Repository navigation
PegaProx 1.4.1 is a security and fix release on top of 1.4.0. It ships a patched Brotli decoder and Pillow, makes IPv6 work across SSH, HA and PBS, keeps the history pages fast at 3,000 and 10,000 guests, and adds an OVA appliance for ESXi.
Updating is recommended for every install. The in-app update and update.sh pull the new library versions by themselves. Docker users get them with the new image; Debian and appliance users also run apt update && apt upgrade, which brings Debian's own Brotli fix (DSA-6582-1).
🔒 Security
- Brotli 1.2.1 or newer is required. The decoder before it has an out-of-bounds write (CVE-2026-111497). PegaProx decodes Brotli in the replies of the systems it talks to (Proxmox VE, PBS, ESXi, the IdP, webhook targets), so a malicious or impersonated peer could reach it. The PegaProx web interface itself never decodes Brotli from a browser.
- Pillow 13.0 on Python 3.11 and newer closes a heap overflow in its FlashPix decoder. Python 3.10 keeps Pillow 12.3.0, the last release built for it.
- Open alerts and their mutes show a node's incidents (ZFS pools and their devices, OSDs, clock, QDevice, node tasks) only to callers with
node.view, as the node pages do. - The CSRF origin check accepts a bracketed IPv6 host, and only one (#1155).
🌐 IPv6
- Nodes are reached over SSH at their plain IPv6 address, and PegaProx's HA group works out node addresses, quorum and the gateway check on IPv6 (#1158).
- An IPv6 PBS gets its URL brackets, also through the port 80 redirect (#1158).
- The VM appliance no longer stops at the theme picker when it is opened over IPv6 (#1155).
⚡ History pages at scale
- The metrics history is stored per cluster in parts. Reports, insights, right-sizing, costs, power and the node and guest charts read only what they show.
- At 3,000 guests over 30 days the slowest history page went from 16 s to 1.9 s, the largest request from 2.5 GB to 86 MB of memory, and the database grows by about 7.5 MB a day instead of 98 MB. At 10,000 guests over 7 days the slowest page went from 33 s to 8.5 s.
- History written by 1.4.0 and older is converted in the background after the update, newest first, with the same results to the bit.
- Resolved and superseded drift events are pruned after a year.
🐛 Fixes
- A live migration hands the guest's conntrack state over when both nodes support it, as Proxmox's own dialog does (#1172).
- Restore tests put a container back on the storages its backup names, and a subvolume without a size limit back on its own pool (#1168).
- The Hosts view of a node shows a failed read with a retry instead of an empty list (#1164).
- A support bundle no longer stalls on a long token in the logs.
- ESXi migrations keep the TPM state, use a guessed volume path only where the node has it, and refuse a folder copy that would leave a disk out or copy an old state of it.
- A host PegaProx cannot place is not dialled at another host's address, and the agent address probe closes its socket.
🌍 Translations
- The ESXi migrations and events panels in all nine languages, Polish terminology throughout, and the migration phase tooltips.
📦 Images
- OVA appliance for ESXi next to the qcow2 image.
- The qemu guest agent is in the VM image, so Proxmox VE shows the appliance's address once the guest agent option is on (#1180).
- The Docker image is also on Docker Hub as
docker.io/pegaprox/pegaprox. - Release images carry a signed build provenance; the README shows how to check it.
⚠️ Behaviour changes
- History format: a downgrade to 1.4.0 or older shows only the history written after the downgrade. Nothing is deleted, and the next update reads and converts all of it again. Details:
docs/history-retention.md. - Drift events: resolved and superseded ones are deleted after 365 days (
PEGAPROX_DRIFT_EVENT_RETENTION_DAYS) and beyond 200,000 per cluster (PEGAPROX_DRIFT_EVENT_CAP). Open and acknowledged events and those linked to an incident or a change are always kept. - Coming from 1.3.x: the behaviour changes of 1.4.0 apply as well, first among them that 100.64.0.0/10 (CGNAT, tailnets) is refused wherever private addresses are refused. See Upgrading to 1.4.
🧭 Known issues
- Snapshot-Iterative (zero downtime) ESXi migration is still experimental. Use Live Clone or Live Mirror for guests whose data matters.
- Automatic failover for PegaProx itself is a beta. Try it in your setup before relying on it; manual failover stays one switch away.
- Change plans are an optional record without an approval gate.
✅ Quality
The automated suite runs more than 13,900 tests on every change. The update from 1.4.0 was tested against a seeded database with 3,000 guests, also while the history was being converted, and against a copy of a real 30-day history: every history route answered byte for byte as 1.4.0 did.
Thank you to everyone who filed, fixed, translated and sponsored along the way. 💚
Thanks in particular to @mdobprv-lab, @omrzk, @hvisage, @nvaert1986, @m4nifest0-tech, @bgatestmg and @gyptazy, who filed, fixed or translated the issues in this release.
💛 Sponsors
PegaProx is AGPL-3.0 and built in the open. Huge thanks to our Platinum sponsors who keep it moving:
💎 Platinum
Sponsor PegaProx: opencollective.com/pegaprox | pegaprox.com/#sponsor
