Restow 0.3.3

Restow 0.3.3. Released 2026-10-10, channel beta.

Beta release. Run it alongside your existing backups, not as your only one, until
you have verified restores against your own data.

Summary

Restow 0.3.3 shows the Proxmox VE nodes with their VMs and containers in the
inventory, mounts an NFS share straight from the path field of a repository, and calls
the place where backups are stored "repository" everywhere. No database migration.

Breaking Changes

None.

Added

• Servers & clients › Inventory (All and Servers): every Proxmox VE node as a row you
  can expand, with its online state and counts (protected, failed, no job, not backed
  up yet); expanded, each VM and container with its status, backup job and backup
  state, linked to its page. For administrators, once a cluster is connected.
• Repositories: the path field of a directory repository accepts an NFS address
  (192.168.1.10:/export/backup, nas.local:/volume1/restow, nfs://…). The
  provider owner can test and mount it right there; Restow fills in the path. When
  jobs are running, the mount waits until none runs (and can be cancelled).
• A menu entry "Repositories" under your organisation.

Changed

• The interface says "repository" (German "Repository", plural "Repositories")
  instead of "storage location" / "Speicherort". The API and the setup notice keep
  their wording.
• Proxmox VE, Connect Proxmox VE: a command made with an existing PVE API token says
  so plainly, and "New command without this token" makes one that lets the installer
  create its own token.
• Proxmox VE: VMs & containers and the inventory show why the last backup of a guest
  failed, not only in a tooltip.

Fixed

• The Proxmox VE node installer named only the missing privileges when an existing API
  token had privilege separation on (the default when a token is created in the PVE web
  interface); it now says so and shows the pveum command that turns it off.
• An agent test could fail when the run report reached the outbox a moment before the
  status recorded the interruption.

Security

• The Dependabot alerts are cleared: uuid 11.1.1 (through @azure/msal-node, which
  only uses v4), esbuild 0.25 (development only) and vitest 4.1.11 (development only).
  None of the vulnerable code paths was reachable in Restow.

Upgrade Notes

New image; no database migration. Coming from 0.3.0 or older, read the notes of
0.3.2 and 0.3.1 below.

Known Issues

• Mounting an NFS share from the path field was tested against the mounter's
  stand-ins, not yet against a real NFS server. While a mount waits for running jobs,
  new jobs still start, so on a server that is never idle it keeps waiting.
• The known issues of 0.3.2 still apply.

Verification

Before the tag, on 2026-10-10, on the release candidate (main plus the 0.3.3 changes):
lint, typecheck and the full test suites with Postgres 16 and restic 0.19.1 (apps/api
3235, apps/web 3794, apps/worker 435, packages/core 1978, packages/i18n 259,
packages/db 144, apps/scheduler 65, ee/api 243, ee/web 176, ee/licensing 59,
ee/worker 5, packages/cli 34), the PVE node installer test, the server installer
tests (624) and pnpm audit (no known vulnerabilities).

Release pipeline, 2026-10-10:

Check	Result	Duration
1. Install: images, compose up, migrations (new install and upgrade)	PASS	83s
2. Health endpoints, worker and scheduler registered	PASS	0s
3. Passkey sign-in E2E with a virtual authenticator, tenant creation, i18n de/en	PASS	2m 01s
4. Microsoft 365 backup and restore against the dev tenant	SKIPPED	0s
5. IMAP backup and restore against Dovecot, hash comparison	PASS	9s
6. Journal receipt, chain verification, export	PASS	3s
7. Standalone restore with restow-restore from the storage of check 5	PASS	24s
8. Storage targets: S3 (Garage), local path, mounted directory	PASS	20s
9. Image scan (Trivy) and dependency audit (pnpm audit)	PASS	20s
10. Endpoint backup: the agent enrolls, backs up a folder, restores it	PASS	11s
11. Mail import (folder and upload) and export (EML ZIP, MBOX), compared by hash	PASS	8s

10 of 11 checks passed in full, 0 partly, 1 skipped, 0 failed. The full report, including the reason for every skipped or partial check, is attached to the release as smoke-report.md.

The Community images were smoke-tested on their own (smoke-report-community.md, smoke-report-community-arm64.md): amd64 PASS with gaps: 8 of 11 checks passed in full, 0 partly, 3 skipped (see the reasons below); arm64 PASS with gaps: 8 of 11 checks passed in full, 0 partly, 3 skipped (see the reasons below).

Images

Two builds of the same release. The full build is the Apache-2.0 core plus the Business and Service Provider modules (Restow Enterprise License), which stay locked until a license key is installed. The Community build is the Apache-2.0 core alone.

ghcr.io/restow-backup/restow:0.3.3
ghcr.io/restow-backup/restow-web:0.3.3
ghcr.io/restow-backup/restow-community:0.3.3
ghcr.io/restow-backup/restow-web-community:0.3.3

The digests of the multi-arch manifests (the opt-in updater verifies the pulled images against the two lines of its build):

restow: sha256:acbfb855008d77940234d89cc7624e11de0c54fd87694867019f750177181af0
restow-web: sha256:ac347ab1bd5776a930f7b662a924883a67fae80a04150f93873bff5522b5e8db
restow-community: sha256:0c7760cb3f522442937384a47a02614cefc1a444fec2a761ef57f1ce12eeb8e2
restow-web-community: sha256:477d5e757898d483a129362181c01db48591686e60b2046d5d0f6a0c824a86bb

All four images are multi-arch (linux/amd64, linux/arm64), signed with cosign (keyless) and carry an SPDX SBOM as attestation. Verify any of them with:

cosign verify ghcr.io/restow-backup/restow:0.3.3 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web:0.3.3 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-community:0.3.3 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/restow-backup/restow-web-community:0.3.3 \
  --certificate-identity-regexp '^https://github.com/restow-backup/restow/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

docker-compose.yml and env.example are the release stack (deploy/release/); install.sh installs it on a dedicated Linux VM (README.md, "Install with the script"; install.sh.sha256 for sha256sum -c after the download); restow-agent-THIRD_PARTY_NOTICES.txt holds the licenses of the agent binaries and of the restic they run; SHA256SUMS lists every file of this release and is signed (SHA256SUMS.sigstore.json).