v3.2.100 — Linux client installer fixed on Debian 12/13

First release since v3.2.92. Auto-updating installs have been pinned to 3.2.92 because 3.2.93–3.2.99 were committed but never released — this tag delivers all of that work at once.

Headline: Linux client installer works on Debian (#19)

The Linux installer St0r generated was broken end to end on Debian 12/13:

• apt-key add was removed in Debian 12 — with set -e the script aborted on the first install step
• lsb_release -sc isn't installed by default on Debian, so the codename came out empty
• the apt repository it configured has no packages for bookworm/trixie
• config was written to /etc/default/urbackupclient using keys the UrBackup client never reads (INTERNET_SERVER/COMPUTERNAME/AUTHKEY) instead of internet_server/internet_authkey/computername in settings.cfg
• it used port 55414 (the web UI port) rather than 55415 for internet clients, and never enabled internet mode

It could not install, and could not have connected if it had.

The Linux download now serves the same pre-configured self-extracting installer the UrBackup web UI hands out, with the client's name, server address, internet port and auth key already baked in. It ships prebuilt binaries and needs no apt repository, so it is distribution-independent. Run it with sudo sh urbackup-client-<name>.sh.

Also in this release: Windows and Linux installers share one code path; requesting an installer for a client id that doesn't exist now returns a clear error instead of a generic installer carrying the global auth key and no client name (it would install but never register as the intended client); and installer download failures surface in the page instead of being silently saved as a broken .sh.

Storage protection (3.2.97–3.2.99, #18)

• A disk guard watches free space on the backup volume every 10 minutes and escalates — warn at 75%, alert at 85%, and at 93% it pauses new file and image backups so the volume cannot fill. UrBackup's nightly cleanup reclaims space and backups resume automatically below 70%.
• Retention floors could exceed their ceilings (min_file_incr=40 against a max of 20), silently stopping UrBackup from pruning old backups. Floors are realigned and the server now rejects any settings save where a min_* is not below its max_*.
• Settings gains a Storage Protection tab with live usage, guard event history, and admin actions to reclaim space or prune orphaned files.
• Retention floors are now editable in Backup Defaults, and the no_images toggle is correctly labelled as disabling image backups rather than "Headless Mode".

Restore visibility (3.2.98, #17)

Restore activities were missing from the Activities page entirely — UrBackup records restores in its own table, which St0r never read. File and image restores now appear alongside backups with a Restores filter, restore badges, and the restored path on hover.

Backup status and settings fixes (3.2.94–3.2.96)

• Backup triggers now report the real reason when the UrBackup API login fails instead of a generic "unable to login" (#16), and login no longer caches an unauthenticated salt session that made start_backup fail silently.
• Clients with file or image backups disabled show Disabled instead of Failed, and no longer count as needing attention (#14). St0r reads UrBackup's authoritative file_disabled/image_disabled flags.
• Email & Alerts settings now persist — mail settings are saved via UrBackup's mail endpoint rather than the general endpoint that silently dropped them (#13).

Security (3.2.93, 3.2.96)

• All npm audit findings resolved across backend and frontend — critical node-tar, high undici/form-data/nodemailer, moderate react-router; axios upgraded to 1.15.x clearing 15 CVEs including SSRF, prototype pollution and header injection; bcrypt, sqlite3 and nodemailer upgraded to clear high-severity advisories.
• Database-backup endpoints now require admin, closing a privilege-escalation path via crafted SQL dump upload.
• The JWT is no longer returned in the login response body — it lives only in the HttpOnly cookie.
• \r\n is sanitized in .env writes, preventing JWT_SECRET overwrite via Settings.
• GET /api/users and PUT /api/client-settings/:id now require admin.
• Debian 13 Trixie compatibility — removed the software-properties-common dependency (#10).

Upgrading

Auto-updating installs will pick this up on their next check. To update manually:

sudo /opt/urbackup-gui/auto-update.sh