on the guest's real node instead of always the first node of the cluster. See Backups.
  • Cloud-init IP settings are applied on bridges that have no IPAM configured, instead of silently being dropped when the target bridge has no IPAM pool behind it. See Virtual Datacenters.
  • VM names starting with a digit are accepted, instead of being rejected by a validation rule stricter than Proxmox itself requires.
  • Host VLANs with no attached VM are shown in the inventory Network view, instead of being hidden because the view previously only rendered VLANs that had a guest on them. See Inventory.
  • The generated PVE token setup script includes Sys.PowerMgmt, so node reboot and shutdown work out of the box instead of failing with a permissions error that required manually editing the token's ACL. See Connect Your Infrastructure.
  • Panel width is remembered across sessions, and status chips are readable in both light and dark themes instead of losing contrast in one of them.
  • Sorting external hypervisor VMs no longer crashes when the source inventory has incomplete data for some fields. See Migration.

Security​

  • Node, VMID, and storage identifiers are validated before being interpolated into SSH commands, closing an injection path where a crafted identifier could alter the command being run.
  • The license client no longer keeps the previous entitlement state when a license check fails, falling back to Community instead of continuing to honor a stale entitlement.

v1.4.5 -- 2026-06-27​

Compliance frameworks, DRS load balancing, and an OIDC role-sync fix. Assess a connection against major security compliance frameworks, DRS finally honors its Balance Types setting, and a login regression that could silently demote manually assigned administrators is fixed.

Added​

  • Security compliance frameworks -- Assess a connection against NIST 800-53, NIST 800-171, CMMC Level 2, and ISO/IEC 27001 from a new Frameworks tab, with a score donut, satisfied / partial / failed breakdown, per-node results, and a styled PDF report. See Compliance. (Enterprise)
  • Open in Proxmox -- A button next to the cluster or node name opens the native Proxmox web interface in a new tab, deep-linking a member node to its own management IP instead of always opening the cluster's primary node.
  • Migration target-network selector lists SDN VNets alongside classic bridges, so nodes whose guest networks are VNets rather than plain bridges no longer show an empty target list. See Migration.

Improved​

  • Inventory Network view shows host bridges and VLANs per node, so clusters with no VMs are no longer an empty page; bridges open a detail panel and SDN VNet IDs resolve to their friendly alias. See Inventory.
  • Node maintenance is simpler -- entering maintenance now triggers Proxmox's own node-maintenance mode (HA guests are evacuated by Proxmox itself), with a note that non-HA guests still need to be migrated or shut down manually.
  • DRS honors the Balance Types setting, previously a dead knob -- load-balancing candidates are now filtered by guest type for both reactive balancing and homogenization, with the guest-type gate also applied at execution time. See DRS.
  • DRS settings cleanup -- removed the dead balancing-method and balancing-mode knobs, guarded balance-types at a minimum of one, moved resource weights to a single row, and added status icons on exclusions and balance-types.
  • The inventory tree's expand/collapse state is now scoped per tenant, so switching tenant no longer carries over the previous tenant's expanded/collapsed state.
  • The cluster SSH test shows the per-node ok/error breakdown on failure too, not only on success.
  • The VM delete confirmation dialog spells out exactly what will be removed before you confirm.

Fixed​

  • OIDC role preserved on login -- v1.4.4's OIDC role re-sync demoted any user with no matching IdP group to Viewer on every sign-in, which could lock out a manually assigned administrator. The re-sync is now authoritative only when a group-to-role mapping is actually configured and groups are sent by the IdP.
  • OIDC accounts are labelled correctly and can no longer be given a local password, closing a path where a credentials-based login could bypass SSO and MFA entirely.
  • Warm and direct-ESXi migrations preserve the source NIC MAC address, so the migrated guest keeps its network identity instead of stranding its old IP on a ghost adapter.
  • Warm migration reliability -- a stale /dev/nbdN device is released before attaching, and the delta-apply step is chunked to stay under the SSH argument-size limit.
  • Migrating a running LXC container now uses restart mode instead of online=1, which Proxmox rejects for containers, so an online CT migration no longer fails outright.
  • Dropped the misleading "vSAN datastore detected" log line on the vCenter migration path.
  • The percent chart Y-axis is widened so the "100%" label is no longer clipped.
  • Old completed tasks are no longer re-alerted as new events roughly a week after they originally ran.

Security​

  • Patched Go orchestrator CVEs by bumping golang.org/x/crypto, x/net, and x/sys (SSH, HTML, and IDNA advisories).

v1.4.4 -- 2026-06-22​

Stability and security hardening, plus shared migration tasks. A patch-focused release: MSP gets a header tenant switcher, in-flight migrations become visible to the whole team, several data-integrity and error-surfacing fixes land across guests and RRD charts, and the runtime image gets a security cleanup.

Added​

  • Header tenant switcher -- MSP administrators can switch the active tenant directly from the navbar, with the dashboard and other pages re-scoping to show only that tenant's data. See Multi-Tenancy. (Enterprise)
  • Shared migration tasks -- In-flight migrations now appear in a shared footer panel visible to every user instead of only the one who started them, so the whole team can follow a long-running migration, with a link to the warm-migration node setup docs included. See Migration. (Enterprise)

Improved​

  • VM console screenshots are served as JPEG instead of raw PPM, producing lighter, faster-loading previews in the inventory tree and detail panel.

Fixed​

  • RRD performance charts show dates on multi-day timeframes -- charts previously showed only times, which made it impossible to tell which day a data point belonged to once the timeframe spanned more than 24 hours.
  • The Backups tab surfaces the real gateway error -- a reverse proxy returning an HTML error page used to fail silently with Unexpected token '<'; the actual gateway error is now shown. See Backups.
  • A failed migration block-device transfer is now reported as a failure instead of being masked as a successful migration.
  • Warm migration to a thick-provisioned target bounds its zero-fill pass, so it can no longer exit with a false out-of-space (ENOSPC) error.
  • Guest and node API routes no longer swallow real errors -- failures now surface to the UI instead of silently returning empty data.
  • OIDC users re-sync their role from IdP group membership on every login, so a group change in the identity provider takes effect immediately rather than waiting for the next manual sync.
  • RRD performance graphs are scoped to the resource rather than the whole connection, closing an RBAC scope leak where a user could see performance data for resources outside their granted scope.
  • The inventory NETWORK section stays stable when a connection briefly blips instead of collapsing and losing its expanded state. See Inventory.
  • Replication writes the DR config with cp -f on pmxcfs, avoiding a transient failure window during the write.

Security​

  • Removed the unused npm binary from the runtime image, patched dependency CVEs (undici, OpenSSL on the orchestrator), and refreshed front-end dependencies.

v1.4.3 -- 2026-06-15​

MSP mode, multi-license stacking, connection health diagnostics. MSP tenants can own whole Proxmox clusters, multiple licenses can be stacked on one install, and every connection gets a built-in health check.

Added​

  • MSP mode (whole-cluster tenant ownership) -- An MSP tenant can own entire Proxmox clusters with an unmasked full-cluster view, alongside the existing vDC / IaaS slicing. The provider / NOC keeps the fleet-wide view (dashboard, VMs, alerts, reports) for supervision and license aggregation, while each MSP tenant operates only its owned clusters. Includes provider provisioning (assign or release connections, a Tenant / vDC ownership column, and an owner selector when creating a connection) and scoped operations (inventory, dashboard, alerts, reports, backup jobs, and migration among owned connections). See Multi-Tenancy. (Enterprise)
  • License stacking -- Import additional licenses to grow fleet capacity without regenerating the primary license. Fleet-total node quota, per-tenant rollup, a "Licensed to" name per import, plus edit-mapping and remove, all from the License tab. A single-license install behaves exactly as before. See Licensing. (Enterprise)
  • Connection health diagnostics -- A per-connection Diagnostic column and modal run read-only checks: reachability, authentication and permissions, version, cluster health / quorum / Ceph, storage and SSH for PVE; version, auth and datastores for PBS; basic reachability for external migration sources. Works in Community mode with no orchestrator dependency.
  • Guest names in alerts and event emails -- VM and CT alerts and event notifications now show the guest name next to the vmid ("Name (vmid)") in the alerts table, the navbar dropdown and the email template.

Improved​

  • Nodes column on the connection lists collapses to the first node plus a count, with the full list on hover.
  • Deploy wizard exposes real bridges and an editable VLAN tag for provider and MSP modes (vDC tenants keep the VNet picker).
  • Green Score insight moves to its own row so longer suggestions stay fully readable.
  • The What's New panel no longer opens automatically on a new version; open it any time from the profile menu.

Fixed​

  • Orchestrator API authentication -- The orchestrator now reads the API key from PROXCENTER_API_API_KEY (the value docker-compose already injects, identical to the frontend's key), so authentication can be enabled and matches the frontend. An unset key keeps authentication disabled as a safe fallback, so installs without a shared key are unaffected.

v1.4.2 -- 2026-06-14​

Warm migration, SPICE consoles, Ceph topology, and a security sprint. No-data-loss VMware migration, in-browser SPICE, a read-only CRUSH topology view, role-level RBAC scopes, SSO-only and local 2FA policies, plus a security hardening sprint.

Added​

  • Warm migration for VMware (CBT) -- VMware VMs migrate with changed-block tracking and a final delta sync, so there is no data loss on large or busy disks. Covers ESXi-direct and vCenter (including vSAN), single and bulk, with a go/no-go preflight and SOAP-session keepalive. (Enterprise)
  • In-browser SPICE console for QEMU VMs, alongside noVNC.
  • Ceph CRUSH topology view -- Read-only CRUSH tree with details and pools in the cluster Ceph tab, plus full cluster config with working OSD flag toggles.
  • Role-level default RBAC scope, inherited by every assignment of that role. (Enterprise)
  • SSO-only login policy for OIDC, hiding the local form and forcing the SSO redirect, plus an issuer fix for manual endpoint overrides. (Enterprise)
  • Local TOTP two-factor with an admin enforcement policy.
  • Clone a VM from a snapshot restore point, choosing a snapshot as the clone source.

Improved​

  • Local migration from the cluster Guests tab (node-to-node) instead of forcing cross-cluster only.
  • Reports and notifications overhaul -- connection scoping, backup report polish, per-category severity, and an event-email rework (English copy, task-log details, one mail per event).
  • Guest VLANs resolved from host bond sub-interfaces so tagged guests group correctly.
  • Resume paused VMs, dots allowed in tags, and the guest icon dims when off for color-blind legibility.
  • Dashboard widgets honor the appearance settings (font-size, corner-rounding, shared gauge).
  • Tree sections stay open when clicking the PROXMOX VE / NETWORK headers.
  • Serial / headless VMs show a badge instead of looping on a failing screenshot.
  • VM User role gains the read access the Inventory needs to load.
  • Standalone hosts behind NAT connect to the public host for node management, not the private interface.
  • Pull-based threshold alert evaluation with silence sync; silences are respected in the home dashboard widget.

Fixed​

  • Partial-VM cleanup no longer leaks the target VMID after a failed conversion.
  • Empty guest Backups tab now explains why (no connected PBS vs no snapshots).
  • "Run now" works again (a missing route returned an HTML 404).
  • Real local backup time and Proxmox-style columns, and legacy maxfiles is translated to prune-backups.

Security​

  • Security hardening sprint -- critical findings closed plus follow-ups, TOFU host-key verification on the ssh2 path, per-connection ws-proxy TLS and Dependabot overrides, js-cookie bumped to clear a high-severity advisory, and Node 26 pipeline hardening for XCP-ng / Hyper-V / Nutanix.

v1.4.1 -- 2026-05-21​

DRS hardening, migration fixes, and security. Automatic-mode DRS is significantly safer, with several reliability fixes for vSphere migration and rolling updates.

Improved​

  • DRS automatic-mode hardening -- A per-cluster migration cap replaces the global cap as the throttle, an opt-in per-target inflow cap prevents ping-pong, and the post-migration snowball is fixed so the scheduled cron is the only periodic trigger (maintenance evacuations still self-loop). Backed by a hardening bundle: 64-bit recommendation IDs, post-migration singleflight, exclusive scheduler registration, a freshness gate, a storage gate scoped strictly to maintenance evacuation, and affinity preserved across a PVE flap.
  • DRS settings UI cleanup -- The advanced section is reorganized into migration limits, behavior and resource weights, slider help moved to tooltips, and misleading dead toggles removed. The rebalance interval now supports 15m and 30m.

Fixed​

  • Migrate-to-Proxmox no longer greys out on single-disk nodes (#331) -- /tmp is synthesized as a temporary-storage fallback when the root filesystem has free space.
  • Long-running config PUT timeouts on slow storage (#332) -- all migration-time /qemu/{vmid}/config PUTs now use a 120s timeout, fixing ZFS-over-iSCSI auto-attach and the false "all cluster nodes unreachable" masquerade.
  • Rolling update reliability -- respects reboot_timeout end-to-end with sustained-online polling and a verify retry, runs apt / ha-manager / ceph / reboot via sudo -n for non-root SSH users, and surfaces node version and API token permission errors (#318).
  • curl stderr surfaced and orphan LVM freed on stream failure (#316).
  • Test connection for Ollama fixed after the auth refactor (#314).

Security​

  • SSRF guard on the AI test and models endpoints (#335) -- cloud metadata endpoints (AWS, Alibaba, OCI, AWS IPv6 IMDS) are blocked, with a DNS lookup so aliases that resolve to blocked addresses are rejected; local Ollama setups are unaffected.
  • Dependency and hardening bumps -- ws 8.20.1, bundled npm 11.15.0, an ip-address fix, go-ntlmssp, Alpine 3.19 to 3.22, a tightened license URL spoofing check, and shell-arg validators on SSH-command routes.

Upgrade notes​

  • No schema changes since v1.4.0. The DRS settings now present max_concurrent_migrations_per_cluster instead of the global max_concurrent_migrations; existing configs are auto-migrated at runtime.

v1.4.0 -- 2026-05-11​

MSP / IaaS release. ProxCenter becomes a multi-tenant Proxmox cloud platform. Each customer gets a self-service virtual datacenter (vDC) with quotas, network and backup isolation, while the provider keeps a single pane of glass over the underlying clusters. The persistence layer also moves to PostgreSQL for production-grade reliability.

Breaking​

  • PostgreSQL is now required -- SQLite support has been removed entirely. Existing installations must plan a PostgreSQL cutover before upgrading, then re-bootstrap their configuration through the UI on first boot. The Docker image no longer ships better-sqlite3 or the legacy SQLite migrator. Full step-by-step instructions are documented in Upgrade to v1.4.

Added​

  • vDC tenant cockpit -- A dedicated "My vDC" workspace for each tenant with live consumption (host and VM metrics), quota donuts for CPU, RAM, storage, snapshots and backups, datacenter map and Green IT KPIs. Tenants self-serve their capacity without provider intervention. (Enterprise)
  • Self-service deployment wizard -- A guided flow for tenants to deploy VMs from templates, ISOs, clones or PBS restores. Every step is quota-enforced server-side, and foreign resources (storage, node, bridge outside the tenant's vDC) are refused with explicit errors instead of being silently swapped. (Enterprise)
  • Native IPAM at the vDC level -- Per-vDC SDN VNet and subnet management, with automatic IP and MAC reservation on deploy, clone, restore and config edit. A PVE pool scan reconciles externally created VMs back into the inventory. (Enterprise)
  • Per-vDC Proxmox Backup Server bindings -- Each vDC gets its own PBS namespace, sub-token, ACL and PVE storage. Auto-provisioning is the default (one-click), manual mode is supported for stricter operators. Backup data isolation by design. (Enterprise)
  • Tenant restore from PBS -- Tenants can overwrite a source VM or restore as a new VM into their vDC pool, through a simple-mode dialog that hides advanced PVE flags they don't need. (Enterprise)
  • Tenant-scoped backup jobs -- PVE backup jobs constrained to the tenant pool, with a structured schedule picker (frequency, time, weekdays) and Verify / Delete actions inline. Tenants can only target their own infrastructure. (Enterprise)
  • Datacenters and Green IT configuration -- Configure per-datacenter PUE, electricity price, CO² factor and server specs, then assign clusters, nodes or vDCs to them. Green metrics now reflect the real DC each VM runs on, not a global default.
  • Per-VM Green Score in the inventory header -- 30-day energy, cost and CO² aggregate shown inline next to each VM, with a hover breakdown (CPU average, PUE, score deltas) and one actionable insight (idle CPU, oversized RAM, mostly stopped, efficient DC). (Enterprise)
  • Tenant-scoped reports, alerts, tasks and events -- Every cross-cutting MSP feature now respects tenant boundaries on shared-node clusters. A new vDC-scoped report type is reserved to the super-admin. (Enterprise)
  • Cross-tenant users view -- Provider-side single page listing every user across tenants, with assignments overview and role propagation.
  • White-label login page -- The Login view is now a composable shell, fully covered by the white-label theme (logo, colors, copy, dark scheme). (Enterprise)
  • HA Failback per resource -- Toggle Failback on individual HA resources from the HA tab, with a refreshed UI.
  • LXC network edit -- Full edit dialog with IP, gateway and IPv6 fields. The CT template picker now lists templates from any node hosting the storage, not just the local one.
  • Cross-cluster migration progress -- Real progress reporting for offline cross-cluster moves. External migrations can target a specific VMID, and the VLAN tag is preserved on the migrated NIC.
  • WeasyPrint sidecar for PDFs -- Dedicated container for scheduled report PDF rendering, decoupled from the main app. (Enterprise)

Improved​

  • Settings tab visibility -- Enterprise-only tabs (alerts, LDAP, OIDC, white-label, notifications) are now hidden in Community rather than greyed out, and additionally hidden for vDC tenants since they do not manage tenant-wide infrastructure. Tabs are scrollable on narrow screens.
  • Tenant lifecycle clarity -- "Disabled" tenants are now "Locked" with explicit semantics: login blocked, data preserved.
  • Super-admin scope -- Super-admins are pinned to every tenant by design, removing the "I can no longer see this tenant" trap when leaving the provider tenant.
  • RBAC performance -- Tenant grants are preloaded once per request instead of being looked up N times across scoping helpers, removing a noticeable latency on large fleets.
  • Inventory polish for MSP -- Tenant and cluster icons in the inventory tree, plus bridge and interface labels no longer rendered in monospace.
  • Demo mode aligned with v1.4 -- The hosted demo now seeds the full MSP surface (vDCs, datacenters, PBS, users, RBAC) and locks mutating endpoints behind a 403.

Fixed​

  • Cross-tenant isolation -- Inventory, PBS backups and PVE backup jobs now enforce tenant scope consistently. A tenant with zero vDCs is no longer treated as the provider.
  • Tenant alert visibility -- The async visibility predicate is awaited on every callsite (regression test added).
  • Shared storage visibility -- Shared PVE storages are no longer hidden from tenants who need them.
  • Restored VM placement -- VMs and CTs restored from PBS now land in the tenant's vDC pool instead of the default pool.
  • Tags persistence -- Tag updates use parameterised queries and respect tenant scoping.
  • VxlanTag allocation -- The allocator queries live PVE state instead of trusting only the local database.
  • PBS metadata edge cases -- Millisecond timestamps are stripped before being sent to PVE, and backup IDs parse correctly when the namespace contains slashes.
  • Network inventory polish -- IP usage column, click-to-detail modal, no more flicker on refresh.
  • Provider role bypass closed -- PATCH /users/[id] enforces the provider-only role guard, and the role dropdown is cleared between edits to avoid stale state.

v1.3.5 -- 2026-04-22​

Added​

  • SSH Commands settings tab -- New Settings area showing the SSH command allowlist, connection status and sudoers security recommendations for operators who use SSH-backed orchestration.
  • PBS inventory tabs -- Proxmox Backup Server details now use horizontal tabs for a faster inventory workflow.
  • Advanced VM hardware editing -- USB, PCI, serial, audio and RNG devices can be edited or removed from the hardware view.
  • Alert exclusion patterns -- Alert rules now support an exclude-pattern field to suppress known noisy targets.
  • Improved ESXi Windows migration path -- Windows cold migrations from ESXi Direct can route through virt-v2v for driver injection, with additional guards for EFI, vSAN and custom temporary storage.

Improved​

  • Migration follow-up navigation -- After intra-cluster migrations, the inventory follows the VM on its new node instead of leaving the operator on stale node data.
  • Network flows diagnostics -- The collector-off state is clearer and agent probing is faster.
  • Locale-aware dates -- Date formatting now respects the user locale consistently across the product.

Fixed​

  • UEFI guest boot reliability -- UEFI migrations set pre-enrolled keys on efidisk0 where required.
  • Network flow commands -- OVS commands now route through the SSH execution layer, so sudo settings are applied correctly.
  • Inventory payload typing -- Details payloads now include the moved-to target used after VM relocation.

v1.3.4 -- 2026-04-22​

Added​

  • Site Recovery dashboard -- New pair-by-pair dashboard, protected VM list, per-VM status panel, bandwidth history and console access during failover.
  • Site Recovery scheduler -- RPO and scheduled modes, frequency tabs, timezone autocomplete, cron generation and preview of the next planned executions.
  • Safe Site Recovery job editing -- Protection jobs can be edited with clearer labels, validation and safer edit dialogs.
  • Disk lifecycle actions -- Regular disks are now detached instead of deleted directly, while unused disks can be attached or deleted inline.
  • Display hardware editing -- VGA memory and clipboard settings can be edited from the Display row.
  • NFR visibility -- Not For Resale licenses are shown in the license panel and top bar.
  • Configurable alert thresholds -- Dashboard alert thresholds moved to Settings and are available in Community edition.

Improved​

  • Dashboard thresholds -- Dashboard alerts now use configured thresholds instead of hardcoded 80/90 values.
  • Storage timeout feedback -- NFS content fetches fail faster and return a clearer timeout message.
  • Site Recovery polish -- Added job names, snapshot tabs, bandwidth windows, preflight details, auto-retry badge and delete confirmations.
  • Dependency and security maintenance -- Dependency updates and SonarCloud reliability fixes were included in the release.

Fixed​

  • Cross-cluster migration safety -- Source VM deletion is handled after migration, and CPU host mismatches are blocked before they can break a move.
  • Ceph target imports -- KRBD path formats returned by pvesm path are handled correctly on Ceph targets.
  • Metric server creation -- Metric servers are created through the correct Proxmox endpoint and schema.
  • Inventory and chart warnings -- Health alert drill-down, translated dashboard alerts and UI warnings were cleaned up.

v1.3.3 -- 2026-04-19​

Added​

  • vCenter live migration pipeline -- Live migrations use NFC on snapshot, include VMware Tools status checks and expose snapshot quiesce information.
  • Migration modal safeguards -- Power-state checks, VMware Tools guards and a temporary storage selector were added to the migration UI.
  • SDN cluster tab -- New SDN tab scaffolding with Zones, VNets, Options, IPAM, Firewall and Fabrics sub-tabs.
  • SDN apply workflow -- Pending banners and audit feedback were added to the SDN apply flow.
  • VM creation disk import -- VM creation can now attach an existing disk during the wizard.
  • Options pending-state UI -- VM option edits show pending change indicators and provide a revert action.
  • LDAP group restrictions -- LDAP access can be constrained by group membership.
  • Inventory tree controls -- Locked VMs display a lock icon, and the tree can show VM IDs.
  • Richer XLSX exports -- Inventory exports include vCPU plus allocated and used RAM/disk columns.

Improved​

  • Windows UEFI migration support -- Windows UEFI guests are handled through virt-v2v with OVMF, EFI disk and VirtIO fallback handling.
  • Bulk migration reliability -- Multi-disk and bulk vCenter migrations use a harder pipeline with sequential handling and adaptive UI.
  • VNC resiliency -- noVNC auto-reconnects with exponential backoff.
  • Hardware editing UX -- CPU, socket and memory inputs can be cleared, and the RAM slider supports smaller steps.

Fixed​

  • Cross-cluster VM unlock -- Source VMs are unlocked after successful cross-cluster migration.
  • Storage sharing detection -- Shared storage detection is now type-aware.
  • SSH diagnostics -- Non-zero SSH commands preserve stdout for troubleshooting and respect configured timeouts.
  • Production build issues -- Latent TypeScript errors that blocked builds were resolved.

v1.3.2 -- 2026-04-14​

Fixed​

  • ESXi vSAN migrations -- ESXi disk transfer now supports VMs stored on vSAN datastores, improving migrations from VMware environments where disk paths do not behave like classic datastores.

v1.3.1 -- 2026-04-11​

Added​

  • Alert silencing -- Alerts can be muted and unmuted with a duration, with translated UI labels and backend silence records.
  • Alert purge action -- Old alerts and silences can be purged from the orchestrator through the alert UI.
  • Rolling update timeout warning -- Rolling updates now warn more clearly about reboot timeouts and allow a longer maximum timeout.

Improved​

  • Alert state handling -- Muted alerts are separated from deleted alerts, hidden from active counts, and visible when using the silenced filter.
  • Dashboard tab order -- Dashboard tab drag-and-drop order persists across reloads.
  • Inventory maintainability -- Large inventory components were split into focused context menu, dialog, external hypervisor, storage and tree item modules.

Fixed​

  • Failover reliability -- Cluster failover is more robust when nodes are down, with lower thresholds and timeout-aware failure counting.
  • Cross-cluster migration cleanup -- Migrations track the Proxmox task ID, unlock the source VM and delete it when the delete-source option is enabled.
  • Alert deletion and deduplication -- Alert delete, resolve, silence and deduplication flows now target the correct endpoints and keep the expected visible state.
  • Cross-node VNC routing -- Console routing was restored after a node-IP routing regression.
  • Docker database migrations -- Missing alert and sort-order tables/columns were added to Docker migration scripts.

v1.3.0 -- 2026-04-08​

Added​

  • Failover node discovery -- Node IPs are discovered when a connection is created and refreshed every five minutes by the inventory poller.
  • Failover thresholds -- Failover logic now separates hard failures from timeouts and supports a configurable failure threshold.

Improved​

  • Migration storage selection -- Operators can choose storage for all migrated VMs, with a clearer migration UI.
  • XCP-ng migration handling -- XO downloads send the required accept header, keep snapshots when downloads fail and detect empty VHD downloads early.
  • Taskbar usability -- The target column is wider and supports the column menu.
  • Inventory state -- Expand-all state persists across page reloads.
  • Upload reliability -- Upload handling uses safer error boundaries and smaller chunks.

Fixed​

  • RBAC role display -- Custom role names display correctly in OIDC, LDAP and user screens, and global-scope assignments can be changed.
  • Console routing -- noVNC connects to the VM's actual node IP instead of the connection base URL.
  • Disk format choices -- Disk format options are filtered according to the selected target storage type.
  • Migration task responses -- XO task path responses and local disk flags are handled correctly.

v1.2.5 -- 2026-04-05​

Added​

  • Datacenter settings tab -- Datacenter-level settings now expose tag style, general options, replication settings and network interface selectors.
  • Metric Server and Notifications tabs -- These tabs are available for datacenters and standalone nodes.
  • Proxmox tag rendering -- Inventory tree items display Proxmox tag shapes and colors from datacenter.cfg.

Improved​

  • Settings modularity -- Datacenter settings were split into smaller components and completed with missing Proxmox fields.
  • Notification target resolution -- Notification APIs now return actual endpoints instead of only target types.
  • Toast system -- MUI Snackbar/Alert toasts were replaced with the product's custom notification implementation.

Fixed​

  • SSH node resolution -- SSH no longer falls back to the load balancer address when the app runs behind a proxy.
  • Inventory scrolling -- Removed an unwanted global scroll on the inventory page.
  • Tag edits -- Tag updates now sync correctly after edits.

v1.2.4 -- 2026-04-05​

Added​

  • LXC hardware editing -- LXC containers now support swap editing and clearer disk display.
  • AI settings disclosure -- The AI settings page includes a data-disclosure notice so operators understand what can be sent to an AI provider.
  • Automatic release publishing -- Version tags now create GitHub releases with generated changelog content.

Improved​

  • Rolling update polling -- Polling frequency is reduced while idle to lower background load.

Fixed​

  • LXC type coverage -- Swap and mountpoint fields were added to TypeScript types.
  • AI assistant toggle -- Disabled assistant state now persists correctly in Settings.

v1.2.3 -- 2026-04-03​

Fixed​

  • Managed host cleanup -- Settings now automatically remove stale managed host entries when nodes are removed from a Proxmox cluster.

v1.2.2 -- 2026-04-03​

Added​

  • Dashboard time range picker -- A global 1h / 6h / 24h / 7d / 30d range selector drives all chart widgets.
  • Collapsible dashboard sections -- Section headers now use Grafana-style separators and can collapse groups of widgets.
  • Free widget resizing -- Dashboard widgets can be resized freely instead of being constrained by fixed maximum sizes.

Improved​

  • Dashboard widgets -- PBS Overview, Ceph Status, DRS Status, Guest Heatmap, Infra Global Chart, Backup Calendar and KPI cards were refreshed.
  • Theme consistency -- Widget colors, tooltips and date displays now adapt better across light and dark themes.
  • Layout cleanup -- Deleted widget types are cleaned from saved layouts, and default layouts/presets were updated.
  • Internationalization -- Missing dashboard keys were added for English, French, German and Chinese.

Fixed​

  • Build stability -- A duplicate fontSize property that caused build failures was removed.
  • Static analysis issues -- SonarCloud findings around sort comparison and redundant ternaries were resolved.

v1.2.1 -- 2026-03-30​

Added​

  • Near-zero downtime migration mode -- ESXi and XCP-ng migrations gained SSHFS transfer and SSHFS Boot flows, with fallback to cold migration where needed.
  • Backup job dialog refresh -- Backup job creation was overhauled and integrated with HA resource management.
  • HA resource names -- HA resource tables now include a Name column.

Improved​

  • Migration hardware detection -- ESXi SOAP XML parsing now detects disk controller types such as SCSI, SATA and IDE.
  • vSAN handling -- VMware vSAN datastore support was improved for migration scenarios.
  • Inventory list scrolling -- VM, Pool, Tag and Node list views scroll correctly again.
  • Performance -- Polling, RRD field handling and inventory tree re-renders were optimized.

Fixed​

  • PBS restore modal -- Restoring from a PBS datastore view works correctly.
  • Disk wear display -- Storage details show disk wear percentage instead of remaining life.
  • Cluster selection typing -- TypeScript narrowing issues around cluster selection were fixed.
  • Backup schedule type errors -- Autocomplete typing for backup schedule options was corrected.

v1.1.0 -- 2026-03-19​

Added​

  • German language support -- Full German translation for the dashboard interface
  • Multi-Tenancy -- Tenant management in Settings with super_admin gating and per-tenant data isolation
  • Dashboard interactive widgets -- Clickable dashboard widgets for quick navigation
  • Template panel -- New template management panel in the inventory view
  • OS type labels -- Display OS type labels on VM inventory items

Improved​

  • Migration vSAN support -- Improved handling of VMs on VMware vSAN datastores
  • Migration SSH fixes -- Fixed SSH orchestrator silent failures and unreliable qm set commands replaced with PVE REST API
  • Migration NFS storage -- Fixed fallback volume naming for NFS/directory storage imports
  • Reports -- Fixed vCPU counts, percentage calculations, white-label branding in PDFs, and tenant scoping
  • Security -- Resolved CodeQL findings and improved code quality

Fixed​

  • Migration EFI VMs -- Correct handling of EFI disk allocation where data disk becomes disk-1
  • Migration disk volume parsing -- Fallback to reading VM config via PVE API when regex parsing fails
  • Report tenant scoping -- Reports now respect tenant boundaries for multi-tenant deployments

v1.0.0 -- 2025-06-01​

Initial release of ProxCenter.

Added​

  • Unified Inventory -- Centralized tree view of all Proxmox nodes, VMs, containers, and storage pools with split-pane layout and multiple view modes (Tree, Hosts, Pools, Tags)
  • Real-Time Monitoring -- Live dashboards with CPU, memory, storage, and network metrics for nodes and guests
  • Connection Management -- Support for Proxmox VE and Proxmox Backup Server connections with API token and username/password authentication
  • Backup Management -- Centralized view of backup jobs, schedules, and restore points across all connected PBS instances
  • Event Log -- Aggregated event stream from all connected Proxmox hosts with filtering and search
  • User Management -- Invite users via email, assign roles, manage accounts
  • System Roles -- Built-in Admin, Operator, and Viewer roles with predefined permissions
  • Audit Log -- Comprehensive action trail for all user activity with filtering, search, and export
  • DRS (Distributed Resource Scheduling) -- Automatic VM load balancing across cluster nodes (Enterprise)
  • Site Recovery -- Disaster recovery planning with automated failover configuration (Enterprise)
  • Network Security -- Firewall rule management and network security policies (Enterprise)
  • Custom RBAC -- Role creation with granular permissions and scoped access control (Enterprise)
  • Scheduled Jobs -- Recurring task automation for backups, snapshots, and maintenance (Enterprise)
  • Infrastructure Reports -- Scheduled reports with PDF/CSV export (Enterprise)
  • Alerts & Notifications -- Threshold-based alerting with email and webhook delivery (Enterprise)
  • LDAP Integration -- LDAP / Active Directory authentication support (Enterprise)
  • CVE Scanner -- Vulnerability detection for Proxmox hosts (Enterprise)
  • License Management -- License-based feature gating with Community and Enterprise editions
  • Multi-Tenancy -- Tenant isolation for multi-client and multi-team environments (Enterprise)
  • White-Label Branding -- Custom logo, colors, and branding for the ProxCenter interface (Enterprise)
  • Templates & Cloud Images -- VM template management and cloud image deployment (Enterprise)
  • Rolling Updates -- Orchestrated node updates with automatic VM evacuation (Enterprise)
  • VMware / XCP-ng Migration -- Automated migration pipelines from ESXi and XCP-ng to Proxmox (Enterprise)
  • AI Insights -- AI-powered infrastructure analysis and recommendations (Enterprise)
  • OIDC / SSO -- OpenID Connect and single sign-on authentication (Enterprise)
  • Compliance -- Security hardening compliance checks (Enterprise)
  • Change Tracking -- Configuration change detection and diff view (Enterprise)
  • Self-Hosted Deployment -- Docker-based deployment with SQLite backend