ProxmoxVE/.github/changelogs/2026/10.md

2026-10-24

🚀 Updated Scripts

• 🐞 Bug Fixes

  • patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. @rhclayto (#18074)
  • fix: Linkwarden - clear Yarn berry cache after install and update- #18115 @bferd (#18116)
  • Borg-UI: recreate the borg venvs with --clear @MickLesk (#18118)
  • SnapOtter: recreate the AI venv with --clear @MickLesk (#18119)
  • Update authentik version to 2026.8.5 @thieneret (#18125)

• ✨ New Features

  • Frigate: bump to v0.18.2 @MickLesk (#18120)

• 🔧 Refactor

  • install: answer every prompt from the environment, survive a closed stdin @MickLesk (#18121)

🧰 Tools

• 🐞 Bug Fixes

  • fix(addons): use catch_errors so the update marker is cleared @mazelado (#18128)

2026-10-23

🚀 Updated Scripts

• postgresql: default the version prompt and match Alpine's packages @MickLesk (#18093)

• Storyteller: build the runtime like upstream's Dockerfile @MickLesk (#18083)

  • 🐞 Bug Fixes

    • proxcenter: skip the type check and lower the build heap @MickLesk (#18090)
    • hermesagent: retry the installer download, fall back to GitHub @MickLesk (#18091)
    • zabbix: use the arm64 repository for 7.0 @MickLesk (#18089)
    • kasm: survive a failed release lookup and answer the installer with flags @MickLesk (#18092)

  • ✨ New Features

    • InvoiceShelf: run the Laravel scheduler @MickLesk (#18079)

  • 🔧 Refactor

    • podman-homeassistant: require Debian 13 @MickLesk (#18095)
    • apache-guacamole: require Debian 13 @MickLesk (#18094)
    • unifi-os-server: require Debian 13 @MickLesk (#18096)
    • openwebui: drop the Intel oneAPI Base Toolkit @MickLesk (#18098)
    • ollama: drop the Intel oneAPI Base Toolkit @MickLesk (#18097)
    • tdarr: do not let a failed or slow updater block the service start @MickLesk (#18100)
    • immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt @MickLesk (#18099)
    • Refactor: pimox-haos-vm @MickLesk (#18077)

💾 Core

• Telemetry: explain and categorize by the command that failed @MickLesk (core#166)
• error-handler: report a handled silent failure only on its own line @MickLesk (core#165)
• VM silent: return the failure instead of exiting @MickLesk (core#164)
• error-handler: keep the start explanation and the final IP lookup from failing the run @MickLesk (core#163)
• error output: report a failure inside a subshell once @MickLesk (core#162)
• general: allow Composer as root in every script @MickLesk (core#161)
• lxc-updater: skip the resource check when the container cannot read its RAM @MickLesk (core#160)
• vm-core: let vm_timezone_default survive a host without /etc/timezone @MickLesk (core#159)

2026-10-22

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Zabbix: keep unattended updates on the installed series @florianpunz (#18051)

• 🔧 Refactor

  • Refactor: Cryptpad @MickLesk (#18065)

💾 Core

• Incus: drive a remote Incus server from the client's default remote @MickLesk (core#154)
• Deploy the release again when an update is redone @MickLesk (core#158)

❔ Uncategorized

• chore(ct): sync sparkyfitness defaults with PocketBase @github-actions[bot] (#18061)

2026-10-21

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Immich: bump release version to v3.3.5 (CVE) @CerberusStyle (#18057)
  • DroppedNeedle: pass release version to the app via COMMIT_TAG @MickLesk (#18042)

💾 Core

• Keep the version an update started from across a redo @MickLesk (core#156)
• Redo an update whose run did not finish after the deploy @MickLesk (core#155)

2026-10-20

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Plane: give Silo its own HOME @MickLesk (#18028)
  • Immich: Pin version to 3.3.4 @vhsdream (#18036)
  • InvenTree: run apt under systemd so postinst can finish @MickLesk (#18029)
  • Profilarr: pass the deno pin as the version @MickLesk (#18025)
  • Silo: keep the version file out of ~/.silo @MickLesk (#18030)
  • InvenTree: move to go.packager.io @MickLesk (#18015)
  • Zitadel: run init and setup in the foreground @MickLesk (#18016)

• ✨ New Features

  • Zitadel: Support v1 and v2 Login @MickLesk (#18031)

• 🔧 Refactor

  • Refactor: OpenWebUI (remove numba pin) @MickLesk (#18026)

💾 Core

• Only treat an NVIDIA GPU as present when its device nodes are @MickLesk (core#153)

2026-10-19

🆕 New Scripts

• Calagopus (#18012)
• Netronome (#18011)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • immich: record library revisions when the line is missing @mazelado (#17990)
  • Update authentik 2026.8.4 @thieneret (#18004)

• ✨ New Features

  • feat(mealie): add reverse proxy auth settings to mealie.env @bferd (#18006)

2026-10-18

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Donetick: create selfhosted.yaml from the example @MickLesk (#17992)
  • Wiki.js: only back up db.sqlite on SQLite installs @MickLesk (#17993)
  • FlareSolverr: pass Chrome an en-US Accept-Language @MickLesk (#17995)
  • 2FAuth: install the locked dependencies @MickLesk (#17996)
  • Tracearr: drop the pnpm store after the update build @gioxx (#17869)
  • vaultwarden: build before stopping the service @mazelado (#17983)

• 💥 Breaking Changes

  • fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) @CrazyWolf13 (#17978)

💾 Core

• Let get_current_ip reach its IPv6 fallback @MickLesk (core#151)
• Drop apt autoclean before apt clean @MickLesk (core#152)
• Silence apt's script warning in $STD @MickLesk (core#150)

2026-10-17

🆕 New Scripts

• ProxCenter (#17961)
• Listenarr (#17963)
• Youtarr (#17962)
• Norish (#17964)

🚀 Updated Scripts

• 🔧 Refactor

  • Sonarr: stay on the newest v4 (pin) @MickLesk (#17958)

2026-10-16

🆕 New Scripts

• Downtify (#17959)
• openGym (#17960)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Pelican Panel: pass the URL to p:environment:setup @MickLesk (#17948)
  • OneDev: use the onedev.server unit of 16.9 @MickLesk (#17949)
  • ReadMeABook: start the scheduler with the service @MickLesk (#17950)

💾 Core

• Clean up after installs and updates again @MickLesk (core#147)
• Fix apt_conffile_report exiting 1 when uutils comm sees locale-sorted input @BadFlo (core#146)

2026-10-15

🚀 Updated Scripts

• 🐞 Bug Fixes

  • fix(apprise-api): copy static assets into the served directory @brokentokin (#17940)
  • Bytestash: modify backup process | Update Resources @MickLesk (#17935)
  • Zabbix: Add '-y' flag to apt install commands @MickLesk (#17933)
  • karakeep: bump Node.js from 22 to 24 @github-actions[bot] (#17087)

💾 Core

• Keep VM release lookups working without system.func @MickLesk (core#144)
• Stop calling exit 1 "Operation not permitted" at several steps @MickLesk (core#140)

2026-10-14

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Paperclip: fall back to a non-frozen install when the release lockfile is stale @MickLesk (#17922)

• 🔧 Refactor

  • Immich: rebuild the image libraries when the revision record is missing @MickLesk (#17919)

💾 Core

• Show what the failing command printed, and keep verbose output in the log @MickLesk (core#139)
• Install jq before the release lookup and show what a non-JSON answer was @MickLesk (core#138)
• Refresh the NodeSource key before a same-major Node.js update @MickLesk (core#137)
• github: say why a forge could not be reached instead of 'connection failed' @MickLesk (core#136)

2026-10-13

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Fix URL for downloading OneDev latest release @ryansully (#17915)
  • LocalAI: pin the CPU backends when the container has no GPU runtime @MickLesk (#17909)
  • [Gluetun] Update GitHub repository source install and update. @CerberusStyle (#17899)
  • Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update @MickLesk (#17894)
  • WikiJS: use v2 Repo until v3 is stable @MickLesk (#17895)

• 💥 Breaking Changes

  • zammad: Debian 13, new apt repo, Elasticsearch 8 @durzo (#17836)

💾 Core

• Keep the version key parseable by jq 1.6 @MickLesk (core#134)

2026-10-12

🆕 New Scripts

• WatchState (#17881)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • chore(ct): sync wazuh defaults with PocketBase @github-actions[bot] (#17889)
  • Wanderer: bring back the wanderer-pb wrapper @MickLesk (#17874)
  • Tracearr: install only the server's production dependencies @MickLesk (#17873)
  • Paperless-ngx: QoL restart crashed services | patch regex @MickLesk (#17812)
  • Splunk Enterprise: start the service as the splunk user @rcastley (#17816)

💾 Core

• Draw a Community Scripts banner while a script has no header of its own @MickLesk (core#133)
• Order pre-release labels when comparing versions @MickLesk (core#132)
• gh: curl_download: wait between attempts @MickLesk (core#131)

🧰 Tools

• ✨ New Features

  • Immich Public Proxy: optional visitor upload service (v4 Release) @MickLesk (#17875)

2026-10-11

🆕 New Scripts

• Cinephage (#17852)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Immich: build libvips with JPEG 2000 support @MickLesk (#17864)
  • hermesagent: match the relaunched root gateway regardless of interpreter @MickLesk (#17847)
  • Radicale: install the bcrypt and argon2 extras @MickLesk (#17813)
  • fix(zigbee2mqtt): preserve backup stream and prevent filename collisions @petermnt (#17751)

• ✨ New Features

  • QoL: let var_* answer the optional add-on prompts @MickLesk (#17858)
  • QoL: Confirm third-party installers through confirm_external_installer @MickLesk (#17857)
  • docker: take the lxcfs toggle, TCP socket and Compose choice from app variables @MickLesk (#17850)

• 🔧 Refactor

  • RustDesk Server: run the official server, make the web UI optional @MickLesk (#17854)
  • Caddy: install the .deb from GitHub instead of the Cloudsmith repo @MickLesk (#17862)

💾 Core

• Add confirm_external_installer @MickLesk (core#130)
• setup_docker: make LXC resource limits visible to nested containers @andrebrait (core#9)
• Incus: fix ENABLE_FUSE / TUN vars @MickLesk (core#127)
• Resolve a uv required-version range to the newest release inside it @MickLesk (core#126)
• Upgrade MongoDB in place when an app package depends on it @MickLesk (core#128)

2026-10-10

🆕 New Scripts

• Weblate (#17837)
• CertMate (#17803)
• AnythingLLM (#17802)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • update endurain repo from codeberg to gh @johanngrobe (#17831)
  • Immich: download countryInfo.txt into the geodata directory on update @claytonfaria (#17823)
  • paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom @austinpilz (#17825)

2026-10-09

🆕 New Scripts

• FoldingAtHome (#17799)
• LocalAI (#17801)
• Tvheadend (#17800)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • OpenCloud: fix Collabora embedding with Collabora 26.04.4 @SimKaiLong (#17810)

• 🔧 Refactor

  • Immich: survive an interrupted update and a failing ML build @MickLesk (#17798)

💾 Core

• check_for_release: compare against the release marked as latest @MickLesk (core#125)

🧰 Tools

• ✨ New Features

  • FileBrowser Quantum: migrate the config and database to v2 @MickLesk (#17815)

2026-10-08

🆕 New Scripts

• Unifi-OS-Server VM (#17752)
• ZimaOS VM (#17778)

🚀 Updated Scripts

• Revert "Immich: Pin to v3.3.0" @MickLesk (#17767)

• 🐞 Bug Fixes

  • Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian @MickLesk (#17789)
  • CLIProxyAPI: keep plugins and data across updates @MickLesk (#17790)
  • Kima-Hub: install the Python services into a uv venv @MickLesk (#17791)

• ✨ New Features

  • Immich: Pin to 3.3.0 / Update ML Python to 3.13 @MickLesk (#17770)

• 🔧 Refactor

  • Refactor: OPNsense VM @MickLesk (#17785)
  • Refactor: Nextcloud VM (Turnkey) @MickLesk (#17787)
  • Refactor: OpenWrt VM @MickLesk (#17774)
  • Refactor: Ubuntu VM @MickLesk (#17776)

💾 Core

• Tolerate a missing datacenter.cfg in vm_keyboard_default @MickLesk (core#124)
• Take the ISO storage from the disk pool when it can hold ISOs @MickLesk (core#122)
• Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC @MickLesk (core#117)
• tools: forge truncated release list @MickLesk (core#118)
• Remember a kept cached image until the upstream changes @MickLesk (core#119)
• Choose the VM keyboard layout and carry the host's timezone into prepared images @MickLesk (core#120)
• VM's: run first-boot units without debconf dialogs @MickLesk (core#121)

2026-10-07

🆕 New Scripts

• Fedora VM (#17747)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • AudioMuse-AI: replace the venv on update without asking @MickLesk (#17738)
  • paperclip: run as a dedicated non-root user so Claude Code can skip permissions @samvandenbossche (#17707)
  • Thingsboard: update Java version from 17 to 25 @CerberusStyle (#17733)

• ✨ New Features

  • Immich: Pin to v3.3.0 @vhsdream (#17759)

• 💥 Breaking Changes

  • OpenCloud: bump to v8.1.0, rebuild search index on upgrade @SimKaiLong (#17710)

• 🔧 Refactor

  • Pangolin: Unpin Release, stable enough, Bump to latest @MickLesk (#17740)
  • Refactor: Archlinux-VM @MickLesk (#17741)
  • Refactor: MikroTik RouterOS @MickLesk (#17748)

💾 Core

• Fix Fedora and BLS cloud image console setup @MickLesk (core#116)
• Keep setup_nodejs alive when the caller's directory is gone @MickLesk (core#114)

2026-10-06

🆕 New Scripts

• Pricebuddy (#17708)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • Webtrees: stop serving data/ and the source folders directly @MickLesk (#17724)

💾 Core

• Incus: check the architecture on Incus hosts too @MickLesk (core#113)
• Incus: Pass the app's var_* settings into Incus containers @MickLesk (core#112)
• Incus: stub storage_content_check on Incus @MickLesk (core#104)
• Incus: map Proxmox template versions to Incus image names @MickLesk (core#111)
• Incus: read storage names from .vars files @MickLesk (core#110)
• Incus: show the spinner inside containers again @MickLesk (core#109)
• Incus: set the hostname with sh, so it works before bash is installed @MickLesk (core#102)
• Incus: reserve a plain address on Incus, leave the gateway to the network @MickLesk (core#101)
• Incus: Wait for the network on Alpine OS too @MickLesk (core#105)
• Incus: do not fail the build when hostname -I is missing @MickLesk (core#103)
• Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it @MickLesk (core#108)
• Incus: accept mode=generated @MickLesk (core#106)
• Incus: pass the full install environment into Incus containers (quoted) @MickLesk (core#107)

2026-10-05

🚀 Updated Scripts

• Point to DevScripts, the renamed ProxmoxVED @MickLesk (#17694)

• 🐞 Bug Fixes

  • wanderer: set the proxy secret and install plugins in their own directories @MickLesk (#17698)
  • discourse: serve stylesheets and repair the update @MickLesk (#17697)
  • wikijs: bump Node.js from 24 to 26 @github-actions[bot] (#17689)
  • jotty: bump Node.js from 22 to 24 @github-actions[bot] (#17688)

💾 Core

• Read releases from github.com when the API is rate limited, resume stalled downloads @MickLesk (core#99)
• Check for template and container storage before the settings menu @MickLesk (core#98)
• Check /etc/pve before the settings menu @MickLesk (core#97)
• Check container settings before pct create rejects them @MickLesk (core#96)
• PVE: Smart Diagnosis - say why a container would not start @MickLesk (core#95)
• Retry template downloads that pveam reports as done but are not @MickLesk (core#94)
• Check the OS release against pve-container before creating anything @MickLesk (core#93)
• Rename "ProxmoxVED"-Links to "DevScripts" @MickLesk (core#91)

🧰 Tools

• 🐞 Bug Fixes

  • monitor-all: read container IPs from the host side @jasonobrien (#17686)

2026-10-04

🚀 Updated Scripts

• 🐞 Bug Fixes

  • immich: read the Intel runtime from the pinned release @MickLesk (#17677)

💾 Core

• better explain unsupported version & upgrade path for pve @MickLesk (core#86)
• Quote PostgreSQL identifiers and drop spaces from the creds file name @MickLesk (core#89)
• Find the default Rust toolchain in current rustup output @MickLesk (core#88)

2026-10-03

🆕 New Scripts

• Keeper.sh (#17659)

🚀 Updated Scripts

• 🐞 Bug Fixes

  • hermesagent: download the installer before running it @MickLesk (#17666)
  • frigate: raise the Node heap for the web build @MickLesk (#17667)
  • Tracearr: workaround for failing map tiles download and data preservation @durzo (#17661)
  • fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth @PsycoStea (#17653)

• 🔧 Refactor

  • Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP @MickLesk (#17655)

💾 Core

• detect_repo_source: read the license header and fall back to ProxmoxVE @MickLesk (core#85)

2026-10-02

🚀 Updated Scripts

• 🐞 Bug Fixes

  • zerobyte: upgrade Bun on update @MickLesk (#17646)
  • sure: keep Active Storage uploads across updates @MickLesk (#17648)
  • twenty: run upstreams upgrade command instead of the removed setup-db.ts @MickLesk (#17647)

• 🔧 Refactor

  • NPM: Refactor / Fix npm openresty user and certbot version @MickLesk (#17649)
  • several scripts: use the release helpers instead of hand-rolled version checks and downloads @MickLesk (#17625)

💾 Core

• QoL: message blocks, clean-install keep list, password helper, network limits @MickLesk (core#61)

2026-10-01

🚀 Updated Scripts

• 🐞 Bug Fixes

  • romm: keep the asset links in sync with ROMM_BASE_PATH @MickLesk (#17610)
  • teslamate: build from the elixir directory since 4.3.0 @MickLesk (#17612)

• ✨ New Features

  • feat(glance): add alpine os @skilletfun (#17605)
  • feat(blocky): add alpine os @skilletfun (#17637)

• 🔧 Refactor

  • several scripts: apt instead of apt-get, cleanup_lxc, nginx_enable_site, drop needless daemon-reloads @MickLesk (#17624)
  • several scripts: use setup_postgresql_db / setup_mariadb_db instead of hand-written SQL @MickLesk (#17622)

💾 Core

• Offer to raise the kernel key limits instead of only naming them @MickLesk (core#81)

🧰 Tools

• 🔧 Refactor

  • tools, turnkey: load core instead of the legacy misc functions @MickLesk (#17621)

📚 Documentation

• chore: drop the local header generation; headers come from core @MickLesk (#17623)