v2.5.1

What's fixed

Patch release on top of 2.5.0 — security hardening and operator docs (no feature changes).

• Safer API / health error responses (no Flask debug by default; short controlled messages)
• Log sanitization for CodeQL py/log-injection findings
• Docker image pip bump to clear image CVEs (Trivy)
• Document required Proxmox API privileges in docs/INSTALL.md
• CodeQL / security CI polish (query filters, Trivy Action pin)

Code scanning: open alerts cleared on main after this series.

Verify artifacts

sha256sum -c SHA256SUMS

Full changelog

v2.5.0...v2.5.1

Not an official Proxmox product — community support via GitHub issues.

v2.5.0

What's new

• Customization Specs — reusable presets (admin password never stored)
• Timezone / locale / workgroup controls
• Optional IPv6 (opt-in) and multi-NIC on single deploys (not bulk)
• Lifecycle tags on PVE VMs (lifecycle-* / failed-customization)
• Specs apply on bulk shared settings via spec_id
• Security assurance: CodeQL, Bandit, pip-audit, gitleaks, Trivy, Dependabot; release includes SHA256SUMS + CycloneDX SBOM

Verify artifacts

sha256sum -c SHA256SUMS

Full changelog

See commits since 2.4.0 on main, or GitHub's auto-generated notes below / in the compare view.

Not an official Proxmox product — community support via GitHub issues.