pve-fcsan 1.7.1 (security)

Security release: upgrade all nodes.

• Certificate pinning: array and switch connections now accept only the certificate you pinned. Before, pvesan also accepted any certificate signed by a certificate authority the node trusts, for any host name. Someone able to intercept the management network could therefore impersonate an array or switch and capture its credentials. Connections are now HTTPS only, redirects are not followed, and replies are limited to 64 MiB. This affects every array driver and both switch drivers.
• GUI escaping: every grid column in the SAN GUI is HTML-encoded. Before, text reported by arrays, switches and devices was shown as markup: volume names, SCSI vendor and model, and fabric symbolic names. A device on the fabric could set its symbolic name so that script ran in an administrator's browser session.
• DR import: malformed guest records in a replica's metadata are skipped. Hookscripts are not taken over from a replica. Raw QEMU args are kept and reported.

Your configuration stays the same and works without any changes after the upgrade.

Upgrade: apt update && apt install pve-fcsan on each node, one at a time. Then check pvesan-integrate status and reload the GUI in your browser.