proxmox-sdk v0.0.13
A correctness, robustness, and security hardening release — including community contributions that fix Proxmox password/ticket authentication and add caller-supplied session support.
Highlights
- Password/ticket authentication fixes — the ticket endpoint is now built under the service API prefix (
/api2/json/access/ticket, reverse-proxy aware) and thePVEAuthCookieis sent unquoted, souser@realm+ password auth works against real Proxmox nodes. Previously it failed with aJSONDecodeErrorand then 401. Thanks @nanomad! - Bring-your-own
aiohttpsession — passsession=toProxmoxSDK/HttpsBackendto reuse your own connection pool, timeouts, tracing, or proxy. The SDK reuses it verbatim and never closes it (it also handles the ticket-cookie quoting for external cookie jars). Thanks @CoMPaTech! - Review hardening — config CLI commands (
config-add/-remove/-set-default/-list/-show) now load existing config before operating, fixing silent profile loss and empty list/show;batchuses the configured default profile; download checksum auto-discovery blocks SSRF probes to loopback/private/link-local/metadata hosts; typedAuthenticationErroron non-JSON auth responses; negative-retry validation and a cross-event-loopclose()leak fix; idempotent synchronousclose(). - Also includes opt-in OpenTelemetry tracing and Proxmox Datacenter Manager (PDM) API codegen support merged since 0.0.12.
Pull requests in this release
- #112 — Make Proxmox password/ticket auth work (API prefix + unquoted cookie) — @nanomad
- #113 — Allow a caller-supplied aiohttp session — @CoMPaTech
- #114 — Harden config CLI, auth, downloads, and backend lifecycle — @emersonfelipesp
- #115 — Version bump to 0.0.13rc1 (release candidate) — @emersonfelipesp
- #116 — Version bump to 0.0.13 (final) — @emersonfelipesp
Thanks to our contributors 🙏
Special thanks to @nanomad (Giovanni Condello) and @CoMPaTech (Tom Scholten) for reporting, independently reproducing, reviewing, and fixing the authentication and session issues that make this release possible.
Published to PyPI and Docker Hub (raw, nginx, granian, and per-service mock images).
Contributors
nanomad, CoMPaTech, and emersonfelipesp