Update all non-major dependencies

renovatebot commented

2026-05-25 16:46:49 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
cert-manager		minor	`v1.20.2` → `v1.21.1`
ghcr.io/actualbudget/actual-server	Kustomization	minor	`26.6.0` → `26.8.1`
ghcr.io/immich-app/immich-machine-learning	Kustomization	minor	`v3.0.1` → `v3.1.0`
ghcr.io/immich-app/immich-server	Kustomization	minor	`v3.0.1` → `v3.1.0`
metallb/metallb	Kustomization	patch	`v0.16.0` → `v0.16.1`
pnpm (source)	packageManager	minor	`10.28.0` → `10.34.5`
proxmox (source)	required_provider	minor	`0.81.0` → `0.111.1`
rancher/local-path-provisioner	Kustomization	patch	`v0.0.36` → `v0.0.37`
zonefile (source)	required_provider	minor	`0.1.2` → `0.2.0`

Release Notes

cert-manager/cert-manager (cert-manager)

`v1.21.1`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.21.1 fixes a controller panic for Certificates with spec.renewal.policy: Disabled, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at Ready=False (InvalidSolver) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities.

All users should upgrade.

Changes by Kind

Bug or Regression

Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled (#9038, @sklirg)
Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created (#9083, @SebTardif)
Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. (#9037, @wallrj-cyberark)
Fixed the commented Gateway API config example in the Helm chart values to use gatewayAPI.enabled instead of the invalid gatewayAPI.enable. (#9012, @mateenali66)

Other (Cleanup or Flake)

Bump golang.org/x/text to v0.40.0 to fix a reported security vulnerability (#9039, @wallrj-cyberark)
Bump google.golang.org/grpc to v1.82.1 to fix a reported security vulnerability (#9063)
Bump github.com/google/cel-go to v0.29.0 to fix a reported security vulnerability (#9072)
Bump go.opentelemetry.io/otel to v1.44.0 to fix a reported security vulnerability (#9073)
Update distroless base images (#9000, #9025)

`v1.21.0`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading.

Major Themes

Default `tokenrequest` RBAC removed from Helm chart

⚠️ Breaking change

The Helm chart no longer creates a default Role and RoleBinding granting the cert-manager controller permission to create tokens for its own ServiceAccount (serviceaccounts/token: create). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024.

If you use serviceAccountRef.name pointing at the controller ServiceAccount, you must now either create your own Role/RoleBinding granting serviceaccounts/token: create, or migrate to a dedicated ServiceAccount (recommended — see the Vault or Route53 documentation).

Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole

⚠️ Potentially breaking change

The cert-manager-edit aggregate ClusterRole no longer grants create for challenges.acme.cert-manager.io or create, patch, update for orders.acme.cert-manager.io (GHSA-8rvj-mm4h-c258). These resources are internal to cert-manager's ACME workflow. Challenge patch and update are retained because users may need them to remove stuck finalizers.

This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly.

Metrics port name and path Helm values removed

⚠️ Breaking change

The Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path have been removed. The controller Service metrics port has been renamed from tcp-prometheus-servicemonitor to http-metrics. Because the Helm values schema uses additionalProperties: false, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. (#8952)

ACME and Certificate Management

ACME Renewal Information (ARI): experimental support for RFC 9773 behind the ACMEUseARI feature gate. When enabled, cert-manager queries the ACME server's renewalInfo endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. (#8798)
waitInsteadOfSelfCheck solver option: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See configuration details. (#8858)
AWS IAM authentication for Vault: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. (#8422)
Certificate renewal policies: a new renewalPolicies field on the Certificate API provides more expressive control over renewal scheduling, complementing renewBefore and renewBeforePercentage. (#8258)
Configurable CertificateRequest retry backoff: the new --certificate-request-maximum-backoff-duration flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. (#8893)
Modern2026 PKCS#12 profile: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. (#8841)
Webhook certificate renewal after system suspend: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. (#8464)

Gateway API and cainjector

HTTP01 ListenerSet parentRef fallback: the acme.cert-manager.io/http01-parentreffallback: "true" annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. (#8749)
cert-manager.io/ignore-tls-listeners annotation: exclude specific Gateway TLS listeners from certificate management. (#8727)
Additional listener protocols: configurable listener protocols beyond the default set. (#8683)
enableGatewayAPI configuration restructure: enableGatewayAPI and enableGatewayAPIListenerSet are deprecated in favor of gatewayAPI.enabled / gatewayAPI.enableListenerSet. The old fields continue to work. (#8732)
CAInjectorMerging promoted to GA: unconditionally enabled; will be removed in a future release. (#8583)
cainjector server-side apply unconditional: the ServerSideApply feature gate is deprecated. (#8692)
cainjector --ignore-namespaces flag: skip specified namespaces when watching Secrets for injection. (#8614)

Deployment and Observability

Venafi OAuth token observability: a new AuthFailed Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. (#8808, #8779)
runtimeClassName support: configurable for cert-manager components and ACME HTTP01 solver pods. (#8791, #8976)
startupapicheck.ttlSecondsAfterFinished: opt-in automatic cleanup of the startupapicheck Job. (#8523)
--acme-http01-solver-extra-labels: propagate global.commonLabels to dynamically-created ACME HTTP01 solver resources. (#8761)

Notable Bug Fixes

Integer overflow in renewBeforePercentage: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. (#8947)
Infinite re-issuance loop: cert-manager no longer loops when an issuer returns an already-expired certificate. (#8610)
ACME transient network errors: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. (#8760)
DNS-over-HTTPS response body cap: response body reads are now bounded at 128 KB to prevent potential OOM. (#8803)
Vault path traversal: the Vault issuer webhook now rejects .. path segments, preventing path.Join from silently resolving relative segments. (#8930)
DNS issuer secrets validated before ready: prevents silent misconfiguration. (#8255)

Community

As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved.

A special thanks to:

for their contributions, comments and support!

Also, thanks to the cert-manager maintainer team for their help in this release:

And finally, thanks to the cert-manager steering committee for their feedback in this release cycle:

Changes since v1.20.0

Feature

Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps)
Add certificateRequestMaximumBackoffDuration controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, --certificate-request-maximum-backoff-duration CLI flag, or Helm value config.certificateRequestMaximumBackoffDuration. Defaults to 32 hours for backward compatibility. (#8893, @lunarwhite)
Add an optional waitInsteadOfSelfCheck field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. (#8858, @wallrj)
Add configurable runtimeClassName support for cert-manager components and ACME HTTP01 solver pods. (#8791, @jsoref)
Add direct configurable runtimeClassName support for ACME HTTP01 solver pods via the acmesolver.runtimeClassName Helm value. (#8976, @erikgb)
Add new controller flag --acme-http01-solver-extra-labels, allowing Helm's global.commonLabels to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#8761, @lunarwhite)
Add opt-in startupapicheck.ttlSecondsAfterFinished Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#8523, @dap0am)
Added ARI support through the ACMEUseARI feature gate. (#8798, @hjoshi123)
Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). (#8422, @bitloi)
Added cert-manager.io/ignore-tls-listeners annotation for ignoring gwapi listeners. (#8727, @hjoshi123)
Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. (#8683, @ThatsMrTalbot)
Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 (#8841, @seanorama)
Cainjector: A new flag --ignore-namespaces was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. (#8614, @figaw)
Disabled client side rate-limiting if AP&F is enabled. (#8757, @hjoshi123)
Extend the Venafi/CyberArk integration to also support PANW NGTS. (#8779, @FelixPhipps)
Adding certificate renewal policies (#8258, @hjoshi123)
Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate (#8692, @erikgb)
Processed annotations cert-manager.io/alt-names, cert-manager.io/ip-sans to Certificates generated from ingress like objects in cert-shim controllers. (#8927, @jabbrwcky)
Promote the CAInjectorMerging feature gate to GA (#8583, @Copilot)
When using ACME HTTP-01 with a ListenerSet, setting the annotation acme.cert-manager.io/http01-parentreffallback: "true" causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. (#8749, @apkatsikas)

Bug or Regression

BREAKING: The Helm chart no longer ships a default Role and RoleBinding granting the cert-manager controller ServiceAccount permission to create tokens for itself (serviceaccounts/token: create). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on serviceAccountRef.name pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own Role and RoleBinding granting serviceaccounts/token: create on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). (#8931, @wallrj-cyberark)
ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. (#8760, @texasich)
Add dns issuer secrets validation before marking it as ready (#8255, @Peac36)
Add missing issuer finalizer RBAC to the order controller to support owner references (#8654, @erikgb)
ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. (#8822, @lunarwhite)
Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. (#8843, @wallrj-cyberark)
Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. (#8651, @mateenali66)
Fix webhook serving certificate not being renewed after system suspend. (#8464, @Peac36)
Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). (#8962, @hjoshi123)
Fixed an integer overflow in renewBeforePercentage calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. (#8947, @ThatsMrTalbot)
Fixed duplicate parentRef bug when both issuer config and annotations are present. (#8619, @hjoshi123)
Fixed infinite re-issuance loop when issuer returns an already expired certificate (#8610, @onurmicoogullari)
Fixed local e2e-setup-samplewebhook installation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#8821, @wallrj)
Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). (#8803, @SebTardif)
Fixed validation of timezone-prefixed renewal window cron specs without a schedule. (#8813, @immanuwell)
Helm chart bugfix: rename image helper to avoid umbrella chart conflicts (#8753, @FelixPhipps)
Helm: Fix invalid YAML generated when both webhook.config and webhook.volumes are defined. (#8664, @jnohlgard)
Remove ACME Challenge create and Order create/patch/update from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). (#8958, @wallrj-cyberark)
Remove issuer owner reference from challenges blocking challenge garbage collection (#8743, @erikgb)
Update logic to identify and preserve the secret matching nextPrivateKeySecretName (#8577, @putongyong)
Vault Issuer webhook validation now rejects .. path segments in spec.vault.path and auth mount path fields, preventing path.Join from silently resolving relative segments before constructing the Vault API request. (#8930, @wallrj-cyberark)

Other (Cleanup or Flake)

API cleanup: removed deprecated ObjectReference (#8625, @inteon)
Remove Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path. The metrics path is always /metrics and the target port is always http-metrics. Rename the controller service metrics port from tcp-prometheus-servicemonitor to http-metrics for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. (#8952, @erikgb)
The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet. The old fields continue to work. (#8732, @ThatsMrTalbot)
Update base images to Debian 13 (#8849, @ltwongaa)

`v1.21.0-beta.0`

Compare Source

[!NOTE]
⚠️ This is a pre-release. For testing only!

For full release notes including breaking changes, upgrade notes, major themes and community credits, see the v1.21 release notes.

Changes since v1.21.0-alpha.1

Feature

Add certificateRequestMaximumBackoffDuration controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, --certificate-request-maximum-backoff-duration CLI flag, or Helm value config.certificateRequestMaximumBackoffDuration. Defaults to 32 hours for backward compatibility. (#8893, @lunarwhite)
Add an optional waitInsteadOfSelfCheck field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. (#8858, @wallrj)
Add configurable runtimeClassName support for cert-manager components and ACME HTTP01 solver pods. (#8791, @jsoref)
Added ARI support through the ACMEUseARI feature gate. (#8798, @hjoshi123)
Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). (#8422, @bitloi)
Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3. (#8841, @seanorama)
A new flag --ignore-namespaces was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. (#8614, @figaw)
Disabled client side rate-limiting if AP&F is enabled. (#8757, @hjoshi123)
Processed annotations cert-manager.io/alt-names, cert-manager.io/ip-sans to Certificates generated from ingress like objects in cert-shim controllers. (#8927, @jabbrwcky)
When using ACME HTTP-01 with a ListenerSet, setting the annotation acme.cert-manager.io/http01-parentreffallback: "true" causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. (#8749, @apkatsikas)

Bug or Regression

BREAKING: The Helm chart no longer ships a default Role and RoleBinding granting the cert-manager controller ServiceAccount permission to create tokens for itself (serviceaccounts/token: create). This RBAC was added in v1.16 (#7213) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on serviceAccountRef.name pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own Role and RoleBinding granting serviceaccounts/token: create on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). (#8931, @wallrj-cyberark)
ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. (#8760, @texasich)
Fix webhook serving certificate not being renewed after system suspend. (#8464, @Peac36)
Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). (#8962, @hjoshi123)
Fixed an integer overflow in renewBeforePercentage calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. (#8947, @ThatsMrTalbot)
Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). (#8803, @SebTardif)
Fixed validation of timezone-prefixed renewal window cron specs without a schedule. (#8813, @immanuwell)
Harden ACME Challenge and Order resources: reject user-created Challenges without Order ownership, enforce Order spec immutability, and detect pre-placed same-name Challenges with mismatched specs. (#8948, @wallrj-cyberark)
Remove ACME Challenge create and Order create/patch/update from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). (#8958, @wallrj-cyberark)
Update logic to identify and preserve the secret matching nextPrivateKeySecretName. (#8577, @putongyong)
Vault Issuer webhook validation now rejects ... path segments in spec.vault.path and auth mount path fields, preventing path.Join from silently resolving relative segments before constructing the Vault API request. (#8930, @wallrj-cyberark)

Other (Cleanup or Flake)

Remove Helm values prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, and prometheus.podmonitor.path. The metrics path is always /metrics and the target port is always http-metrics. Rename the controller service metrics port from tcp-prometheus-servicemonitor to http-metrics for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. (#8952, @erikgb)
Update base images to Debian 13. (#8849, @ltwongaa)

`v1.21.0-alpha.1`

Compare Source

Changes since v1.21.0-alpha.0

[!NOTE]
⚠️ This is a pre-release. For testing only!

Feature

Add Venafi OAuth token request observability and a new AuthFailed Issuer condition reason to distinguish bad credentials from transient infrastructure errors. (#8808, @FelixPhipps)
Add new controller flag --acme-http01-solver-extra-labels, allowing Helm's global.commonLabels to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). (#8761, @lunarwhite)
Add opt-in startupapicheck.ttlSecondsAfterFinished Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. (#8523, @dap0am)
Added cert-manager.io/ignore-tls-listeners annotation for ignoring gwapi listeners. (#8727, @hjoshi123)
Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. (#8683, @ThatsMrTalbot)
Extend the Venafi/CyberArk integration to also support PANW NGTS. (#8779, @FelixPhipps)
Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate (#8692, @erikgb)

Bug or Regression

Add dns issuer secrets validation before marking it as ready (#8255, @Peac36)
Add missing issuer finalizer RBAC to the order controller to support owner references (#8654, @erikgb)
ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. (#8822, @lunarwhite)
Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in #8808. (#8843, @wallrj-cyberark)
Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. (#8651, @mateenali66)
Fixed infinite re-issuance loop when issuer returns an already expired certificate (#8610, @onurmicoogullari)
Fixed local e2e-setup-samplewebhook installation to use the samplewebhook image repository and tag from the saved image tarball manifest. (#8821, @wallrj)
Helm chart bugfix: rename image helper to avoid umbrella chart conflicts (#8753, @FelixPhipps)
Helm: Fix invalid YAML generated when both webhook.config and webhook.volumes are defined. (#8664, @jnohlgard)
Remove issuer owner reference from challenges blocking challenge garbage collection (#8743, @erikgb)

Other (Cleanup or Flake)

The enableGatewayAPI and enableGatewayAPIListenerSet fields on ControllerConfiguration are deprecated and moved into the gatewayAPI sub-struct as gatewayAPI.enabled and gatewayAPI.enableListenerSet. The old fields continue to work. (#8732, @ThatsMrTalbot)

`v1.21.0-alpha.0`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

⚠️ This is a pre-release. For testing only!

Changes by Kind since `v1.20.0`

Feature

Feat(certificate): adding certificate renewal policies (#8258, @hjoshi123)
Promote the CAInjectorMerging feature gate to GA (#8583, @Copilot)

Bug or Regression

Fixed duplicate parentRef bug when both issuer config and annotations are present. (#8619, @hjoshi123)

Other (Cleanup or Flake)

API cleanup: removed deprecated ObjectReference (#8625, @inteon)

`v1.20.3`

Compare Source

cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters.

v1.20.3 removes the issuer owner reference from challenges which was blocking challenge garbage collection, removes unnecessary write verbs from the cert-manager-edit aggregate ClusterRole, and updates Go to fix reported CVEs.

Changes by Kind

Bug or Regression

Remove Challenge create and Order create, patch, update verbs from the cert-manager-edit aggregate ClusterRole. (#8940, @wallrj-cyberark)
Remove issuer owner reference from challenges blocking challenge garbage collection (#8759, @cert-manager-bot)

Other (Cleanup or Flake)

Bump go to 1.26.3, other deps to fix several govulncheck issues (#8789, @SgtCoDFish)
Update Go to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 (#8926, @wallrj-cyberark)

immich-app/immich (ghcr.io/immich-app/immich-machine-learning)

`v3.1.0`

Compare Source

Welcome to Immich v3.1.0!

This release includes several quality of life improvements and another round of bug fixes. Keep reading below for the complete highlights.

Highlights

Upload wakelock (web)
Undo archive (web)
Filter assets by server filepath (workflows)
Quick navigate to maintenance page (web)
Better slideshow button accessibility (web)
OIDC role claim sync improvements (OAuth)
Invalidate sessions on password reset (admin-cli)

Upload wakelock (web)

Similar to mobile, the web application will now automatically acquire a wakelock to prevent the screen from dimming while uploads are happening. This feature will require an HTTPS connection.

Undo archive (web)

After archiving assets, the success notification now has an “undo” button to undo the action.

Filter assets by server filepath (workflows)

The asset file filter has a new option “Use path”. When set to true, it will filter based on the actual path on the server rather than the original file name.

Filter assets by EXIF metadata (workflows)

A new workflow filter has been added that allows you to filter assets based on their EXIF metadata fields. For now it only supports string comparisons, with numerical comparisons expected to come soon.

Filter by EXIF metadata step configuration options

Quick navigate to maintenance page (web)

The command palette (CTRL+K or /) now includes an item for the maintenance page.

Command palette with a maintenance page item

Better slideshow button visibility (web)

The slideshow buttons on the web are now wrapped in a container with a backdrop blur, making them easier to view when the current asset is very light.

OIDC role claim sync improvements (OAuth)

The OAuth integration in Immich supports setting an initial isAdmin value for new users via a role claim. This same process has been updated to now sync isAdmin on subsequent logins. Additionally, the role claim now supports both single values (immich_role: 'admin') in addition to lists of values ( immich_role: ["admin", "user"]), making in more flexible.

Invalidate sessions on password reset (admin-cli)

When using the admin command line interface to reset a password, there is now a new option to invalidate existing sessions.

immich-admin reset-admin-password
Found Admin:
- ID=e65e6f88-2a30-4dbe-8dd9-1885f4889b53
- OAuth ID=
- Email=admin@example.com
- Name=Immich Admin
? Please choose a new password (optional) immich-is-cool
? Invalidate existing sessions? Yes
The admin password has been updated.

Date range for map (mobile)

Similar to web, mobile now also supports filtering the map for assets within a given date range.

Mobile map settings page date range options

What's Changed

🚨 Breaking Changes

chore(mobile): drop support for iOS 14 by @agg23 in #29780

🚀 Features

feat(cli): Add --visibility flag to immich CLI upload subcommand by @yuxincs in #29614
feat(mobile): custom date range for map by @YarosMallorca in #26205

🌟 Enhancements

feat(web): Keep show more open on duplicates by @MontejoJorge in #29734
fix(server/workflow): add trigger for external libraries AssetCreate by @cratoo in #29597
chore(seo): remove redundant twitter metadata tags by @cevdetta in #29801
feat(web): add wake lock when uploading assets by @diogotcorreia in #29820
feat(web): undo archive from toast by @YarosMallorca in #27061
feat: workflow filter assets by upload path by @benbeckford in #30000
feat(web): add maintenance link to command palette by @yamishi13 in #30016
feat: add album asset event handling by @timonrieger in #29008
fix(web): improve slideshow controls visibility on bright backgrounds by @tech00exploere in #29950
fix: re-evaluate OIDC role claim on every login and support array values by @ImperatorRuscal in #29991
feat: exif metadata workflow filter by @benbeckford in #29295
feat: password invalidate sessions by @jrasm91 in #30125

🐛 Bug fixes

fix(mobile): apply exif orientation to remote raw photos on android by @santoshakil in #29906
fix(web): hide stack thumbnail tray in slideshow mode by @tech00exploere in #29918
fix(web): use Container component for responsive admin maintenance la… by @tech00exploere in #29917
fix(server): updated default CSP config to support videos from V3 player by @l0ll098 in #29830
fix(server): workflow date filter, make end date inclusive by @kigrup in #29876
fix(web): URI encode slug and reduce confusion for users by @meesfrensel in #29796
fix(web): clear birth date by @danieldietzler in #29959
fix(server): disable heif security limit by @mertalev in #29954
fix: zero byte image uploads by @rrrockey in #29426
fix(server): return workflow steps in ascending order by @benbeckford in #29999
fix(mobile): update album creation to use user-defined name from dialog by @LeLunZ in #30002
fix: long press share quality override preference settings by @alextran1502 in #30030
fix(web): align ContextMenu z-index with design-system token by @tech00exploere in #30015
fix(web): refresh folder view after asset deletion by @tech00exploere in #29899
fix: do not show the whats new page on fresh login by @shenlong-tanwen in #30072
fix(mobile): prevent crash on video widget dispose by @agg23 in #30078
fix(web): attach file picker input to DOM so iOS Safari fires change … by @mrxder in #29660
fix: timebuckets locked permissions by @danieldietzler in #30066
fix: search statistics locked folder permissions by @danieldietzler in #30063
fix(web): fix Country/State filters when set to Unknown by @compscitwilight in #30026
fix(server): file uploads for files with extension only filenames by @compscitwilight in #30024
fix(mobile): stop double close animation when dismissing an asset by @santoshakil in #29413
fix(mobile): back up files moved into a watched folder on android by @santoshakil in #29872
fix(web): lens model search by @jrasm91 in #30088
fix(mobile): add album picker to the partner view bottom sheet by @santoshakil in #30099
fix(mobile): prevent duplicate album creation during submission by @LeLunZ in #30003
fix(mobile): properly group download tasks for Live Photos by @agg23 in #29952
fix(mobile): show real error when an asset can't be added to an album by @santoshakil in #29754
fix(mobile): treat wired ethernet as unmetered on ios by @santoshakil in #29351
fix(server): send id_token_hint on OIDC logout by @lorypota in #29720
fix(mobile): refresh asset stack after deleting viewer item by @PeterOmbodi in #28164
fix: limit ocr overlay to images by @YarosMallorca in #30116
fix: disable slideshow crossfade on reduced motion by @YarosMallorca in #29826
fix(mobile): map unresponsive after viewing asset by @YarosMallorca in #27036
fix(mobile): send date-only value for memories query param by @ajuijas in #30049
fix: admin user details responsive layout by @YarosMallorca in #30114
fix: backup delay translation key parsing by @YarosMallorca in #30112
fix(web): use correct date field for shift-click range in Recently Added by @okxint in #30071
fix(server): dissolve stack when its non-primary assets are deleted by @justadityaraj in #29354
fix: always set extension from provided file by @bo0tzz in #29839
fix: locked view and asset view provider by @shenlong-tanwen in #30136
fix(mobile): birthday picker date order follows locale by @santoshakil in #29419
fix(web): restore correct back route when opening person asset via direct URL by @okxint in #30129
fix(web): mirror asset viewer navigation icons in RTL by @noboike in #30151
fix(mobile): allow URL validation to pass when scheme is not provided by @agg23 in #30142
fix: run background tasks in root isolate by @shenlong-tanwen in #30101
fix(web): mirror onboarding navigation icons in RTL by @noboike in #30158
fix: min faces user preference by @jrasm91 in #30177
fix(web): use RTL transform origin in AdaptiveImage by @noboike in #30182
fix: don't skip person thumbnail generation if ML is disabled by @bo0tzz in #30194
fix: shared by user detail panel by @danieldietzler in #30187
fix(mobile): prevent timeline scroll to top on unrelated pages by @agg23 in #30281

📚 Documentation

chore(security.txt): bump expired Expires field (RFC 9116) by @kobihikri in #29932
fix(docs): remove ref to synology channel by @mmomjian in #30051
fix: hypertext link to example docker-compose.rootless.yml by @upmcplanetracker in #30155

🌐 Translations

feat(docs): add bulgarian readme by @nedevski in #29427
chore(web): update translations by @weblate in #29781

New Contributors

@kobihikri made their first contribution in #29932
@kigrup made their first contribution in #29876
@yuxincs made their first contribution in #29614
@cevdetta made their first contribution in #29801
@mrxder made their first contribution in #29660
@compscitwilight made their first contribution in #30026
@nedevski made their first contribution in #29427
@yamishi13 made their first contribution in #30016
@lorypota made their first contribution in #29720
@ImperatorRuscal made their first contribution in #29991
@ajuijas made their first contribution in #30049
@justadityaraj made their first contribution in #29354
@pavel-miniutka made their first contribution in #29939
@noboike made their first contribution in #30151
@upmcplanetracker made their first contribution in #30155

Full Changelog: https://github.com/immich-app/immich/compare/v3.0.3...v3.1.0

`v3.0.3`

Compare Source

v3.0.3

various bug fixes
we push to our own F-Droid repo at https://app.futo.org/fdroid/repo now. If you're using F-Droid, please pull the application from there from now on
fixes an issue where LivePhotos upload from the background isn't showing up.

[!Note]
In some specific circumstances, newly uploaded Live Photos could have broken thumbnails. If you see any such cases, please run the "missing" job for thumbnails or wait for the respective nightly job to clear it up.

What's Changed

🚀 Features

feat: publish app releases to FUTO F-Droid repo by @bo0tzz in #29804

🐛 Bug fixes

fix(web): closing plugin method picker selects "unknown" method by @benbeckford in #29784
fix: unauthorized album owner update by @danieldietzler in #29883
fix: still part of live photo hidden on bg upload by @shenlong-tanwen in #29884
fix: system appbar icon color has incorrect color in asset viewer by @alextran1502 in #29885
fix: locked visibility in search random endpoint by @danieldietzler in #29887
fix(mobile): send a full datetime from the android memories widget by @santoshakil in #29689
fix: memory search date validation by @danieldietzler in #29907
fix(server): set hvc1 tag when using hwa by @mertalev in #29908
fix(mobile): clear zoom state when swapping assets by @agg23 in #29909
fix: Ken Burns effect on sliver app bar jittery on Android by @alextran1502 in #29890

📚 Documentation

fix(docs): update fdroid link by @mmomjian in #29797
feat: system integrity docs by @danieldietzler in #29911

🌐 Translations

chore(web): update translations by @weblate in #29774
fix(mobile): correct person age singular pluralization by @tech00exploere in #29868

New Contributors

@tech00exploere made their first contribution in #29868

Full Changelog: https://github.com/immich-app/immich/compare/v3.0.2...v3.0.3

`v3.0.2`

Compare Source

v3.0.2

This patch release addresses various bugs from v3 release and adds an additional filter to workflows

What's Changed

🌟 Enhancements

fix(web): add ARIA label to ServerStatisticsCard by @tjhorner in #29497
feat(server): hls variant configuration by @mertalev in #29613
feat: user agnostic database restore by @danieldietzler in #29512
feat(server): date workflow filter by @benbeckford in #29040

🐛 Bug fixes

fix: re-add gCastEnabled negation by @bo0tzz in #29499
fix: downmix audio to stereo to fix broken channel layout by @lukasdotcom in #29485
fix: live transcoding when viewing from a link share by @lukasdotcom in #29471
fix: web search timeline visibility by @danieldietzler in #29518
fix(web): missing i18n strings by @wonsukchoi in #29612
fix: chinese browser locales recognition by @danieldietzler in #29622
chore: improve added to album messages by @danieldietzler in #29641
fix(mobile): fix 10-bit heic and avif colors on android by @santoshakil in #29631
fix(mobile): match iOS scroll to top and tabbar scroll (#28469) by @agg23 in #29705
fix: wrap migrations in transaction by @shenlong-tanwen in #29664
fix: oauth account linking by @danieldietzler in #29624
fix: incorrect grouping of recently added assets by @benbeckford in #29666
fix: integrity checks checksum pagination by @danieldietzler in #29516
fix(mobile): missing crop options and rotation scaling by @bwees in #29645
fix(mobile): properly handle live photos locally by @agg23 in #29462
fix: integrity checks dto validation by @danieldietzler in #29621
fix(mobile): http request handling after isolate death by @mertalev in #29714
fix: do not log out on automatic url switch by @shenlong-tanwen in #29715
fix(server): stream ffprobe packets by @mertalev in #29723
fix: search metadata for album shared links by @danieldietzler in #29742
fix(web): clear asset selection when search context changes by @khanguyen74 in #29738
fix(mobile): update timeline args on layout constraint changes by @santoshakil in #29653
fix: iso date parsing for three digit years by @danieldietzler in #29739
fix: missing files integrity checks by @danieldietzler in #29737
fix(mobile): play videos from search results and folder view by @santoshakil in #29693
fix(web): recursively unnest class arrays by @meesfrensel in #29755
fix: emit album update event when uploading assets through shared link by @danieldietzler in #29757
fix(web): always initialize language manager to set lang and dir by @meesfrensel in #29696

📚 Documentation

chore: update docs with v3 tags by @alextran1502 in #29312
fix(docs): use correct heading name for DB dump by @track0x1 in #29483
feat(docs): add Malayalam language support in README files by @jinskjoy in #29593
fix(docs): clarify version policy by @mmomjian in #29654

🌐 Translations

chore(web): update translations by @weblate in #29415

New Contributors

@tjhorner made their first contribution in #29497
@wonsukchoi made their first contribution in #29612
@track0x1 made their first contribution in #29483
@jinskjoy made their first contribution in #29593
@khanguyen74 made their first contribution in #29738

Full Changelog: https://github.com/immich-app/immich/compare/v3.0.1...v3.0.2

metallb/metallb (metallb/metallb)

`v0.16.1`

Compare Source

pnpm/pnpm (pnpm)

`v10.34.5`: pnpm 10.34.5

Compare Source

Patch Changes

78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Gold Sponsors

`v10.34.4`: pnpm 10.34.4

Compare Source

Patch Changes

352ae48: Security: validate config dependency names and versions before using them to build filesystem paths. A pnpm-workspace.yaml with a traversal-shaped configDependencies name (such as ../../PWNED) or version (such as ../../../PWNED) could previously cause pnpm install to create symlinks or write package files outside node_modules/.pnpm-config and the store. Names must now be valid npm package names and versions must be exact semver versions. See GHSA-qrv3-253h-g69c.
352ae48: Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests. See GHSA-fr4h-3cph-29xv.
352ae48: Prevent pnpm patch-remove from removing files outside the configured patches directory.
217fbe0: Hardened the warning printed when a project .npmrc uses environment variables in registry/auth settings: the suggested pnpm config set command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled .npmrc and a shell expands $(...), backticks, and $VAR even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.

Platinum Sponsors

Gold Sponsors

`v10.34.3`: pnpm 10.34.3

Compare Source

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:

the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
registry URLs in pnpm-workspace.yaml.

This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).

Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.

If your authentication broke after upgrading, move the token out of the committed .npmrc:


# Writes to your user/global config, not the repository:
pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"

Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.

See https://pnpm.io/npmrc for full migration details.

Patch Changes

Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running pnpm config set "<key>" <value> to store it in the global config, or by keeping the ${...} line in the user-level ~/.npmrc — with a link to https://pnpm.io/npmrc.
A repository-controlled project or workspace .npmrc can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set userconfig, globalconfig, or prefix to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set tokenHelper. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace .npmrc files are read. Fixed by upgrading @pnpm/npm-conf to 3.0.3.

Platinum Sponsors

Gold Sponsors

`v10.34.2`: pnpm 10.34.2

Compare Source

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

Following GHSA-3qhv-2rgh-x77r, pnpm no longer expands ${ENV_VAR} placeholders that come from a repository-controlled config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to:

the project/workspace .npmrc — registry, @scope:registry, proxy URLs, URL-scoped keys (//host/…), and credential values (_authToken, _auth, _password, username, tokenHelper, cert, key);
registry URLs in pnpm-workspace.yaml.

This release also closes a bypass where a project .npmrc could set userconfig, globalconfig, or prefix to make pnpm load a repo-supplied file as trusted config (via @pnpm/npm-conf@3.0.3).

Environment variables are still expanded in trusted config: your user-level ~/.npmrc, the global config, CLI options, and environment config.

If your authentication broke after upgrading, move the token out of the committed .npmrc:


# Writes to your user/global config, not the repository:
pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN"

Or keep the ${NPM_TOKEN} line but put it in your user-level ~/.npmrc instead of the repo. In GitHub Actions, actions/setup-node with registry-url already writes a user-level .npmrc, so NODE_AUTH_TOKEN keeps working. For other CI where editing each pipeline is hard, set NPM_CONFIG_USERCONFIG=.npmrc in the CI environment to declare the project .npmrc trusted.

See https://pnpm.io/npmrc for full migration details.

Patch Changes

Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's packageManager field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global .npmrc — defaulting to the public npm registry, instead of the repository's project/workspace settings.
pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the packageManager field (or pnpm self-update) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact name@version, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip.
Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace .npmrc and pnpm-workspace.yaml) can no longer expand ${...} placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work.
Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.
Require trusted package identity before package-name onlyBuiltDependencies (and allowBuilds) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.
pnpm now verifies the detached OpenPGP signature of a Node.js release's SHASUMS256.txt against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (node-mirror:<channel> in .npmrc), and the integrity check previously trusted a SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the release channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.

Platinum Sponsors

Gold Sponsors

`v10.34.1`: pnpm 10.34.1

Compare Source

Patch Changes

Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Gold Sponsors

`v10.34.0`: pnpm 10.34

Compare Source

Minor Changes

Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, pnpm install (non-frozen) would log ERR_PNPM_TARBALL_INTEGRITY, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile.

pnpm install now exits with ERR_PNPM_TARBALL_INTEGRITY and a hint pointing at the new opt-in flag.

The only opt-in is pnpm install --update-checksums — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable.

--force and pnpm update deliberately do not bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. --frozen-lockfile behavior is unchanged. --fix-lockfile keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass.

Patch Changes

Pin unscoped per-registry settings (_authToken, _auth, username/_password, tokenHelper, inline cert/key) to the registry declared in the same config source at load time, so a later layer overriding registry= (workspace .npmrc, pnpm-workspace.yaml, CLI --registry) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU.
Fixed minimumReleaseAge handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version time field) by default, which made the maturity check throw ERR_PNPM_MISSING_TIME whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when minimumReleaseAge is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets ERR_PNPM_MISSING_TIME from the cache fast-path fall through to the network fetch even under strict mode.
Reject git resolutions whose commit field is not a 40-character hexadecimal SHA before invoking git. A malicious lockfile could otherwise smuggle a value such as --upload-pack=<command> through git fetch / git checkout, which on SSH or local-file transports executes the supplied command.
Reject patch files whose diff --git headers reference paths outside the patched package directory. Previously a malicious .patch file added via a pull request could write, delete, or rename arbitrary files reachable by the user running pnpm install.
Fixed --prefix=<dir> not being honored when locating the workspace root. The --prefix → dir rename was applied after workspace detection, so workspace settings declared in <dir>/pnpm-workspace.yaml were not loaded when pnpm was invoked from outside <dir> #11535.
Reject dependency aliases that contain path-traversal segments (such as @x/../../../../../.git/hooks) when reading them from a package manifest or symlinking them into node_modules. A malicious registry package could otherwise use a transitive dependency key to make pnpm install create symlinks at attacker-chosen paths outside the intended node_modules directory.

Platinum Sponsors

Gold Sponsors

`v10.33.4`: pnpm 10.33.4

Compare Source

Patch Changes

Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.
Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #11341.

Platinum Sponsors

Gold Sponsors

`v10.33.3`: pnpm 10.33.3

Compare Source

Patch Changes

When self-updating from v10's @pnpm/exe to v11+ on Intel macOS (darwin-x64), pnpm self-update now transparently switches to the JS-only pnpm package on npm instead of installing @pnpm/exe@v11+ (which doesn't ship a working binary for Intel Macs because of an upstream Node.js SEA bug — see #11423 and nodejs/node#62893). Without this, the self-update would silently leave the user with no working pnpm binary. The new install requires Node.js to be available on PATH; a warning is printed when the swap happens. All other host/version combinations are unchanged.
pnpm self-update (with no version argument) no longer downgrades pnpm when the registry's latest dist-tag points to an older release than the currently active version. Run pnpm self-update latest to force a downgrade #11418.

Platinum Sponsors

Gold Sponsors

`v10.33.2`: pnpm 10.33.2

Compare Source

Patch Changes

Globally-installed bins no longer fail with ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND when pnpm was installed via the standalone @pnpm/exe binary (e.g. curl -fsSL https://get.pnpm.io/install.sh | sh -) on a system without a separate Node.js installation. Previously, when which('node') failed during pnpm add --global, pnpm fell back to process.execPath, which in @pnpm/exe is the pnpm binary itself — and that path was baked into the generated bin shim, causing the shim to invoke pnpm instead of Node #11291, #4645.
Fix an infinite fork-bomb that could happen when pnpm was installed with one version (e.g. npm install -g pnpm@A) and run inside a project whose package.json selected a different pnpm version via the packageManager field (e.g. pnpm@B), while a pnpm-workspace.yaml also existed at the project root.

The child's environment is now forced to manage-package-manager-versions=false (v10) and pm-on-fail=ignore (v11+), which disables the package-manager-version handling in whichever pnpm runs as the child.

Fixes #11337.

Platinum Sponsors

Gold Sponsors

`v10.33.1`: pnpm 10.33.1

Compare Source

Patch Changes

When a project's packageManager field selects pnpm v11 or newer, commands that v10 would have passed through to npm (version, login, logout, publish, unpublish, deprecate, dist-tag, docs, ping, search, star, stars, unstar, whoami, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, pnpm version --help print npm's help on a project with packageManager: pnpm@11.0.0-rc.3 #11328.

Platinum Sponsors

Gold Sponsors

`v10.33.0`: pnpm 10.33

Compare Source

Minor Changes

Added a new dedupePeers setting that reduces peer dependency duplication. When enabled, peer dependency suffixes use version-only identifiers (name@version) instead of full dep paths, eliminating nested suffixes like (foo@1.0.0(bar@2.0.0)). This dramatically reduces the number of package instances in projects with many recursive peer dependencies #11070.

Patch Changes

Fail on incompatible lockfiles in CI when frozen lockfile mode is enabled, while preserving non-frozen CI fallback behavior.
When package metadata is malformed or can't be fetched, the error thrown will now show the originating error.
Fixed intermittent failures when multiple pnpm dlx calls run concurrently for the same package. When the global virtual store is enabled, the importer now verifies file content before skipping a rename, avoiding destructive swap-renames that break concurrent processes. Also tolerates EPERM during bin creation on Windows and properly propagates enableGlobalVirtualStore through the install pipeline.
Fixed handling of non-string version selectors in hoistPeers, preventing invalid peer dependency specifiers.
Improve the non-interactive modules purge error hint to include the confirmModulesPurge=false workaround.

When pnpm needs to recreate node_modules but no TTY is available, the error now suggests either setting CI=true or disabling the purge confirmation prompt via confirmModulesPurge=false.

Adds a regression test for the non-TTY flow.
Fixed false "Command not found" errors on Windows when a command exists in PATH but exits with a non-zero code. Also fixed path resolution for --filter contexts where the command runs in a different package directory.
When a pnpm-lock.yaml contains two documents, ignore the first one. pnpm v11 will write two lockfile documents into pnpm-lock.yaml in order to store pnpm version integrities and config dependency resolutions.
Fixed a bug preventing the clearCache function returned by createNpmResolver from properly clearing metadata cache.

Platinum Sponsors

Gold Sponsors

`v10.32.1`: pnpm 10.32.1

Compare Source

Patch Changes

Fix a regression where pnpm-workspace.yaml without a packages field caused all directories to be treated as workspace projects. This broke projects that use pnpm-workspace.yaml only for settings (e.g. minimumReleaseAge) without defining workspace packages #10909.

Platinum Sponsors

Gold Sponsors

`v10.32.0`: pnpm 10.32

Compare Source

Minor Changes

Added --all flag to pnpm approve-builds that approves all pending builds without interactive prompts #10136.

Patch Changes

Reverted change related to setting explicitly the npm config file path, which caused regressions.
Reverted fix related to lockfile-include-tarball-url. Fixes #10915.

Platinum Sponsors

Gold Sponsors

`v10.31.0`: pnpm 10.31

Compare Source

Minor Changes

When pnpm updates the pnpm-workspace.yaml, comments, string formatting, and whitespace will be preserved.

Patch Changes

Added -F as a short alias for the --filter option in the help output.
Handle undefined pkgSnapshot in pnpm why -r #10700.
Fix headless install not being used when a project has an injected self-referencing file: dependency that resolves to link: in the lockfile.
Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates ENOTEMPTY/EEXIST errors if another thread already completed the import.
When lockfile-include-tarball-url is set to false, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent #6667.
Fixed optimisticRepeatInstall skipping install when overrides, packageExtensions, ignoredOptionalDependencies, patchedDependencies, or peersSuffixMaxLength changed.
Fixed pnpm patch-commit failing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems).

The issue occurred because pnpm was setting HOME and the Windows user profile env var to empty strings to suppress user git configuration when running git diff. This caused git to resolve the home directory (~) as root (/), leading to permission errors when attempting to access /.config/git/attributes.

Now uses GIT_CONFIG_GLOBAL: os.devNull instead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution.

Fixes #6537
Fix pnpm why -r --parseable missing dependents when multiple workspace packages share the same dependency #8100.
Fix link-workspace-packages=true incorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to * in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version #10173.
Fixed pnpm update --interactive table breaking with long version strings (e.g., prerelease versions like 7.0.0-dev.20251209.1) by dynamically calculating column widths instead of using hardcoded values #10316.
Explicitly tell npm the path to the global rc config file.
The parameter set by the --allow-build flag is written to allowBuilds.
Fix a bug in which specifying filter on pnpm-workspace.yaml would cause pnpm to not detect any projects.
Print help message on running pnpm dlx without arguments and exit.

Platinum Sponsors

Gold Sponsors

`v10.30.3`: pnpm 10.30.3

Compare Source

Patch Changes

Fixed version switching via packageManager field failing when pnpm is installed as a standalone executable in environments without a system Node.js #10687.

Platinum Sponsors

Gold Sponsors

`v10.30.2`: pnpm 10.30.2

Compare Source

Patch Changes

Fix auto-installed peer dependencies ignoring overrides when a stale version exists in the lockfile.
Fixed "input line too long" error on Windows when running lifecycle scripts with the global virtual store enabled #10673.
Update @zkochan/js-yaml to fix moderate vulnerability.

Platinum Sponsors

Gold Sponsors

`v10.30.1`: pnpm 10.30.1

Compare Source

Patch Changes

Use the /-/npm/v1/security/audits/quick endpoint as the primary audit endpoint, falling back to /-/npm/v1/security/audits when it fails #10649.

Platinum Sponsors

Gold Sponsors

`v10.30.0`: pnpm 10.30

Compare Source

Minor Changes

pnpm why now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies.

Patch Changes

Revert pnpm why dependency pruning to prefer correctness over memory consumption. Reverted PR: #7122.
Optimize pnpm why and pnpm list performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one #10596.

Platinum Sponsors

Gold Sponsors

`v10.29.3`: pnpm 10.29.3

Compare Source

Patch Changes

Fixed an out-of-memory error in pnpm list (and pnpm why) on large dependency graphs by replacing the recursive tree builder with a two-phase approach: a BFS dependency graph followed by cached tree materialization. Duplicate subtrees are now deduplicated in the output, shown as "deduped (N deps hidden)" #10586.
Fixed allowBuilds not working when set via .pnpmfile.cjs #10516.
When the enableGlobalVirtualStore option is set, the pnpm deploy command would incorrectly create symlinks to the global virtual store. To keep the deploy directory self-contained, pnpm deploy now ignores this setting and always creates a localized virtual store within the deploy directory.
Fixed minimumReleaseAgeExclude not being respected by pnpm dlx #10338.

Platinum Sponsors

Gold Sponsors

`v10.29.2`: pnpm 10.29.2

Compare Source

Patch Changes

Reverted a fix shipped in v10.29.1, which caused another issue #10571.
Reverted fix: Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.

Platinum Sponsors

Gold Sponsors

`v10.29.1`: pnpm 10.29.1

Compare Source

Minor Changes

The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
Support configuring auditLevel in the pnpm-workspace.yaml file #10540.
Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #10436.

Patch Changes

Fixed pnpm list --json returning incorrect paths when using global virtual store #10187.
Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #10290.
Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #10497.
Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #10176.
Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #10281.
Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #10460.
Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #10540.
update tar to version 7.5.7 to fix security issue

Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842
Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #10325.
Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #10271.
pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #10561.
Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #10457.

Platinum Sponsors

Gold Sponsors

`v10.28.2`: pnpm 10.28.2

Compare Source

Patch Changes

Security fix: prevent path traversal in directories.bin field.
When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.
Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #9950.

Platinum Sponsors

Gold Sponsors

`v10.28.1`: pnpm 10.28.1

Compare Source

Patch Changes

Fixed installation of config dependencies from private registries.

Added support for object type in configDependencies when the tarball URL returned from package metadata differs from the computed URL #10431.
Fix path traversal vulnerability in binary fetcher ZIP extraction
- Validate ZIP entry paths before extraction to prevent writing files outside target directory
- Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix
- Both attack vectors now throw ERR_PNPM_PATH_TRAVERSAL error
Support plain http:// and https:// URLs ending with .git as git repository dependencies.

Previously, URLs like https://gitea.example.org/user/repo.git#commit were not recognized as git repositories because they lacked the git+ prefix (e.g., git+https://). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads.

Changes:
- The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver
- The git resolver now recognizes plain http:// and https:// URLs ending in .git as git repositories
- Removed the isRepository check from the tarball resolver since it's no longer needed with the new resolver order
Fixes #10468
pnpm run -r and pnpm run --filter now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use --if-present to suppress this error #6844.
Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for ./ but not .\. Since backslashes are directory separators on Windows, malicious packages could use paths like foo\..\..\.npmrc to write files outside the package directory.
When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project #5759.
Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.
Revert Try to avoid making network calls with preferOffline #10334.
Fix --save-peer to write valid semver ranges to peerDependencies for protocol-based installs (e.g. jsr:) by deriving from resolved versions when available and falling back to * if none is available #10417.
Do not exclude the root workspace project, when it is explicitly selected via a filter #10465.

Platinum Sponsors

Gold Sponsors

bpg/terraform-provider-proxmox (proxmox)

`v0.111.1`

Compare Source

Bug Fixes

cluster: handle influx_token write-only status in metrics_server (#2972) (65831bb)
hwmapping: percent-encode comments to survive PVE round-trip (#2980) (dcc0c36)
vm: persist boot_order on first apply when cloning (#2969) (505cb8d)

Miscellaneous

ci: update actions/attest-build-provenance digest (a2bbfa2 → 0f67c3f) (#2976) (1a3c1b1)
ci: update actions/setup-go digest (4a36011 → 924ae3a) (#2970) (41f4c40)
ci: update dorny/paths-filter action (v4.0.1 → v4.0.2) (#2979) (90d03f7)
ci: update golangci/golangci-lint-action digest (82606bf → ba0d7d2) (#2977) (2cc0206)
deps: update image golang (32c0e6e → f96cc55) (#2978) (95d97fe)
deps: update image golang (792443b → 32c0e6e) (#2967) (efd1e95)

`v0.111.0`

Compare Source

Features

acme: add write-only data_wo argument to proxmox_acme_dns_plugin (#2962) (cd4ecd7)
disk: add support for ZFS disk/zpool creation with proxmox_node_disk_zfs (#2952) (087b1d0)
openid: add write-only client_key_wo to proxmox_realm_openid (#2964) (0ef7bdc)

Miscellaneous

ci: Update actions/checkout action (v6.0.3 → v7.0.0) (#2958) (0a5bf04)
docs: update README.md (5fd272a)

`v0.110.0`

Compare Source

Features

cluster: add dynamic crs ha scheduler and auto-rebalance options (#2940) (1b14b39)
file: add ImportState to proxmox_virtual_environment_download_file (#2938) (e7a1032)
storage: add options parameter for proxmox_storage_cifs resource (#2947) (e152990)
storage: add create_base_path and create_subdirs base options for cifs,nfs,dir storage resources (#2949) (c1262fd)

Bug Fixes

core: surface underlying error on SSH file transfer failure (#2956) (45d73a6)
node: accept string-typed startall-onboot-delay in node config (#2957) (87b7992)

Miscellaneous

deps: update image golang (68cb6d6 → 87a41d2) (#2941) (b5dafd8)
deps: update module golang.org/x/crypto (v0.52.0 → v0.53.0) (#2942) (5bedef1)
deps: update module golang.org/x/net (v0.55.0 → v0.56.0) (#2943) (804860f)

`v0.109.0`

Compare Source

⚠ BREAKING CHANGES

vm: restore ipv4_addresses on refresh for existing VMs (#2932)

Features

vm: add queues option for scsi disks (#2931) (f95abbc)

Bug Fixes

core: bound SSH dial and handshake with a timeout, improve concurrent sudo checks (#2924) (d59b7bb)
vm: restore ipv4_addresses on refresh for existing VMs (#2932) (fdcc890)

Miscellaneous

ci: update actions/checkout action (v6.0.2 → v6.0.3) (#2937) (832d2f8)
ci: update actions/checkout digest (de0fac2 → df4cb1c) (#2936) (e064604)
deps: update image golang (1.26.3 → 1.26.4) (#2933) (3159f24)

`v0.108.0`

Compare Source

Features

access: add audiences parameter to openid realm resource (#2907) (71cfead)
ceph: add proxmox_ceph_status data source (#2910) (776d8bf)
vm: add agent.wait_for_ip.enabled to disable IP lookup (#2923) (58db0a0)

Bug Fixes

access: only warn on inline acl when set in config (#2918) (05f106b)
core: correct errors in diagnostic messages (#2873) (6dfdfb6)
lxc: apply idmap on first boot after container create (#2922) (f062e3e)
vm: prevent VM restart on import from keyboard/agent defaults (#2911) (7080ae0)
vm: refresh hook_script_file_id in read (#2921) (f8b2dd9)
vm: remove node-local devices before migration (#2837) (7290812)

Miscellaneous

ci: update actions/stale digest (b5d41d4 → eb5cf3a) (#2920) (8e93ff7)
deps: update image golang (6df14f4 → 2d6c802) (#2916) (50673a0)
deps: update module github.com/rogpeppe/go-internal (v1.14.1 → v1.15.0) (#2917) (b0c896e)

`v0.107.0`

Compare Source

Features

ceph: add proxmox_ceph_pool resource (#2884) (8fb6738)
ha: add failback attribute to haresource (#2865) (1b5e7d8)
node: add node_config resource and datasource (#2875) (e00e81a)

Bug Fixes

access: gate user/group acl read; deprecate inline acl (e40c1ab)
lxc: avoid nil-bool panic when disk block is omitted (#2908) (053ce10)
lxc: skip empty config PUT for lifecycle-only updates (#2888) (32b1194)
sdn: add missing acceptance build tag to EVPN Zone test (#2872) (93ed6a8)

Miscellaneous

ci: update actions/create-github-app-token action (v3.1.1 → v3.2.0) (#2879) (84f9d53)
ci: update golangci/golangci-lint-action digest (1e7e51e → 82606bf) (#2903) (287ae68)
ci: update goreleaser/goreleaser-action action (v7.2.1 → v7.2.2) (#2909) (4e63070)
ci: update hashicorp/setup-terraform action (v4.0.0 → v4.0.1) (#2878) (519319e)
ci: update hashicorp/setup-terraform digest (5e8dbf3 → dfe3c3f) (#2876) (e9d0381)
ci: use pull_request_target in project-automation (f40c393)
deps: update golangci/golangci-lint (v2.12.1 → v2.12.2) (#2867) (832e174)
deps: update image golang (1.26.2 → 1.26.3) (#2868) (a729891)
deps: update image golang (2981696 → 313faae) (#2877) (4237a30)
deps: update image golang (313faae → 6df14f4) (#2904) (1c97160)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.14.1 → v7.15.0) (#2885) (b4d87e8)
deps: update module golang.org/x/crypto (v0.51.0 → v0.52.0) (#2905) (5c4d15d)
deps: update module golang.org/x/net (v0.53.0 → v0.54.0) (#2870) (c4f2de6)
deps: update module golang.org/x/net (v0.54.0 → v0.55.0) (#2906) (ecb905d)
docs: update terraform local (2.8.0 → 2.9.0) (#2880) (7b51658)
docs: update terraform tls (4.2.1 → 4.3.0) (#2881) (15fc5ab)
vm2: error format sweep (#2861) (047c4d4)

`v0.106.0`

Compare Source

Features

lxc: add support for mknod() feature (#2845) (07f91b4)

Bug Fixes

lxc: allow disabling feature flags on update (#2857) (2f3ae58)
lxc: refresh features, start_on_boot, hookscript in read (#2852) (e316aba)
network: allow unknown ports on linux bridge validate (#2855) (dacac9c)

Miscellaneous

ci: Update actions/add-to-project action (v1.0.2 → v2) (#2860) (5939390)

`v0.105.0`

Compare Source

Features

core: add SFTP file upload method (#2836) (39ca5d3)
network: add vids attribute to proxmox_network_linux_bridge (#2841) (f391b1c)
sdn: add support for EVPN controller (#2839) (ed23beb)

Bug Fixes

acme: mark eab_hmac_key and eab_kid as Sensitive (#2838) (30051b2)
ci: derive bot identity from app-slug output, not /app endpoint (b801d67)
ci: read release PR branch from action output, not gh pr view (52565bb)
lxc: gate host_managed on PVE 9.1+, not 9.0+ (#2828) (d348aed)
network: catch omitted vlan_aware in vids validator (#2849) (9e47424)

Miscellaneous

ci: update goreleaser/goreleaser-action action (v7.1.0 → v7.2.1) (#2831) (2506f61)
ci: Update JetBrains/qodana-action action (v2025.3.2 → v2026.1.0) (#2834) (d485cc9)
code: address Qodana code-quality findings (#2827) (b0e08d7)
core: add nil-safe helpers for nil to value conversion (#2829) (03493e9)
deps: update golangci/golangci-lint (v2.11.4 → v2.12.1) (#2844) (c3a14a3)
deps: update image golang (1e598ea → b54cbf5) (#2830) (16c2280)
deps: update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.40.0 → v2.40.1) (#2843) (114ce5a)
docs: configure context7.json indexing with version sync (ac70974)
lxc: restructure container docs for LLM retrieval (#2833) (7d264d8)

`v0.104.0`

Compare Source

Features

lxc: add host_managed option for container networking (#2812) (03dcffb)

Bug Fixes

lxc: apply disk acl/quota/replicate on container create (#2824) (0d64b73)
vm: stop re-emitting format= on existing import_from disks (#2822) (edfdac6)
vm: treat missing disk volume as not-found during read (#2821) (07cd772)

Miscellaneous

ci: Update googleapis/release-please-action action (v4.4.1 → v5) (#2820) (c607cbc)
ci: update goreleaser/goreleaser-action action (v7.0.0 → v7.1.0) (#2823) (4d86ada)
deps: update github.com/hashicorp/terraform-plugin-* (#2819) (65e1e16)
deps: update image golang (5f3787b → 1e598ea) (#2818) (4e2d74e)
vm2: add design for VM Plugin Framework migration (d824227)
vm2: audit VM resource implementation (#2810) (618e0cb)
vm2: mark PR #1 merged in tracker (8624144)

`v0.103.0`

Compare Source

Features

cluster: refactoring and improving proxmox_metrics_server (#2805) (354abf4)
file: add file_name_regex filter to proxmox_files data source (#2802) (c84eca9)
hw: add proxmox_hardware_pci data source (#2799) (76618a1)

Miscellaneous

cluster: align cluster_options with ADR-003/005 (#2804) (829ba6b)
deps: update image golang (fcdb3e4 → 5f3787b) (#2807) (d067ce0)

`v0.102.0`

Compare Source

⚠ BREAKING CHANGES

lxc: use computed cpu.units value instead of hardcoded 1024 (#2791)

Features

provider: add node_address_source ssh attribute for DNS-based node resolution (#2792) (87d0abb)
vm: add upgrade attribute to cloud-init initialization block (#2788) (e828b52)
vm: wait for guest agent readiness before reboot (#2790) (40317ec)

Bug Fixes

example: update /example/* to use short aliases (d6f1680)
lxc: use computed cpu.units value instead of hardcoded 1024 (#2791) (b54e6c5)

Miscellaneous

ci: update actions/create-github-app-token action (v3.0.0 → v3.1.1) (#2796) (8397ff6)
ci: update actions/setup-go digest (4b73464 → 4a36011) (#2793) (bfbf78c)
ci: update actions/upload-artifact digest (bbbca2d → 043fb46) (#2794) (5c82af8)
ci: update googleapis/release-please-action action (v4.4.0 → v4.4.1) (#2798) (7b10d95)
code: update to use Golang 1.26.x (#2785) (d2f3c70)
deps: update image golang (2a2b4b5 → fcdb3e4) (#2797) (32d0937)
deps: update module github.com/hashicorp/terraform-plugin-mux (v0.23.0 → v0.23.1) (#2795) (19925da)
docs: codify audit-discovered conventions into ADR-003/004/005 (#2787) (d8c8c75)
docs: update links to reference bpg.sh for documentation (b36528a)
docs: update upgrade.md guide (befb41d)

`v0.101.1`

Compare Source

Bug Fixes

docs: add missing examples and import sections for short-name aliases (#2784) (5f59d52)

Miscellaneous

ci: Update actions/github-script action (v8 → v9) (#2782) (c8c9823)
deps: update image golang (1.26.1 → 1.26.2) (#2778) (6805a82)
deps: update image golang (595c784 → cd78d88) (#2777) (ef0c04d)
deps: update module golang.org/x/crypto (v0.49.0 → v0.50.0) (#2780) (a963a30)
deps: update module golang.org/x/net (v0.52.0 → v0.53.0) (#2781) (d167c32)

`v0.101.0`

Compare Source

⚠ BREAKING CHANGES

vm: fix and improve VM datasources, deprecate SDK datasource (#2764)

Features

core: surface PVE task warnings from VM/container operations (#2761) (28850c8)
lxc: add cpu.limit attribute for containers (#2744) (cb25180)
lxc: add full flag to clone block (#2755) (f7010e1)
network: add linux bond interface resource (5db6deb), closes #1980

Bug Fixes

docs: add storage import docs (#2759) (079902f)
hwmapping,ha: better 'not-found' detection in read and delete (#2767) (ac53f8c)
network: adjust Linux Bridge name validator to PVE UI constraint (#2762) (190f7fa)
network: improve consistency of linux network interface resources (#2776) (57a97ce)
vm: fix and improve VM datasources, deprecate SDK datasource (#2764) (0ce6d0c)
vm: use move_disk API for EFI disk and TPM state storage migration (#2757) (c78c873)

Miscellaneous

deps: update module github.com/hashicorp/go-version (v1.8.0 → v1.9.0) (#2760) (7362ba5)
docs: update terraform local (2.7.0 → 2.8.0) (#2765) (0424b01)

`v0.100.0`

Compare Source

⚠ BREAKING CHANGES

vm: set power state of VM centrally (#2508)

Features

access: add short-name aliases for access resources (#2720) (8b690cf)
acme: add short-name aliases for ACME resources (#2721) (d386759)
cluster: add short-name aliases for cluster resources (#2725) (8fafc04)
ha: add short-name aliases for HA resources (#2722) (acd0d9f)
node: add short-name aliases for node resources (#2726) (33914d5)
provider: add short-name aliases for vm, version, and pool resources (#2728) (38dca5a)
sdn: add short-name aliases for SDN resources (#2724) (0028588)
storage: add short-name aliases for storage resources (#2727) (798f1ea)

Bug Fixes

cpu: update docs, tests (033b8f5)
docs: update broken doc links (#2754) (b7d0242)
lychee: update comments for clarity (6fea54e)
vm: mark disk size as computed to prevent passthrough drift (#2718) (cba4dd6)
vm: prevent disk resize revert when combined with config changes (#2751) (f45cf78)
vm: set power state of VM centrally (#2508) (b8ceecd)
vm: support fractional cpulimit values (#2745) (445e47c)

Miscellaneous

core: add migration helpers for resource type name rename (ADR-007) (#2719) (b2bb732)
deps: update golangci/golangci-lint (v2.11.3 → v2.11.4) (#2729) (f95bc46)
dev: update ADRs and reference examples (#2752) (15afbe8)
dev: update code-review skill (a7a489f)
docs: document usage of ZFS storage in acc tests (2eca921)
docs: update FWK reference examples documentation (c20d0be)
test: add tier-based and resource-targeted test execution (#2753) (31b4706)
test: improve acceptance test stability and reliability (#2746) (f54fca2)

`v0.99.0`

Compare Source

Features

backup: add proxmox_backup_job resource and proxmox_backup_jobs data source (#2711) (92b3e88)
file: add proxmox_files data source (#2703) (e848a57)
ha: add proxmox_virtual_environment_harule resource (PVE 9+) (#2682) (31ab05a)
provider: add support for replication (#2661) (ca9a5f7)

Bug Fixes

access: remove overly restrictive username_claim validation on openid realm (#2685) (7782dc5)
ci: correct repository reference in sync-docs workflow (f225107)
ha: handle nil Strict value in HARule and update API response validation (3bf1e8c)
lxc: ignore warnings in container create and clone tasks (#2701) (7f7e36d)
vm: reboot after disk resize when disk is not hotpluggable (#2686) (4ffb2f1)
vm: skip cloud-init device update when only config changed (#2709) (46e8362)

Miscellaneous

ci: Update actions/create-github-app-token action (v2.2.1 → v3.0.0) (#2698) (7983416)
ci: Update dorny/paths-filter action (v3.0.2 → v4.0.1) (#2699) (9828faa)
ci: update jetbrains/qodana-action action (v2025.3.1 → v2025.3.2) (#2712) (98e9407)
deps: bump google.golang.org/grpc from 1.79.2 to 1.79.3 (#2713) (c653d7c)
deps: update github.com/hashicorp/terraform-plugin-* (#2693) (db6522f)
deps: update golangci/golangci-lint (#2670) (979ce29)
deps: update golangci/golangci-lint (v2.11.2 → v2.11.3) (#2692) (a737b37)
deps: update image golang (c7e98cc → 595c784) (#2708) (d6339f9)
deps: update image golang (e2ddb15 → c7e98cc) (#2691) (c33b2ab)
deps: update module golang.org/x/crypto (v0.48.0 → v0.49.0) (#2696) (e7484c2)
deps: update module golang.org/x/net (v0.51.0 → v0.52.0) (#2697) (951bc29)
dev: introduce ADR-007 for resource type name migration to shorter prefix (1c07f6d)

`v0.98.1`

Compare Source

Bug Fixes

pool: support nested pool IDs in API endpoints (#2680) (c6c726b)
provider: preserve null tos in ACME account when API returns empty string (#2672) (f9bbd7d)
vm: replace enumerated network and IP config fields with dynamic unmarshaling (#2679) (e5b2771)
vm: support removal of network devices from VM configuration (#2674) (9b5a978)

Miscellaneous

deps: update image golang (1.26.0 → 1.26.1) (#2669) (9a8d85b)
docs: clarify example prerequisites for SSH, node name, timezone, and DHCP (8f97a34)
vm: deprecate 'enabled' attribute on 'network_device' block (#2678) (65b809d)

`v0.98.0`

Compare Source

Features

access: add OpenID Connect realm resource and documentation (#2655) (51c7535)
lxc: add support for entrypoint attribute (#2543) (178a8ad)

Bug Fixes

lxc: wrong mapping of ignore-unpack-errors attr in create API request (8fe621d)
vm: add started attribute to cloned_vm resource (#2666) (d9b292a)

Miscellaneous

ci: Update crazy-max/ghaction-import-gpg action (v6.3.0 → v7.0.0) (#2665) (e77ea1e)
ci: Update peter-evans/repository-dispatch action (v3 → v4) (#2653) (3408558)
deps: bump cloudflare/circl to v1.6.3 (da4b6ab)
deps: update image golang (9edf713 → fb612b7) (#2663) (369254f)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.14.0 → v7.14.1) (#2664) (b25f773)
docs: fix broken links (c792dc9)
docs: remove TOC section from the main documentation page (d6638f7)
docs: update badge links in readme.md (7de7db1)
docs: update os type l26 linux kernel range for vm (#2657) (cdd7356)
docs: update shields in readme.md (8988f21)
docs: update terraform proxmox (0.97.0 → 0.97.1) (#2648) (6811fb3)
fwk: standardize model files (#2651) (911d8d3)

`v0.97.1`

Compare Source

Bug Fixes

firewall: handle missing security group in Read and fix id override Create (#2647) (f526c39)
hwmapping: enable nested USB hubs (#2636) (d42fe74)
vm,lxc: add name validation (#2631) (53cce6f)
vm: allow adding EFI disk without forcing VM replacement (#2645) (d636403)

Miscellaneous

ci: Update actions/attest-build-provenance action (v3 → v4) (#2641) (de5f833)
ci: update actions/setup-go digest (7a3fe6c → 4b73464) (#2643) (9af341a)
ci: Update actions/upload-artifact action (v6 → v7) (#2642) (4d84904)
ci: Update hashicorp/setup-terraform action (#2635) (af078b7)
ci: update lycheeverse/lychee-action action (v2.7.0 → v2.8.0) (#2638) (5271851)
deps: update github.com/hashicorp/terraform-plugin-* (#2634) (345f785)
deps: update image golang (c83e68f → 9edf713) (#2633) (c47a705)
deps: update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.38.2 → v2.39.0) (#2639) (8b3bff1)
deps: update module golang.org/x/net (v0.50.0 → v0.51.0) (#2640) (587d1fe)
docs: add vm-lifecycle, multi-node, and upgrade guides (#2628) (d2b8729)

`v0.97.0`

Compare Source

Features

lxc: implement idmap support via SSH config file editing (#2579) (63334e1)

Bug Fixes

ci: exclude ARM architecture for Windows builds in goreleaser (9c268a5)
docs: clarify SSH password inheritance with API token auth (#2624) (d453924)
firewall: handle "already exists" error in SG and IPSet create (#2627) (06f3c6f)
firewall: update rules with position awareness (#2593) (2bd6b98)
lxc, vm: add retries for LXC operations, unify retry logic into shared package (#2616) (39c0198)
storage: unknown encryption_key_fingerprint after PBS apply (#2625) (82c49fd)
vm: preserve disk deletions in update request (#2614) (b12111f)
vm: remove duplicate line in ipConfigObjects (#2618) (0a4ab5b)
vm: skip cdrom devices during disk read-back on import (#2626) (64c2db2)

Miscellaneous

ci: update actions/stale digest (9971854 → b5d41d4) (#2611) (fcead36)
ci: Update goreleaser/goreleaser-action action (v6.4.0 → v7.0.0) (#2623) (f7ab67d)
deps: update golangci/golangci-lint (v2.9.0 → v2.10.1) (#2603) (3e64ec4)
docs: update terraform local (2.6.2 → 2.7.0) (#2612) (6da27f6)

`v0.96.0`

Compare Source

Features

cluster: add otel options to metrics server resource (#2595) (32dfac8)
network: add configurable timeout for network reload operations (#2573) (ed8593d)

Bug Fixes

cluster: fix Description body-building bug and standardize delete handling in options (#2601) (a704bb1)
file: retry read-back after upload for distributed storage consistency (#2571) (989a4ba)
hwmapping: add comment validator, fix acceptance tests (#2609) (f943051)
network: properly delete cidr/cidr6 when address is removed from linux (#2587) (a52a11f)
network: properly delete optional fields when removed from VLAN config (#2599) (d0f1704)
node: add CPU utilization to node data source (#2605) (1a1cbbb)
sdn: avoid mtu=0 when omitted for sdn zones (#2584) (66c43d8)
sdn: better apply resiliency, fix import of a pending zone (#2610) (a9ea3c1)
vm: clean up orphaned re-import code and clarify import_from as create-only (#2568) (2160f00)

Miscellaneous

core: unify Delete field type across API client structs (#2604) (d6a66f4)
deps: update golangci/golangci-lint (v2.8.0 → v2.9.0) (#2589) (ee0f07f)
deps: update image golang (1.25.7 → 1.26.0) (#2590) (8f5d598)
deps: update module golang.org/x/crypto (v0.47.0 → v0.48.0) (#2591) (43c295b)
deps: update module golang.org/x/net (v0.49.0 → v0.50.0) (#2592) (7b83dd8)
test: do not run SDN acceptance tests in parallel (#2607) (ac1fabd)
test: fix parallel VM tests execution (#2608) (09500be)

`v0.95.0`

Compare Source

⚠ BREAKING CHANGES

node: correct cpu_count inconsistency between _node and _nodes data sources (#2559)

Bug Fixes

docs: update PR title guidelines for breaking changes and contributor notes (d884c4a)
lxc: apply start_on_boot and features on clone and update (#2562) (b21616a)
node: correct cpu_count inconsistency between _node and _nodes data sources (#2559) (c4d8d6b)
vm: apply custom timeouts on update operations (#2561) (e9bb225)
vm: correctly update hotpluggable devices (#2556) (9d4155a)
vm: reboot before disk resize to prevent pending changes from reverting size (#2563) (3465c84)

Miscellaneous

ci: Update actions/checkout action (v4.2.2 → v6.0.2) (#2554) (9262783)
ci: update actions/checkout digest (8e8c483 → de0fac2) (#2557) (db2bba1)
deps: update image golang (011d6e2 → cc73743) (#2564) (5b10da9)
deps: update image golang (1.25.6 → 1.25.7) (#2552) (d148eb0)
deps: update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.38.1 → v2.38.2) (#2553) (aa1b8ce)
dev: update templates and define skills for LLM agent flows (#2542) (615c670)
docs: add Architecture Decision Records for the dev process (#2546) (97317f6)
docs: add notice to enable 'Import' content type to allow its use with file resources (#2558) (90ce565)
docs: fix links in DEBUGGING.md (8beb699)

`v0.94.0`

Compare Source

Features

firewall: add proxmox_virtual_environment_node_firewall (#2502) (d45f269)

Bug Fixes

lxc: provision mount points when cloning containers (#2529) (67990d7), closes #2518 #2507
network: update reload timeout and retry (#2510) (f66b9dd)
sdn: correct EVPN resource handling and improvements to base zone (#2501) (c159715)
storage: add validator for acceptable values for storage content and update docs (#2519) (fc8b018)
vm: add missing cpu types (#2499) (f51c8df)
vm: handle nil ip_config block in cloud-init during clone (#2527) (4ed5433)
vm: require reboot for CPU core or socket changes (#2534) (3ca754c), closes #2516

`v0.93.1`

Compare Source

Bug Fixes

docs: prevent path traversal in sudoers tee configuration (#2524) (bd604c4)

Miscellaneous

ci: update actions/checkout action (v6.0.1 → v6.0.2) (#2521) (84e0b97)
ci: update actions/setup-go digest (4dc6199 → 7a3fe6c) (#2520) (1a1174c)
deps: update image golang (1.25.5 → 1.25.6) (#2504) (3e75bbb)
deps: update image golang (6cc2338 → 8bbd140) (#2503) (d087c97)
deps: update module golang.org/x/net (v0.48.0 → v0.49.0) (#2506) (9fe808a)
docs: update terraform local (2.6.1 → 2.6.2) (#2522) (8c64b5e)
docs: update terraform tls (4.1.0 → 4.2.1) (#2523) (94d9dd3)

`v0.93.0`

Compare Source

Features

lxc: add path_in_datastore computed attribute for cross-resource refs (#2493) (616ec37)
lxc: enable root disk resize without recreate (#2321) (581782c)
vm: add ha-aware migration for ha-managed vms (#2476) (4f5b4fb)
vm: add support for hotplug parameter (#2356) (891fd41)

Bug Fixes

docs: improve provider documentation readability and structure (#2487) (b9457fa)
example: make lxc container use root provider so it works (#2458) (7e1a379)
lxc: allow mounting existing subvol with size argument (#2491) (0b9e1e0)
ssh: harden try_sudo for PVE 9, improve shell compatibility (#2480) (f3dd703)
vm: prevent initialization drift when cloning VM with user_account (#2486) (dbd4fd5)
vm: resizing disk deletes cdrom / cloud-init (#2484) (ae17149)

Miscellaneous

docs: minor docs fixes and improvements (#2481) (b52af8d)

`v0.92.0`

Compare Source

⚠ BREAKING CHANGES

The proxmox_virtual_environment_download_file resource now checks the upstream URL's Content-Length during every refresh with overwrite=true (default). This restores the original behavior from v0.33.0 that was accidentally removed in v0.78.2. Users who want to disable upstream checking should set overwrite=false.
The proxmox_virtual_environment_firewall_options resource now requires exactly one of vm_id or container_id to be specified. Previously, configurations with only node_name would pass validation but fail at runtime. This change enforces the requirement at validation time.

Features

access: add LDAP realm and sync resources (#2454) (085b73b), closes #1871
docs: add universal LLM Agent instructions and contribution guidelines (#2473) (16abacc)

Bug Fixes

api: detect TFA requirement and return clear error message (#2477) (876849d)
docs: clarify documentation workflow for FWK resources (#2475) (7bd295a)
docs: fix broken links in docs (#2464) (cdeddf8)
docs: update reference to setting up proxmox (#2455) (3c11ffd)
file: restore upstream URL change detection in download_file (#2474) (ad181ee), closes #2470
firewall: make vm_id/container_id required in VM/Container -level firewall options (#2453) (5ded5d4)
storage: prevent "was absent, but now present" error for backups block (#2465) (501c09b)
vm: allow vcpus hotplug without reboot (#2466) (f864d36)
vm: correct disk speed settings for multiple disks and update detection (#2478) (0889c74)

Miscellaneous

deps: update golangci/golangci-lint (v2.7.2 → v2.8.0) (#2472) (5009161)
deps: Update module github.com/avast/retry-go/v4 (v4.7.0 → v5.0.0) (#2452) (1f664be)
docs: remove outdated Ceph handles from apt_standard_repository docs (#2471) (ccbaabd), closes #2421
docs: update terraform proxmox (0.90.0 → 0.91.0) (#2459) (d175ef0)

`v0.91.0`

Compare Source

Features

acme: add support for certificate ordering (#2292) (a2a970d)
sdn: add support for Fabric resources (#2444) (b223dad)
storage: add support for provisioning storage types (NFS/CIFS/PBS/Directory/LVM) (#2130) (f361704)

Bug Fixes

core: handle scientific notation in CustomInt/CustomInt64 unmarshaling (#2431) (4baff92)
vm: allow TPM state updates in place (#2446) (f8717c4)

Miscellaneous

code: cleanup issues reported by static code alalysis (#2442) (686e575)
code: cleanups and linter rules adjustment (#2443) (1eee491)
deps: update image golang (36b4f45 → b6ba523) (#2439) (f82f03c)
deps: update image golang (b6ba523 → 6cc2338) (#2448) (2b22bde)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.12.1 → v7.14.0) (#2438) (4bdd335)
deps: update module github.com/google/go-querystring (v1.1.0 → v1.2.0) (#2440) (ad6b9b2)
docs: add guide for creating VMs from compressed cloud images (#2449) (daa339b)
docs: update contributing guidelines and dev setup guides (#2447) (371e0a1)
docs: update terraform proxmox (0.89.1 → 0.90.0) (#2435) (975f818)

`v0.90.0`

Compare Source

Features

cloned_vm: add cloned VM resource implementation (#2424) (88cad5c)
provider: add ContentType in ListDatastoreFiles (#2423) (773b174)

Miscellaneous

ci: Update actions/upload-artifact action (v5 → v6) (#2419) (3021c54)
ci: update jetbrains/qodana-action action (v2025.2.3 → v2025.2.4) (#2426) (5b2e9ea)
ci: update jetbrains/qodana-action action (v2025.2.4 → v2025.3.1) (#2434) (db3c5bf)
deps: update image golang (20b91ed → a22b2e6) (#2418) (fa883ec)
deps: update image golang (a22b2e6 → 36b4f45) (#2425) (11fccbe)
docs and dev UX improvements (#2427) (a034e8b)

`v0.89.1`

Compare Source

Bug Fixes

vm,lxc: revert deprecation notice for pool_id attribute (#2405) (af3efa9)
vm: allow EFI disk parameter updates without VM recreation (51b8d39), closes #1515
vm: handle disk size mismatch when re-adding removed disk (#2411) (d7346d4)
vm: match CPU type format with PVE (#2409) (63f22db)
vm: prevent perpetual diff when using pool_membership without pool_id (#2408) (acc95bf)
vm: prevent unnecessary reboots on hotplug operations (#2412) (77dc49e), closes #538
vm: retry disk resize on 'does not exist' errors (#2407) (f5f5437)
vm: retry HTTP 500 errors when waiting for agent retrieving IPs (#2410) (c324ef0)

Miscellaneous

ci: update jetbrains/qodana-action action (v2025.2.2 → v2025.2.3) (#2400) (893fd6d)
deps: update golangci/golangci-lint (v2.7.1 → v2.7.2) (#2413) (99e30e1)
deps: update module golang.org/x/crypto (v0.45.0 → v0.46.0) (#2414) (67ac0b1)
deps: update module golang.org/x/net (v0.47.0 → v0.48.0) (#2415) (b0aabfd)

`v0.89.0`

Compare Source

⚠ BREAKING CHANGES

vm: revert cpu.units default to use PVE server default (#2402)

Features

lxc: add env parameter support (#2383) (ef134fc)
oci: add proxmox_virtual_environment_oci_image resource for OCI Images Management (#2373) (86a5bf1)
sdn: add possibility to apply SDN changes on a particular actions (#2386) (01e6433)

Bug Fixes

vm: do not re-import existing disks during update (#2401) (0c7fad9)
vm: revert cpu.units default to use PVE server default (#2402) (c9b8a3f)

Miscellaneous

ci: pin dependencies (#2388) (84bf77d)
ci: update actions/checkout action (v6.0.0 → v6.0.1) (#2398) (5eb8020)
ci: update actions/checkout digest (1af3b93 → 8e8c483) (#2396) (a9926ca)
ci: update actions/create-github-app-token action (v2.2.0 → v2.2.1) (#2399) (2f6c1b4)
ci: Update actions/github-script action (v7 → v8) (#2394) (aaef00e)
ci: update actions/stale digest (5f858e3 → 9971854) (#2397) (cd63393)
ci: update golangci/golangci-lint-action digest (e7fa5ac → 1e7e51e) (#2389) (6593102)
deps: update github.com/hashicorp/terraform-plugin-* (#2392) (459cdfc)
deps: update golangci/golangci-lint (v2.6.2 → v2.7.1) (#2393) (4b5652f)
deps: update image golang (1.25.4 → 1.25.5) (#2390) (54e6aa5)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.12.0 → v7.12.1) (#2391) (5952ae7)

`v0.88.0`

Compare Source

Features

provider: add OTel implementation for metrics resource (#2372) (d37a8bb)
vm,lxc: add wait_for_ip configuration for agent/network interfaces (#2362) (f24add3)
vm: support custom cloud init drive file format (#2375) (ddccd0a)

Bug Fixes

apt: add support for modern APT sources (PVE9+) (#2376) (6f6edec)
disk: restore updating boot disk. (#2150) (0da0bcb)
example: comment out otel metrics server resource (fc94e2a)
lxc: allow container creation/update with correct mountoptions (#2319) (c2dc3a7)
lxc: ignore link-local addresses when waiting for network IPs (#2357) (8c081f5)
vm: convert to template using proper endpoint (#2340) (5615298)
vm: prevent state changes after VM import (#2294) (f0bb501)

Miscellaneous

ci: Update actions/checkout action (#2361) (f5d4676)
ci: update actions/create-github-app-token action (v2.1.4 → v2.2.0) (#2366) (3055dc2)
ci: update actions/setup-go digest (4469467 → 4dc6199) (#2365) (bcce7da)
ci: update golangci/golangci-lint-action digest (0a35821 → e7fa5ac) (#2358) (dd416a1)
ci: update jetbrains/qodana-action action (v2025.2.1 → v2025.2.2) (#2360) (092df22)
deps: update golangci/golangci-lint (v2.5.0 → v2.6.2) (#2304) (0937f2b)
deps: update image golang (e68f6a0 → f60eaa8) (#2359) (b80a193)
deps: update image golang (f60eaa8 → 6981837) (#2370) (faf56bc)
deps: Update module github.com/avast/retry-go/v4 (v4.7.0 → v5.0.0) (#2380) (630240d)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.10.0 → v7.11.0) (#2379) (5e55d92)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.11.0 → v7.12.0) (#2384) (2f7bbb1)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.9.0 → v7.10.0) (#2371) (d3b4847)
deps: update module github.com/hashicorp/go-version (v1.7.0 → v1.8.0) (#2381) (ad38c5b)
deps: update module golang.org/x/crypto (v0.44.0 → v0.45.0) [security] (#2348) (78ce72e)
docs: update terraform local (2.5.3 → 2.6.1) (#2367) (d5b3c64)
update docs to pve 9.1, fix example tests (#2350) (6e2a5aa)
vm: refactor network devices update logic (#2260) (db3d7ec)

`v0.87.0`

Compare Source

Features

pool: add pool_membership resource (#2297) (95f180b)
sdn: add support for VNets datasource (#2299) (c25f19a)
vm: add purge_on_destroy and delete_unreferenced_disks_on_destroy parameters (#2345) (05a59aa)

Bug Fixes

access: imported group resource missing group_id (#2333) (ee1c525)
apt: add missing Ceph Squid (#2318) (8b9bf62)
file: better error message for unsupported import content type (#2344) (f94e25d)
firewall: appending a rule without re-creating the whole ruleset (#2310) (6290cce)
lxc: panic when cloning a container with empty IP config (#2347) (0a259ca)
lxc: race condition in container clone / reboot operations (#2320) (ce358d5)
sdn: fix subnet datasource IP address datatype (#2300) (7ffb314)
ssh: update sudo check logic and cache check results (#2309) (702500c)
vm: increase max disk limit to 31 (#2302) (2ae021a)

Miscellaneous

ci: Update golangci/golangci-lint-action action (v8 → v9) (#2330) (90810fa)
ci: update lycheeverse/lychee-action action (v2.6.1 → v2.7.0) (#2305) (9a788da)
deps: update image golang (1.25.3 → 1.25.4) (#2328) (90f876f)
deps: update image golang (6ca9eb0 → e68f6a0) (#2335) (5354d6b)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.8.1 → v7.8.2) (#2303) (cd9b5fb)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.8.2 → v7.9.0) (#2329) (76680dd)
deps: update module github.com/hashicorp/terraform-plugin-log (v0.9.0 → v0.10.0) (#2336) (6dd51fd)
deps: update module golang.org/x/crypto (v0.43.0 → v0.44.0) (#2337) (fb3fbfc)
deps: update module golang.org/x/net (v0.46.0 → v0.47.0) (#2338) (9f57e9f)
docs: document auto option for enabling SLAAC in IPv6 config in vm and lxc (#2317) (e8c70d7)
docs: update the main doc page for consistency (#2326) (7e4f421)
lxc,vm: add deprecation notice for pool_id attribute (#2312) (3c507cc)

`v0.86.0`

Compare Source

Features

firewall: ability to import firewall rules & options (#2269) (dd1afe6)
firewall: add ability to import ipsets (#2280) (33c751d)
firewall: support node-level firewall rules (#2281) (18c675b)

Bug Fixes

lxc: delete dns attributes when set to null (#2263) (a32988a)
vm: correctly detect pool membership for VM (#2264) (5a5c9c6)

Miscellaneous

ci: Update actions/upload-artifact action (v4 → v5) (#2275) (ad4bbd7)
ci: update googleapis/release-please-action action (v4.3.0 → v4.4.0) (#2273) (0bcba7b)
deps: update image golang (7d73c4c → 8c945d3) (#2253) (a2bb9b6)
deps: update image golang (8c945d3 → dd08f76) (#2270) (4c1514f)
deps: update image golang (dd08f76 → 6bac879) (#2283) (0c9879a)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.8.0 → v7.8.1) (#2271) (11d4c71)
deps: update module github.com/hashicorp/terraform-plugin-framework-timeouts (v0.6.0 → v0.7.0) (#2274) (b9ccb0d)
deps: update module github.com/pkg/sftp (v1.13.9 → v1.13.10) (#2272) (fdbe313)
docs: update CONTRIBUTING.md (#2278) (110093b)

`v0.85.1`

Compare Source

Bug Fixes

docs: clarify that ip in ct ip_config must be in CIDR notation (#2238) (f3b835f)
lxc: DNS / hostname update is not applied (#2245) (9aa1eaf)
sdn: add missing dhcp field to simple zone datasource (#2243) (b4b8d09)
sdn: handle attribute delete in all SDN resources (#2248) (50accca)
sdn: zone: make nodes attribute optional (#2242) (798623b)

Miscellaneous

deps: update image golang (1.25.2 → 1.25.3) (#2246) (3d2092f)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.7.3 → v7.8.0) (#2241) (ecf7920)
deps: update module github.com/hashicorp/terraform-plugin-docs (v0.23.0 → v0.24.0) (#2247) (6e23c90)

`v0.85.0`

Compare Source

Features

sdn: Add DHCP Config for SDN Simple Zone Resource (#2210) (f5d3d92)

Bug Fixes

file: add import content type to file datasource (#2221) (f918bed)
vm: allow cpu units = 1 for cgroups v2 compatibility (#2237) (3fc688b)

Miscellaneous

ci: update actions/stale digest (3a9db7e → 5f858e3) (#2222) (b38066b)
ci: Update peter-evans/create-issue-from-file action (v5.0.1 → v6.0.0) (#2217) (29748a5)
deps: update image golang (1.25.1 → 1.25.2) (#2228) (9e77057)
deps: update image golang (8305f5f → ab1f5c4) (#2215) (6a1f972)
deps: update module github.com/hashicorp/terraform-plugin-framework (v1.16.0 → v1.16.1) (#2216) (515c6bb)
deps: update module github.com/hashicorp/terraform-plugin-framework-validators (v0.18.0 → v0.19.0) (#2230) (761fb70)
deps: update module github.com/skeema/knownhosts (v1.3.1 → v1.3.2) (#2229) (b6022d4)
deps: update module golang.org/x/net (v0.44.0 → v0.45.0) (#2231) (60fdfd6)
deps: update module golang.org/x/net (v0.45.0 → v0.46.0) (#2236) (68bd667)

`v0.84.1`

Compare Source

Bug Fixes

api: handle PVE API's 403 response status (#2207) (46e8c24)
sdn: subnet validation errors when using value interpolation (#2204) (5f876c0)

Miscellaneous

deps: update golangci/golangci-lint (v2.4.0 → v2.5.0) (#2193) (2ab3d94)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.7.1 → v7.7.3) (#2203) (3692434)
deps: update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.38.0 → v2.38.1) (#2197) (0387296)

`v0.84.0`

Compare Source

Features

file: add file datasource (#2176) (8244813)
sdn: add support for Subnet resource and datasource (#2191) (1df305d)
sdn: add support for VNet resource and datasource (#2185) (8938d86)

Miscellaneous

deps: update github.com/hashicorp/terraform-plugin-* (#2187) (09b704a)
deps: update image golang (bb979b2 → 8305f5f) (#2186) (b70fa62)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.6.0 → v7.7.0) (#2189) (46dbc68)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.7.0 → v7.7.1) (#2192) (11f4002)
deps: update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.37.0 → v2.38.0) (#2188) (2b2d619)

`v0.83.2`

Compare Source

Bug Fixes

firewall: detect drift when rules are manually deleted (#2178) (6b84d5a)
firewall: prevent perpetual plan drift on rule attribute removal (#2177) (0e72580)
vm: disk deletion may reorder disks (#2174) (e339fef)

Miscellaneous

ci: update actions/create-github-app-token action (v2.1.1 → v2.1.4) (#2179) (70cfb58)
deps: update image golang (b773c94 → bb979b2) (#2173) (7944277)

`v0.83.1`

Compare Source

Bug Fixes

ci: update link checker config (#2151) (e017881)

Miscellaneous

ci: Update actions/setup-go action (v5 → v6) (#2154) (16814d4)
ci: Update actions/stale action (v9 → v10) (#2155) (87e6392)
code: minor code cleanups (#2156)ssh (9e22c3c)
deps: update image golang (1.25.0 → 1.25.1) (#2153) (a58bf4f)
deps: update image golang (a5e935d → d6bdb04) (#2161) (58d833d)
deps: update image golang (d6bdb04 → b773c94) (#2169) (a979850)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.5.1 → v7.6.0) (#2162) (ffdc3a5)
deps: update module golang.org/x/crypto (v0.41.0 → v0.42.0) (#2163) (4e73d56)
deps: update module golang.org/x/net (v0.43.0 → v0.44.0) (#2170) (ed366b5)
docs: improve container documentation (#2160) (380fd7f)
docs: improve vm.initialization documentation (#2158) (29ef9d2)
docs: include vm/lxc lock error details in the README known issues section (#2166) (1810273)
docs: update reference to release-build in contributing doc (#2167) (739471a)
docs: update sdn_applier example (c275e03)

`v0.83.0`

Compare Source

Features

sdn: add custom resource to apply sdn_* configurations (#2127) (e13d7ef)

Bug Fixes

docs: correct minor typos / formatting (#2144) (a2e4ff0)

Miscellaneous

ci: Update actions/attest-build-provenance action (v2 → v3) (#2142) (f62e69d)
ci: update googleapis/release-please-action action (v4.2.0 → v4.3.0) (#2136) (f634b2e)
ci: update lycheeverse/lychee-action action (v2.5.0 → v2.6.0) (#2137) (64c1ab3)
ci: update lycheeverse/lychee-action action (v2.6.0 → v2.6.1) (#2138) (7f56290)
deps: update image golang (4859242 → 5502b0e) (#2134) (20f41e8)
deps: update image golang (91e2cd4 → 4859242) (#2128) (9ae882e)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.3.0 → v7.4.0) (#2129) (11b8167)
deps: update module github.com/brianvoe/gofakeit/v7 (v7.4.0 → v7.5.1) (#2143) (2eae3ee)
deps: update module github.com/stretchr/testify (v1.10.0 → v1.11.1) (#2135) (6b00db6)

`v0.82.1`

Compare Source

Bug Fixes

vm: prevent re-creation of previously imported disks on update (#2122) (c6c1c18)

Miscellaneous

deps: update image golang (9e56f0d → 91e2cd4) (#2123) (9d179dd)
docs: fix TOC format, cleanup cloud image guide (#2121) (b321a01)

`v0.82.0`

Compare Source

Features

docs: update compatibility notes for PVE 9.x (#2116) (08ea66a)
lxc: add proxmox_virtual_environment_containers data source (#2090) (45f2805)
lxc: Add missing configuration options for container rootfs (#2067) (b2c5012)

Bug Fixes

lxc: adjust max number of container's IP configs (#2088) (602568e)
provider: parsing PVE version reported by API (#2115) (f1501e2)
vm: regression: disk re-ordering on re-apply (#2114) (634ad69)

Miscellaneous

ci: Update actions/checkout action (#2098) (3855cb2)
ci: update actions/create-github-app-token action (v2.0.6 → v2.1.0) (#2095) (6161969)
ci: update actions/create-github-app-token action (v2.1.0 → v2.1.1) (#2099) (7f5d771)
ci: update goreleaser/goreleaser-action action (v6.3.0 → v6.4.0) (#2111) (78ce7f0)
ci: update jetbrains/qodana-action action (v2025.1.1 → v2025.2.1) (#2106) (0dec643)
ci: update lycheeverse/lychee-action action (v2.4.1 → v2.5.0) (#2096) (7c98464)
deps: update golangci/golangci-lint (v2.3.0 → v2.3.1) (#2074) (9947a86)
deps: update golangci/golangci-lint (v2.3.1 → v2.4.0) (#2110) (21bed82)
deps: update image golang (1.24.5 → 1.24.6) (#2085) (ac91fe8)
deps: update image golang (1.24.6 → 1.25.0) (#2107) (9e10206)
deps: update image golang (10a15b9 → 9e56f0d) (#2109) (420add8)
deps: update module github.com/hashicorp/terraform-plugin-testing (v1.13.2 → v1.13.3) (#2113) (1863847)
deps: update module golang.org/x/crypto (v0.40.0 → v0.41.0) (#2086) (5018b31)
deps: update module golang.org/x/net (v0.42.0 → v0.43.0) (#2087) (5151dcc)
docs: cleanup and update clone-vm example (#2094) (c7cd61a)
docs: remove spurious sdn datasource .tf examples (#2092) (91e0fbf)

rancher/local-path-provisioner (rancher/local-path-provisioner)

`v0.0.37`: Local Path Provisioner v0.0.37

Compare Source

What's Changed

build(deps): bump golang.org/x/net from 0.38.0 to 0.55.0 by @dependabot[bot] in #584
fix: use alpine as base image for package/Dockerfile to avoid shippin… by @alexiiiiiiiiiiiiiii in #585
add storageclass nodeaffinity to helm values by @clayrosenthal in #581
fix: update golang.org/x/text to v0.39.0 (CVE-2026-56852) by @derekbit with @Copilot in #587
Add initial Renovate configuration by @renovate-rancher[bot] in #589
chore(deps): update golang docker tag to v1.26.5 by @renovate-rancher[bot] in #591
chore(deps): update github actions by @renovate-rancher[bot] in #590
chore(deps): update module github.com/sirupsen/logrus to v1.9.4 by @renovate-rancher[bot] in #593
chore(deps): update docker/dockerfile docker tag to v1.25.0 by @renovate-rancher[bot] in #594
chore(deps): update module github.com/stretchr/testify to v1.11.1 by @renovate-rancher[bot] in #595
chore(deps): update github/codeql-action digest to 4187e74 by @renovate-rancher[bot] in #592
chore(deps): update centos docker tag to v8 by @renovate-rancher[bot] in #596
chore(deps): update github actions (major) by @renovate-rancher[bot] in #597
chore(deps): update almalinux docker tag to v10 by @renovate-rancher[bot] in #601
chore(deps): update github actions by @renovate-rancher[bot] in #600
fix: bump golang.org/x/net to v0.56.0 (CVE-2026-46600) by @derekbit with @Copilot in #588
Add initial /health probe by @jcpunk in #583
fix: fix validation errors by @derekbit in #602
chore(deps): update github/codeql-action digest to d1ba80a by @renovate-rancher[bot] in #603
fix: upgrade kind to v0.32.0 for containerd config v4 support by @derekbit in #605
fix: select PV by bound PVC in TestPodWithCustomNodeAffinityKey by @derekbit in #606
chore: upgrade github.com/urfave/cli to v3 by @derekbit in #607
fix: remove kind's built-in local-path-provisioner in e2e setup to avoid provisioner race by @derekbit in #608
fix: use multi-stage scratch build for released image to drop shell and Go toolchain by @derekbit in #609
Support exposing user, group and perm patterns by @treydock in #560
test: add e2e coverage for user/group/perm patterns by @derekbit in #611
chore(deps): update actions/stale action to v11 by @renovate-rancher[bot] in #604
chore: release v0.0.37 by @derekbit in #612

New Contributors

@alexiiiiiiiiiiiiiii made their first contribution in #585
@clayrosenthal made their first contribution in #581
@treydock made their first contribution in #560

Full Changelog: https://github.com/rancher/local-path-provisioner/compare/v0.0.36...v0.0.37

ahamlinman/terraform-provider-zonefile (zonefile)

`v0.2.0`

Compare Source

This release migrates the provider's Go module path and TF registry address to
match my current GitHub username.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [cert-manager](https://github.com/cert-manager/cert-manager) | | minor | `v1.20.2` → `v1.21.1` | ![age](https://developer.mend.io/api/mc/badges/age/github-release-attachments/cert-manager%2fcert-manager/v1.21.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-release-attachments/cert-manager%2fcert-manager/v1.20.2/v1.21.1?slim=true) | | ghcr.io/actualbudget/actual-server | Kustomization | minor | `26.6.0` → `26.8.1` | ![age](https://developer.mend.io/api/mc/badges/age/docker/ghcr.io%2factualbudget%2factual-server/26.8.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ghcr.io%2factualbudget%2factual-server/26.6.0/26.8.1?slim=true) | | [ghcr.io/immich-app/immich-machine-learning](https://github.com/immich-app/immich) | Kustomization | minor | `v3.0.1` → `v3.1.0` | ![age](https://developer.mend.io/api/mc/badges/age/docker/ghcr.io%2fimmich-app%2fimmich-machine-learning/v3.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ghcr.io%2fimmich-app%2fimmich-machine-learning/v3.0.1/v3.1.0?slim=true) | | [ghcr.io/immich-app/immich-server](https://github.com/immich-app/immich) | Kustomization | minor | `v3.0.1` → `v3.1.0` | ![age](https://developer.mend.io/api/mc/badges/age/docker/ghcr.io%2fimmich-app%2fimmich-server/v3.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/ghcr.io%2fimmich-app%2fimmich-server/v3.0.1/v3.1.0?slim=true) | | [metallb/metallb](https://github.com/metallb/metallb) | Kustomization | patch | `v0.16.0` → `v0.16.1` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/metallb%2fmetallb/v0.16.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/metallb%2fmetallb/v0.16.0/v0.16.1?slim=true) | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | packageManager | minor | [`10.28.0` → `10.34.5`](https://renovatebot.com/diffs/npm/pnpm/10.28.0/10.34.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.34.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.28.0/10.34.5?slim=true) | | [proxmox](https://search.opentofu.org/provider/bpg/proxmox) ([source](https://github.com/bpg/terraform-provider-proxmox)) | required_provider | minor | `0.81.0` → `0.111.1` | ![age](https://developer.mend.io/api/mc/badges/age/terraform-provider/bpg%2fproxmox/0.111.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/terraform-provider/bpg%2fproxmox/0.81.0/0.111.1?slim=true) | | [rancher/local-path-provisioner](https://github.com/rancher/local-path-provisioner) | Kustomization | patch | `v0.0.36` → `v0.0.37` | ![age](https://developer.mend.io/api/mc/badges/age/github-tags/rancher%2flocal-path-provisioner/v0.0.37?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/github-tags/rancher%2flocal-path-provisioner/v0.0.36/v0.0.37?slim=true) | | [zonefile](https://search.opentofu.org/provider/ahamlinman/zonefile) ([source](https://github.com/ahamlinman/terraform-provider-zonefile)) | required_provider | minor | `0.1.2` → `0.2.0` | ![age](https://developer.mend.io/api/mc/badges/age/terraform-provider/ahamlinman%2fzonefile/0.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/terraform-provider/ahamlinman%2fzonefile/0.1.2/0.2.0?slim=true) | --- ### Release Notes <details> <summary>cert-manager/cert-manager (cert-manager)</summary> ### [`v1.21.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0...v1.21.1) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.21.1 fixes a controller panic for Certificates with `spec.renewal.policy: Disabled`, a regression in 1.21.0 which caused log spam and dropped Secret informer events, Issuers and ClusterIssuers getting stuck at `Ready=False` (`InvalidSolver`) when a referenced ACME DNS-01 solver Secret is created after the Issuer, and the commented Gateway API example in the Helm chart values. It also updates several dependencies to fix reported security vulnerabilities. All users should upgrade. #### Changes by Kind ##### Bug or Regression - Avoid controller panic if a Certificate sets spec.renewal.policy=Disabled ([#9038](https://github.com/cert-manager/cert-manager/issues/9038), [@sklirg](https://github.com/sklirg)) - Fix Issuer/ClusterIssuer stuck at Ready=False/InvalidSolver after a missing ACME DNS-01 solver Secret is created ([#9083](https://github.com/cert-manager/cert-manager/issues/9083), [@SebTardif](https://github.com/SebTardif)) - Fix log spam and dropped Secret informer events for non-cert-manager Secrets, caused by a generics regression introduced in 1.21.0. ([#9037](https://github.com/cert-manager/cert-manager/issues/9037), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fixed the commented Gateway API config example in the Helm chart values to use `gatewayAPI.enabled` instead of the invalid `gatewayAPI.enable`. ([#9012](https://github.com/cert-manager/cert-manager/issues/9012), [@mateenali66](https://github.com/mateenali66)) ##### Other (Cleanup or Flake) - Bump `golang.org/x/text` to v0.40.0 to fix a reported security vulnerability ([#9039](https://github.com/cert-manager/cert-manager/issues/9039), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Bump `google.golang.org/grpc` to v1.82.1 to fix a reported security vulnerability ([#9063](https://github.com/cert-manager/cert-manager/issues/9063)) - Bump `github.com/google/cel-go` to v0.29.0 to fix a reported security vulnerability ([#9072](https://github.com/cert-manager/cert-manager/issues/9072)) - Bump `go.opentelemetry.io/otel` to v1.44.0 to fix a reported security vulnerability ([#9073](https://github.com/cert-manager/cert-manager/issues/9073)) - Update distroless base images ([#9000](https://github.com/cert-manager/cert-manager/issues/9000), [#9025](https://github.com/cert-manager/cert-manager/issues/9025)) ### [`v1.21.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0-beta.0...v1.21.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. cert-manager 1.21 brings ACME Renewal Information (ARI) support, AWS IAM authentication for the Vault issuer, several security hardening changes, and continued improvements to Gateway API integration and cainjector. There are three breaking changes related to Helm chart RBAC and metrics values — review them carefully before upgrading. #### Major Themes ##### Default `tokenrequest` RBAC removed from Helm chart > ⚠️ Breaking change The Helm chart no longer creates a default `Role` and `RoleBinding` granting the cert-manager controller permission to create tokens for its own ServiceAccount (`serviceaccounts/token: create`). No documented workflow requires this RBAC — the Route53 docs section that motivated it was removed in 2024. If you use `serviceAccountRef.name` pointing at the controller ServiceAccount, you must now either create your own `Role`/`RoleBinding` granting `serviceaccounts/token: create`, or migrate to a dedicated ServiceAccount (recommended — see the [Vault](https://cert-manager.io/docs/configuration/vault/) or [Route53](https://cert-manager.io/docs/configuration/acme/dns01/route53/) documentation). ##### Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole > ⚠️ Potentially breaking change The `cert-manager-edit` aggregate ClusterRole no longer grants `create` for `challenges.acme.cert-manager.io` or `create`, `patch`, `update` for `orders.acme.cert-manager.io` ([`GHSA-8rvj-mm4h-c258`](https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258)). These resources are internal to cert-manager's ACME workflow. Challenge `patch` and `update` are retained because users may need them to remove stuck finalizers. This change was already shipped in v1.20.3 and v1.19.6, so if you are running one of those versions this will not be a breaking change. If you have tooling that creates Challenge or Order resources directly, you will need to grant those permissions explicitly. ##### Metrics port name and path Helm values removed > ⚠️ Breaking change The Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path` have been removed. The controller Service metrics port has been renamed from `tcp-prometheus-servicemonitor` to `http-metrics`. Because the Helm values schema uses `additionalProperties: false`, users who still have any of the removed keys in their values overrides will see a schema validation error on upgrade — remove them before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952)) ##### ACME and Certificate Management - **ACME Renewal Information (ARI)**: experimental support for [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773) behind the `ACMEUseARI` feature gate. When enabled, cert-manager queries the ACME server's `renewalInfo` endpoint for the recommended renewal window, allowing servers like Let's Encrypt to proactively prompt renewal during mass revocations or CA key rollovers. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798)) - **`waitInsteadOfSelfCheck` solver option**: skip cert-manager's own self-check and instead wait a configured duration before asking the ACME server to validate. An escape hatch for split-horizon DNS and NAT hairpin environments. See [configuration details](https://cert-manager.io/docs/configuration/acme/#skip-the-self-check-with-waitinsteadofselfcheck). ([#8858](https://github.com/cert-manager/cert-manager/issues/8858)) - **AWS IAM authentication for Vault**: the Vault issuer now supports IRSA, EKS Pod Identity, and ambient EC2/ECS credentials, removing the need for long-lived AWS Secrets. ([#8422](https://github.com/cert-manager/cert-manager/issues/8422)) - **Certificate renewal policies**: a new `renewalPolicies` field on the Certificate API provides more expressive control over renewal scheduling, complementing `renewBefore` and `renewBeforePercentage`. ([#8258](https://github.com/cert-manager/cert-manager/issues/8258)) - **Configurable CertificateRequest retry backoff**: the new `--certificate-request-maximum-backoff-duration` flag (default: 32 hours) caps the exponential backoff for failed CertificateRequests, useful for environments with scheduled CA maintenance windows. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893)) - **Modern2026 [PKCS#12](https://github.com/PKCS/cert-manager/issues/12) profile**: a new FIPS 140-3 compatible encoding profile using AES-256 + SHA-256 KDFs instead of legacy 3DES/RC2. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841)) - **Webhook certificate renewal after system suspend**: the webhook now detects missed certificate renewals after system suspend (S3/S4) or VM live migration by polling wall-clock time, recovering within one minute of resume. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464)) ##### Gateway API and cainjector - **HTTP01 ListenerSet parentRef fallback**: the `acme.cert-manager.io/http01-parentreffallback: "true"` annotation causes cert-manager to use the parent Gateway for solver HTTPRoutes instead of the ListenerSet, enabling TLS-only ListenerSets to use a shared HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749)) - **`cert-manager.io/ignore-tls-listeners` annotation**: exclude specific Gateway TLS listeners from certificate management. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727)) - **Additional listener protocols**: configurable listener protocols beyond the default set. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683)) - **`enableGatewayAPI` configuration restructure**: `enableGatewayAPI` and `enableGatewayAPIListenerSet` are deprecated in favor of `gatewayAPI.enabled` / `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732)) - **`CAInjectorMerging` promoted to GA**: unconditionally enabled; will be removed in a future release. ([#8583](https://github.com/cert-manager/cert-manager/issues/8583)) - **cainjector server-side apply unconditional**: the `ServerSideApply` feature gate is deprecated. ([#8692](https://github.com/cert-manager/cert-manager/issues/8692)) - **cainjector `--ignore-namespaces` flag**: skip specified namespaces when watching Secrets for injection. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614)) ##### Deployment and Observability - **Venafi OAuth token observability**: a new `AuthFailed` Issuer condition reason distinguishes bad credentials from transient errors. PANW NGTS is now supported as a Venafi backend. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [#8779](https://github.com/cert-manager/cert-manager/issues/8779)) - **`runtimeClassName` support**: configurable for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [#8976](https://github.com/cert-manager/cert-manager/issues/8976)) - **`startupapicheck.ttlSecondsAfterFinished`**: opt-in automatic cleanup of the startupapicheck Job. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523)) - **`--acme-http01-solver-extra-labels`**: propagate `global.commonLabels` to dynamically-created ACME HTTP01 solver resources. ([#8761](https://github.com/cert-manager/cert-manager/issues/8761)) ##### Notable Bug Fixes - **Integer overflow in `renewBeforePercentage`**: Certificates with durations longer than approximately 3 years were incorrectly rejected or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947)) - **Infinite re-issuance loop**: cert-manager no longer loops when an issuer returns an already-expired certificate. ([#8610](https://github.com/cert-manager/cert-manager/issues/8610)) - **ACME transient network errors**: challenges no longer permanently fail on TLS handshake timeouts, DNS resolution failures, or context cancellation during nonce fetches and authorization waits. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760)) - **DNS-over-HTTPS response body cap**: response body reads are now bounded at 128 KB to prevent potential OOM. ([#8803](https://github.com/cert-manager/cert-manager/issues/8803)) - **Vault path traversal**: the Vault issuer webhook now rejects `..` path segments, preventing `path.Join` from silently resolving relative segments. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930)) - **DNS issuer secrets validated before ready**: prevents silent misconfiguration. ([#8255](https://github.com/cert-manager/cert-manager/issues/8255)) #### Community As always, we'd like to thank all of the community members who helped in this release cycle, including all below who merged a PR and anyone that helped by commenting on issues, testing, or getting involved in cert-manager meetings. We're lucky to have you involved. A special thanks to: - [@Copilot](https://github.com/Copilot) - [@FelixPhipps](https://github.com/FelixPhipps) - [@Peac36](https://github.com/Peac36) - [@SebTardif](https://github.com/SebTardif) - [@apkatsikas](https://github.com/apkatsikas) - [@bitloi](https://github.com/bitloi) - [@dap0am](https://github.com/dap0am) - [@figaw](https://github.com/figaw) - [@immanuwell](https://github.com/immanuwell) - [@jabbrwcky](https://github.com/jabbrwcky) - [@jnohlgard](https://github.com/jnohlgard) - [@jsoref](https://github.com/jsoref) - [@ltwongaa](https://github.com/ltwongaa) - [@lunarwhite](https://github.com/lunarwhite) - [@mateenali66](https://github.com/mateenali66) - [@onurmicoogullari](https://github.com/onurmicoogullari) - [@putongyong](https://github.com/putongyong) - [@seanorama](https://github.com/seanorama) - [@texasich](https://github.com/texasich) for their contributions, comments and support! Also, thanks to the cert-manager maintainer team for their help in this release: - [@SgtCoDFish](https://github.com/SgtCoDFish) - [@ThatsMrTalbot](https://github.com/ThatsMrTalbot) - [@erikgb](https://github.com/erikgb) - [@hjoshi123](https://github.com/hjoshi123) - [@inteon](https://github.com/inteon) - [@maelvls](https://github.com/maelvls) - [@munnerz](https://github.com/munnerz) - [@wallrj](https://github.com/wallrj) - [@wallrj-cyberark](https://github.com/wallrj-cyberark) And finally, thanks to the cert-manager steering committee for their feedback in this release cycle: - [@FlorianLiebhart](https://github.com/FlorianLiebhart) - [@TrilokGeer](https://github.com/TrilokGeer) - [@ianarsenault](https://github.com/ianarsenault) - [@ssyno](https://github.com/ssyno) #### Changes since v1.20.0 ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Add direct configurable `runtimeClassName` support for ACME HTTP01 solver pods via the `acmesolver.runtimeClassName` Helm value. ([#8976](https://github.com/cert-manager/cert-manager/issues/8976), [@erikgb](https://github.com/erikgb)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3 ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - Cainjector: A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `..` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Update base images to Debian 13 ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0-beta.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-beta.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0-alpha.1...v1.21.0-beta.0) > \[!NOTE] > ⚠️ This is a pre-release. For testing only! For full release notes including breaking changes, upgrade notes, major themes and community credits, see the [v1.21 release notes](https://release-next--cert-manager.netlify.app/docs/releases/release-notes/release-notes-1.21/). #### Changes since v1.21.0-alpha.1 ##### Feature - Add `certificateRequestMaximumBackoffDuration` controller configuration option to cap retry backoff time for failed CertificateRequests. Configurable via config file, `--certificate-request-maximum-backoff-duration` CLI flag, or Helm value `config.certificateRequestMaximumBackoffDuration`. Defaults to 32 hours for backward compatibility. ([#8893](https://github.com/cert-manager/cert-manager/issues/8893), [@lunarwhite](https://github.com/lunarwhite)) - Add an optional `waitInsteadOfSelfCheck` field to ACME HTTP01 and DNS01 solvers so cert-manager can skip its own self-check and ask the ACME server to validate after a configured wait. ([#8858](https://github.com/cert-manager/cert-manager/issues/8858), [@wallrj](https://github.com/wallrj)) - Add configurable `runtimeClassName` support for cert-manager components and ACME HTTP01 solver pods. ([#8791](https://github.com/cert-manager/cert-manager/issues/8791), [@jsoref](https://github.com/jsoref)) - Added ARI support through the ACMEUseARI feature gate. ([#8798](https://github.com/cert-manager/cert-manager/issues/8798), [@hjoshi123](https://github.com/hjoshi123)) - Added AWS IAM authentication support for Vault issuer, including IRSA (IAM Roles for Service Accounts) and ambient credentials (EC2/ECS). ([#8422](https://github.com/cert-manager/cert-manager/issues/8422), [@bitloi](https://github.com/bitloi)) - Adds support for the Modern2026 go-pkcs12 profile and FIPS 140-3. ([#8841](https://github.com/cert-manager/cert-manager/issues/8841), [@seanorama](https://github.com/seanorama)) - A new flag `--ignore-namespaces` was added to the cainjector binary. It can be used to filter out namespaces from being watched for secrets to use for injectables. ([#8614](https://github.com/cert-manager/cert-manager/issues/8614), [@figaw](https://github.com/figaw)) - Disabled client side rate-limiting if AP\&F is enabled. ([#8757](https://github.com/cert-manager/cert-manager/issues/8757), [@hjoshi123](https://github.com/hjoshi123)) - Processed annotations `cert-manager.io/alt-names`, `cert-manager.io/ip-sans` to Certificates generated from ingress like objects in cert-shim controllers. ([#8927](https://github.com/cert-manager/cert-manager/issues/8927), [@jabbrwcky](https://github.com/jabbrwcky)) - When using ACME HTTP-01 with a ListenerSet, setting the annotation `acme.cert-manager.io/http01-parentreffallback: "true"` causes cert-manager to use the parent Gateway as the solver HTTPRoute parentRef instead of the ListenerSet. This enables TLS-only ListenerSets to rely on a shared Gateway HTTP listener for ACME challenges. ([#8749](https://github.com/cert-manager/cert-manager/issues/8749), [@apkatsikas](https://github.com/apkatsikas)) ##### Bug or Regression - **BREAKING**: The Helm chart no longer ships a default `Role` and `RoleBinding` granting the cert-manager controller ServiceAccount permission to create tokens for itself (`serviceaccounts/token: create`). This RBAC was added in v1.16 ([#7213](https://github.com/cert-manager/cert-manager/issues/7213)) but no documented workflow requires it, and the motivating Route53 docs section was removed in Oct 2024. If you rely on `serviceAccountRef.name` pointing at the controller ServiceAccount (an undocumented pattern), you must now create your own `Role` and `RoleBinding` granting `serviceaccounts/token: create` on that ServiceAccount, or migrate to one of the documented patterns (IRSA ambient, or a dedicated ServiceAccount with its own RBAC). ([#8931](https://github.com/cert-manager/cert-manager/issues/8931), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - ACME challenges no longer terminally fail on transient network errors (TLS handshake timeouts, DNS failures, context cancellation) during nonce fetches and authorization waits. The challenge controller returns the error and lets the workqueue retry with backoff. ([#8760](https://github.com/cert-manager/cert-manager/issues/8760), [@texasich](https://github.com/texasich)) - Fix webhook serving certificate not being renewed after system suspend. ([#8464](https://github.com/cert-manager/cert-manager/issues/8464), [@Peac36](https://github.com/Peac36)) - Fixed a rare panic in the trigger controller when a Certificate is deleted from the informer cache while a reconcile is in progress (e.g. during namespace teardown). ([#8962](https://github.com/cert-manager/cert-manager/issues/8962), [@hjoshi123](https://github.com/hjoshi123)) - Fixed an integer overflow in `renewBeforePercentage` calculations that caused Certificates with durations longer than approximately 3 years to be incorrectly rejected by validation or assigned incorrect renewal times. ([#8947](https://github.com/cert-manager/cert-manager/issues/8947), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Fixed potential OOM in DNS-over-HTTPS client by bounding response body read with io.LimitReader (128 KB cap). ([#8803](https://github.com/cert-manager/cert-manager/issues/8803), [@SebTardif](https://github.com/SebTardif)) - Fixed validation of timezone-prefixed renewal window cron specs without a schedule. ([#8813](https://github.com/cert-manager/cert-manager/issues/8813), [@immanuwell](https://github.com/immanuwell)) - Harden ACME Challenge and Order resources: reject user-created Challenges without Order ownership, enforce Order spec immutability, and detect pre-placed same-name Challenges with mismatched specs. ([#8948](https://github.com/cert-manager/cert-manager/issues/8948), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove ACME Challenge `create` and Order `create`/`patch`/`update` from the cert-manager-edit aggregate ClusterRole to prevent direct manipulation of these internal resources (GHSA-8rvj-mm4h-c258). ([#8958](https://github.com/cert-manager/cert-manager/issues/8958), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Update logic to identify and preserve the secret matching nextPrivateKeySecretName. ([#8577](https://github.com/cert-manager/cert-manager/issues/8577), [@putongyong](https://github.com/putongyong)) - Vault Issuer webhook validation now rejects `...` path segments in `spec.vault.path` and auth mount path fields, preventing `path.Join` from silently resolving relative segments before constructing the Vault API request. ([#8930](https://github.com/cert-manager/cert-manager/issues/8930), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) ##### Other (Cleanup or Flake) - Remove Helm values `prometheus.servicemonitor.targetPort`, `prometheus.servicemonitor.path`, and `prometheus.podmonitor.path`. The metrics path is always `/metrics` and the target port is always `http-metrics`. Rename the controller service metrics port from `tcp-prometheus-servicemonitor` to `http-metrics` for consistency with other workloads. Users must remove these keys from their value overrides before upgrading. ([#8952](https://github.com/cert-manager/cert-manager/issues/8952), [@erikgb](https://github.com/erikgb)) - Update base images to Debian 13. ([#8849](https://github.com/cert-manager/cert-manager/issues/8849), [@ltwongaa](https://github.com/ltwongaa)) ### [`v1.21.0-alpha.1`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-alpha.1) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.21.0-alpha.0...v1.21.0-alpha.1) #### Changes since v1.21.0-alpha.0 > \[!NOTE] > ⚠️ This is a pre-release. For testing only! ##### Feature - Add Venafi OAuth token request observability and a new `AuthFailed` Issuer condition reason to distinguish bad credentials from transient infrastructure errors. ([#8808](https://github.com/cert-manager/cert-manager/issues/8808), [@FelixPhipps](https://github.com/FelixPhipps)) - Add new controller flag `--acme-http01-solver-extra-labels`, allowing Helm's `global.commonLabels` to propagate to all dynamically-created ACME HTTP01 solver resources (Pods, Services, Ingresses, or Gateway API HTTPRoutes). ([#8761](https://github.com/cert-manager/cert-manager/issues/8761), [@lunarwhite](https://github.com/lunarwhite)) - Add opt-in `startupapicheck.ttlSecondsAfterFinished` Helm value to enable automatic cleanup of the startupapicheck Job via the Kubernetes TTL-after-finished controller. ([#8523](https://github.com/cert-manager/cert-manager/issues/8523), [@dap0am](https://github.com/dap0am)) - Added `cert-manager.io/ignore-tls-listeners` annotation for ignoring gwapi listeners. ([#8727](https://github.com/cert-manager/cert-manager/issues/8727), [@hjoshi123](https://github.com/hjoshi123)) - Added option to specify additional listener protocols the GatewayAPI integration will consider when creating certificates. ([#8683](https://github.com/cert-manager/cert-manager/issues/8683), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) - Extend the Venafi/CyberArk integration to also support PANW NGTS. ([#8779](https://github.com/cert-manager/cert-manager/issues/8779), [@FelixPhipps](https://github.com/FelixPhipps)) - Make cainjector use SSA unconditionally and deprecate the ServerSideApply feature gate ([#8692](https://github.com/cert-manager/cert-manager/issues/8692), [@erikgb](https://github.com/erikgb)) ##### Bug or Regression - Add dns issuer secrets validation before marking it as ready ([#8255](https://github.com/cert-manager/cert-manager/issues/8255), [@Peac36](https://github.com/Peac36)) - Add missing issuer finalizer RBAC to the order controller to support owner references ([#8654](https://github.com/cert-manager/cert-manager/issues/8654), [@erikgb](https://github.com/erikgb)) - ClusterIssuer metrics collector now correctly respects the enabled-controllers configuration, avoiding a redundant startup when only operating within a namespace. ([#8822](https://github.com/cert-manager/cert-manager/issues/8822), [@lunarwhite](https://github.com/lunarwhite)) - Fix Venafi TPP issuer setup and signing regression on master: restore authentication of the vcert connector in the client constructor, which was removed in [#8808](https://github.com/cert-manager/cert-manager/issues/8808). ([#8843](https://github.com/cert-manager/cert-manager/issues/8843), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Fix a performance issue in the certificateRequestApproval webhook where CertificateRequests referencing a GroupKind whose CRD is not yet installed would trigger repeated API server discovery queries on every admission request. Negative results are now cached for 30 seconds. ([#8651](https://github.com/cert-manager/cert-manager/issues/8651), [@mateenali66](https://github.com/mateenali66)) - Fixed infinite re-issuance loop when issuer returns an already expired certificate ([#8610](https://github.com/cert-manager/cert-manager/issues/8610), [@onurmicoogullari](https://github.com/onurmicoogullari)) - Fixed local `e2e-setup-samplewebhook` installation to use the samplewebhook image repository and tag from the saved image tarball manifest. ([#8821](https://github.com/cert-manager/cert-manager/issues/8821), [@wallrj](https://github.com/wallrj)) - Helm chart bugfix: rename image helper to avoid umbrella chart conflicts ([#8753](https://github.com/cert-manager/cert-manager/issues/8753), [@FelixPhipps](https://github.com/FelixPhipps)) - Helm: Fix invalid YAML generated when both `webhook.config` and `webhook.volumes` are defined. ([#8664](https://github.com/cert-manager/cert-manager/issues/8664), [@jnohlgard](https://github.com/jnohlgard)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8743](https://github.com/cert-manager/cert-manager/issues/8743), [@erikgb](https://github.com/erikgb)) ##### Other (Cleanup or Flake) - The `enableGatewayAPI` and `enableGatewayAPIListenerSet` fields on `ControllerConfiguration` are deprecated and moved into the `gatewayAPI` sub-struct as `gatewayAPI.enabled` and `gatewayAPI.enableListenerSet`. The old fields continue to work. ([#8732](https://github.com/cert-manager/cert-manager/issues/8732), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot)) ### [`v1.21.0-alpha.0`](https://github.com/cert-manager/cert-manager/releases/tag/v1.21.0-alpha.0) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.3...v1.21.0-alpha.0) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. > ⚠️ This is a pre-release. For testing only! #### Changes by Kind since `v1.20.0` ##### Feature - Feat(certificate): adding certificate renewal policies ([#8258](https://github.com/cert-manager/cert-manager/issues/8258), [@hjoshi123](https://github.com/hjoshi123)) - Promote the CAInjectorMerging feature gate to GA ([#8583](https://github.com/cert-manager/cert-manager/issues/8583), [@Copilot](https://github.com/Copilot)) ##### Bug or Regression - Fixed duplicate `parentRef` bug when both issuer config and annotations are present. ([#8619](https://github.com/cert-manager/cert-manager/issues/8619), [@hjoshi123](https://github.com/hjoshi123)) ##### Other (Cleanup or Flake) - API cleanup: removed deprecated ObjectReference ([#8625](https://github.com/cert-manager/cert-manager/issues/8625), [@inteon](https://github.com/inteon)) ### [`v1.20.3`](https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3) [Compare Source](https://github.com/cert-manager/cert-manager/compare/v1.20.2...v1.20.3) cert-manager is the easiest way to automatically manage certificates in Kubernetes and OpenShift clusters. v1.20.3 removes the issuer owner reference from challenges which was blocking challenge garbage collection, removes unnecessary write verbs from the `cert-manager-edit` aggregate ClusterRole, and updates Go to fix reported CVEs. ##### Changes by Kind ##### Bug or Regression - Remove Challenge `create` and Order `create`, `patch`, `update` verbs from the `cert-manager-edit` aggregate ClusterRole. ([#8940](https://github.com/cert-manager/cert-manager/issues/8940), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) - Remove issuer owner reference from challenges blocking challenge garbage collection ([#8759](https://github.com/cert-manager/cert-manager/issues/8759), [@cert-manager-bot](https://github.com/cert-manager-bot)) ##### Other (Cleanup or Flake) - Bump go to 1.26.3, other deps to fix several govulncheck issues ([#8789](https://github.com/cert-manager/cert-manager/issues/8789), [@SgtCoDFish](https://github.com/SgtCoDFish)) - Update Go to `v1.26.4` to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 ([#8926](https://github.com/cert-manager/cert-manager/issues/8926), [@wallrj-cyberark](https://github.com/wallrj-cyberark)) </details> <details> <summary>immich-app/immich (ghcr.io/immich-app/immich-machine-learning)</summary> ### [`v3.1.0`](https://github.com/immich-app/immich/releases/tag/v3.1.0) [Compare Source](https://github.com/immich-app/immich/compare/v3.0.3...v3.1.0) Welcome to Immich `v3.1.0`! This release includes several quality of life improvements and another round of bug fixes. Keep reading below for the complete highlights. ##### Highlights - Upload wakelock (web) - Undo archive (web) - Filter assets by server filepath (workflows) - Quick navigate to maintenance page (web) - Better slideshow button accessibility (web) - OIDC role claim sync improvements (OAuth) - Invalidate sessions on password reset (admin-cli) ##### Upload wakelock (web) Similar to mobile, the web application will now automatically acquire a wakelock to prevent the screen from dimming while uploads are happening. This feature will require an HTTPS connection. ##### Undo archive (web) After archiving assets, the success notification now has an “undo” button to undo the action. ![Undo button on success notification](https://static.immich.cloud/blog/48ff8c50-260a-4114-a8a0-117d8989f622/48fe5c0071ecd3700696ea24516267dd.webp) ##### Filter assets by server filepath (workflows) The asset file filter has a new option “Use path”. When set to true, it will filter based on the actual path on the server rather than the original file name. ![](https://static.immich.cloud/blog/48ff8c50-260a-4114-a8a0-117d8989f622/f75b6701af0ad0acd16f281106e5d571.webp) ##### Filter assets by EXIF metadata (workflows) A new workflow filter has been added that allows you to filter assets based on their EXIF metadata fields. For now it only supports string comparisons, with numerical comparisons expected to come soon. <img width="700" alt="Filter by EXIF metadata step configuration options" src="https://static.immich.cloud/blog/48ff8c50-260a-4114-a8a0-117d8989f622/10dbcaddcbeb9bfa7cab1e4029e0f70b.webp" /> ##### Quick navigate to maintenance page (web) The command palette (`CTRL+K` or `/`) now includes an item for the maintenance page. <img width="600" alt="Command palette with a maintenance page item" src="https://static.immich.cloud/blog/48ff8c50-260a-4114-a8a0-117d8989f622/28134831c6b1a5f1919ceecdadc1ae54.webp" /> ##### Better slideshow button visibility (web) The slideshow buttons on the web are now wrapped in a container with a backdrop blur, making them easier to view when the current asset is very light. ![Slideshow controls on a low contrast image](https://static.immich.cloud/blog/48ff8c50-260a-4114-a8a0-117d8989f622/496215825fbad61a3b2a0c640b5c3aeb.webp) ##### OIDC role claim sync improvements (OAuth) The OAuth integration in Immich supports setting an initial `isAdmin` value for new users via a role claim. This same process has been updated to now *sync* `isAdmin` on subsequent logins. Additionally, the role claim now supports both single values (`immich_role: 'admin'`) in addition to lists of values ( `immich_role: ["admin", "user"]`), making in more flexible. ##### Invalidate sessions on password reset (admin-cli) When using the admin command line interface to reset a password, there is now a new option to invalidate existing sessions. ```none immich-admin reset-admin-password Found Admin: - ID=e65e6f88-2a30-4dbe-8dd9-1885f4889b53 - OAuth ID= - Email=admin@example.com - Name=Immich Admin ? Please choose a new password (optional) immich-is-cool ? Invalidate existing sessions? Yes The admin password has been updated. ``` ##### Date range for map (mobile) Similar to web, mobile now also supports filtering the map for assets within a given date range. <img width="500" alt="Mobile map settings page date range options" src="https://static.immich.cloud/blog/48ff8c50-260a-4114-a8a0-117d8989f622/be25f538bcb69574ff21c15c2aa64b27.webp" /> ***  ##### What's Changed ##### 🚨 Breaking Changes - chore(mobile): drop support for iOS 14 by [@agg23](https://github.com/agg23) in [#29780](https://github.com/immich-app/immich/pull/29780) ##### 🚀 Features - feat(cli): Add --visibility flag to immich CLI upload subcommand by [@yuxincs](https://github.com/yuxincs) in [#29614](https://github.com/immich-app/immich/pull/29614) - feat(mobile): custom date range for map by [@YarosMallorca](https://github.com/YarosMallorca) in [#26205](https://github.com/immich-app/immich/pull/26205) ##### 🌟 Enhancements - feat(web): Keep show more open on duplicates by [@MontejoJorge](https://github.com/MontejoJorge) in [#29734](https://github.com/immich-app/immich/pull/29734) - fix(server/workflow): add trigger for external libraries AssetCreate by [@cratoo](https://github.com/cratoo) in [#29597](https://github.com/immich-app/immich/pull/29597) - chore(seo): remove redundant twitter metadata tags by [@cevdetta](https://github.com/cevdetta) in [#29801](https://github.com/immich-app/immich/pull/29801) - feat(web): add wake lock when uploading assets by [@diogotcorreia](https://github.com/diogotcorreia) in [#29820](https://github.com/immich-app/immich/pull/29820) - feat(web): undo archive from toast by [@YarosMallorca](https://github.com/YarosMallorca) in [#27061](https://github.com/immich-app/immich/pull/27061) - feat: workflow filter assets by upload path by [@benbeckford](https://github.com/benbeckford) in [#30000](https://github.com/immich-app/immich/pull/30000) - feat(web): add maintenance link to command palette by [@yamishi13](https://github.com/yamishi13) in [#30016](https://github.com/immich-app/immich/pull/30016) - feat: add album asset event handling by [@timonrieger](https://github.com/timonrieger) in [#29008](https://github.com/immich-app/immich/pull/29008) - fix(web): improve slideshow controls visibility on bright backgrounds by [@tech00exploere](https://github.com/tech00exploere) in [#29950](https://github.com/immich-app/immich/pull/29950) - fix: re-evaluate OIDC role claim on every login and support array values by [@ImperatorRuscal](https://github.com/ImperatorRuscal) in [#29991](https://github.com/immich-app/immich/pull/29991) - feat: exif metadata workflow filter by [@benbeckford](https://github.com/benbeckford) in [#29295](https://github.com/immich-app/immich/pull/29295) - feat: password invalidate sessions by [@jrasm91](https://github.com/jrasm91) in [#30125](https://github.com/immich-app/immich/pull/30125) ##### 🐛 Bug fixes - fix(mobile): apply exif orientation to remote raw photos on android by [@santoshakil](https://github.com/santoshakil) in [#29906](https://github.com/immich-app/immich/pull/29906) - fix(web): hide stack thumbnail tray in slideshow mode by [@tech00exploere](https://github.com/tech00exploere) in [#29918](https://github.com/immich-app/immich/pull/29918) - fix(web): use Container component for responsive admin maintenance la… by [@tech00exploere](https://github.com/tech00exploere) in [#29917](https://github.com/immich-app/immich/pull/29917) - fix(server): updated default CSP config to support videos from V3 player by [@l0ll098](https://github.com/l0ll098) in [#29830](https://github.com/immich-app/immich/pull/29830) - fix(server): workflow date filter, make end date inclusive by [@kigrup](https://github.com/kigrup) in [#29876](https://github.com/immich-app/immich/pull/29876) - fix(web): URI encode slug and reduce confusion for users by [@meesfrensel](https://github.com/meesfrensel) in [#29796](https://github.com/immich-app/immich/pull/29796) - fix(web): clear birth date by [@danieldietzler](https://github.com/danieldietzler) in [#29959](https://github.com/immich-app/immich/pull/29959) - fix(server): disable heif security limit by [@mertalev](https://github.com/mertalev) in [#29954](https://github.com/immich-app/immich/pull/29954) - fix: zero byte image uploads by [@rrrockey](https://github.com/rrrockey) in [#29426](https://github.com/immich-app/immich/pull/29426) - fix(server): return workflow steps in ascending order by [@benbeckford](https://github.com/benbeckford) in [#29999](https://github.com/immich-app/immich/pull/29999) - fix(mobile): update album creation to use user-defined name from dialog by [@LeLunZ](https://github.com/LeLunZ) in [#30002](https://github.com/immich-app/immich/pull/30002) - fix: long press share quality override preference settings by [@alextran1502](https://github.com/alextran1502) in [#30030](https://github.com/immich-app/immich/pull/30030) - fix(web): align ContextMenu z-index with design-system token by [@tech00exploere](https://github.com/tech00exploere) in [#30015](https://github.com/immich-app/immich/pull/30015) - fix(web): refresh folder view after asset deletion by [@tech00exploere](https://github.com/tech00exploere) in [#29899](https://github.com/immich-app/immich/pull/29899) - fix: do not show the whats new page on fresh login by [@shenlong-tanwen](https://github.com/shenlong-tanwen) in [#30072](https://github.com/immich-app/immich/pull/30072) - fix(mobile): prevent crash on video widget dispose by [@agg23](https://github.com/agg23) in [#30078](https://github.com/immich-app/immich/pull/30078) - fix(web): attach file picker input to DOM so iOS Safari fires change … by [@mrxder](https://github.com/mrxder) in [#29660](https://github.com/immich-app/immich/pull/29660) - fix: timebuckets locked permissions by [@danieldietzler](https://github.com/danieldietzler) in [#30066](https://github.com/immich-app/immich/pull/30066) - fix: search statistics locked folder permissions by [@danieldietzler](https://github.com/danieldietzler) in [#30063](https://github.com/immich-app/immich/pull/30063) - fix(web): fix Country/State filters when set to Unknown by [@compscitwilight](https://github.com/compscitwilight) in [#30026](https://github.com/immich-app/immich/pull/30026) - fix(server): file uploads for files with extension only filenames by [@compscitwilight](https://github.com/compscitwilight) in [#30024](https://github.com/immich-app/immich/pull/30024) - fix(mobile): stop double close animation when dismissing an asset by [@santoshakil](https://github.com/santoshakil) in [#29413](https://github.com/immich-app/immich/pull/29413) - fix(mobile): back up files moved into a watched folder on android by [@santoshakil](https://github.com/santoshakil) in [#29872](https://github.com/immich-app/immich/pull/29872) - fix(web): lens model search by [@jrasm91](https://github.com/jrasm91) in [#30088](https://github.com/immich-app/immich/pull/30088) - fix(mobile): add album picker to the partner view bottom sheet by [@santoshakil](https://github.com/santoshakil) in [#30099](https://github.com/immich-app/immich/pull/30099) - fix(mobile): prevent duplicate album creation during submission by [@LeLunZ](https://github.com/LeLunZ) in [#30003](https://github.com/immich-app/immich/pull/30003) - fix(mobile): properly group download tasks for Live Photos by [@agg23](https://github.com/agg23) in [#29952](https://github.com/immich-app/immich/pull/29952) - fix(mobile): show real error when an asset can't be added to an album by [@santoshakil](https://github.com/santoshakil) in [#29754](https://github.com/immich-app/immich/pull/29754) - fix(mobile): treat wired ethernet as unmetered on ios by [@santoshakil](https://github.com/santoshakil) in [#29351](https://github.com/immich-app/immich/pull/29351) - fix(server): send id\_token\_hint on OIDC logout by [@lorypota](https://github.com/lorypota) in [#29720](https://github.com/immich-app/immich/pull/29720) - fix(mobile): refresh asset stack after deleting viewer item by [@PeterOmbodi](https://github.com/PeterOmbodi) in [#28164](https://github.com/immich-app/immich/pull/28164) - fix: limit ocr overlay to images by [@YarosMallorca](https://github.com/YarosMallorca) in [#30116](https://github.com/immich-app/immich/pull/30116) - fix: disable slideshow crossfade on reduced motion by [@YarosMallorca](https://github.com/YarosMallorca) in [#29826](https://github.com/immich-app/immich/pull/29826) - fix(mobile): map unresponsive after viewing asset by [@YarosMallorca](https://github.com/YarosMallorca) in [#27036](https://github.com/immich-app/immich/pull/27036) - fix(mobile): send date-only value for memories query param by [@ajuijas](https://github.com/ajuijas) in [#30049](https://github.com/immich-app/immich/pull/30049) - fix: admin user details responsive layout by [@YarosMallorca](https://github.com/YarosMallorca) in [#30114](https://github.com/immich-app/immich/pull/30114) - fix: backup delay translation key parsing by [@YarosMallorca](https://github.com/YarosMallorca) in [#30112](https://github.com/immich-app/immich/pull/30112) - fix(web): use correct date field for shift-click range in Recently Added by [@okxint](https://github.com/okxint) in [#30071](https://github.com/immich-app/immich/pull/30071) - fix(server): dissolve stack when its non-primary assets are deleted by [@justadityaraj](https://github.com/justadityaraj) in [#29354](https://github.com/immich-app/immich/pull/29354) - fix: always set extension from provided file by [@bo0tzz](https://github.com/bo0tzz) in [#29839](https://github.com/immich-app/immich/pull/29839) - fix: locked view and asset view provider by [@shenlong-tanwen](https://github.com/shenlong-tanwen) in [#30136](https://github.com/immich-app/immich/pull/30136) - fix(mobile): birthday picker date order follows locale by [@santoshakil](https://github.com/santoshakil) in [#29419](https://github.com/immich-app/immich/pull/29419) - fix(web): restore correct back route when opening person asset via direct URL by [@okxint](https://github.com/okxint) in [#30129](https://github.com/immich-app/immich/pull/30129) - fix(web): mirror asset viewer navigation icons in RTL by [@noboike](https://github.com/noboike) in [#30151](https://github.com/immich-app/immich/pull/30151) - fix(mobile): allow URL validation to pass when scheme is not provided by [@agg23](https://github.com/agg23) in [#30142](https://github.com/immich-app/immich/pull/30142) - fix: run background tasks in root isolate by [@shenlong-tanwen](https://github.com/shenlong-tanwen) in [#30101](https://github.com/immich-app/immich/pull/30101) - fix(web): mirror onboarding navigation icons in RTL by [@noboike](https://github.com/noboike) in [#30158](https://github.com/immich-app/immich/pull/30158) - fix: min faces user preference by [@jrasm91](https://github.com/jrasm91) in [#30177](https://github.com/immich-app/immich/pull/30177) - fix(web): use RTL transform origin in AdaptiveImage by [@noboike](https://github.com/noboike) in [#30182](https://github.com/immich-app/immich/pull/30182) - fix: don't skip person thumbnail generation if ML is disabled by [@bo0tzz](https://github.com/bo0tzz) in [#30194](https://github.com/immich-app/immich/pull/30194) - fix: shared by user detail panel by [@danieldietzler](https://github.com/danieldietzler) in [#30187](https://github.com/immich-app/immich/pull/30187) - fix(mobile): prevent timeline scroll to top on unrelated pages by [@agg23](https://github.com/agg23) in [#30281](https://github.com/immich-app/immich/pull/30281) ##### 📚 Documentation - chore(security.txt): bump expired Expires field (RFC 9116) by [@kobihikri](https://github.com/kobihikri) in [#29932](https://github.com/immich-app/immich/pull/29932) - fix(docs): remove ref to synology channel by [@mmomjian](https://github.com/mmomjian) in [#30051](https://github.com/immich-app/immich/pull/30051) - fix: hypertext link to example docker-compose.rootless.yml by [@upmcplanetracker](https://github.com/upmcplanetracker) in [#30155](https://github.com/immich-app/immich/pull/30155) ##### 🌐 Translations - feat(docs): add bulgarian readme by [@nedevski](https://github.com/nedevski) in [#29427](https://github.com/immich-app/immich/pull/29427) - chore(web): update translations by [@weblate](https://github.com/weblate) in [#29781](https://github.com/immich-app/immich/pull/29781) ##### New Contributors - [@kobihikri](https://github.com/kobihikri) made their first contribution in [#29932](https://github.com/immich-app/immich/pull/29932) - [@kigrup](https://github.com/kigrup) made their first contribution in [#29876](https://github.com/immich-app/immich/pull/29876) - [@yuxincs](https://github.com/yuxincs) made their first contribution in [#29614](https://github.com/immich-app/immich/pull/29614) - [@cevdetta](https://github.com/cevdetta) made their first contribution in [#29801](https://github.com/immich-app/immich/pull/29801) - [@mrxder](https://github.com/mrxder) made their first contribution in [#29660](https://github.com/immich-app/immich/pull/29660) - [@compscitwilight](https://github.com/compscitwilight) made their first contribution in [#30026](https://github.com/immich-app/immich/pull/30026) - [@nedevski](https://github.com/nedevski) made their first contribution in [#29427](https://github.com/immich-app/immich/pull/29427) - [@yamishi13](https://github.com/yamishi13) made their first contribution in [#30016](https://github.com/immich-app/immich/pull/30016) - [@lorypota](https://github.com/lorypota) made their first contribution in [#29720](https://github.com/immich-app/immich/pull/29720) - [@ImperatorRuscal](https://github.com/ImperatorRuscal) made their first contribution in [#29991](https://github.com/immich-app/immich/pull/29991) - [@ajuijas](https://github.com/ajuijas) made their first contribution in [#30049](https://github.com/immich-app/immich/pull/30049) - [@justadityaraj](https://github.com/justadityaraj) made their first contribution in [#29354](https://github.com/immich-app/immich/pull/29354) - [@pavel-miniutka](https://github.com/pavel-miniutka) made their first contribution in [#29939](https://github.com/immich-app/immich/pull/29939) - [@noboike](https://github.com/noboike) made their first contribution in [#30151](https://github.com/immich-app/immich/pull/30151) - [@upmcplanetracker](https://github.com/upmcplanetracker) made their first contribution in [#30155](https://github.com/immich-app/immich/pull/30155) **Full Changelog**: <https://github.com/immich-app/immich/compare/v3.0.3...v3.1.0> ### [`v3.0.3`](https://github.com/immich-app/immich/releases/tag/v3.0.3) [Compare Source](https://github.com/immich-app/immich/compare/v3.0.2...v3.0.3) ##### v3.0.3 - various bug fixes - we push to our own F-Droid repo at <https://app.futo.org/fdroid/repo> now. If you're using F-Droid, please pull the application from there from now on - fixes an issue where LivePhotos upload from the background isn't showing up. > \[!Note] > In some specific circumstances, newly uploaded Live Photos could have broken thumbnails. If you see any such cases, please run the "missing" job for thumbnails or wait for the respective nightly job to clear it up.  ##### What's Changed ##### 🚀 Features - feat: publish app releases to FUTO F-Droid repo by [@bo0tzz](https://github.com/bo0tzz) in [#29804](https://github.com/immich-app/immich/pull/29804) ##### 🐛 Bug fixes - fix(web): closing plugin method picker selects "unknown" method by [@benbeckford](https://github.com/benbeckford) in [#29784](https://github.com/immich-app/immich/pull/29784) - fix: unauthorized album owner update by [@danieldietzler](https://github.com/danieldietzler) in [#29883](https://github.com/immich-app/immich/pull/29883) - fix: still part of live photo hidden on bg upload by [@shenlong-tanwen](https://github.com/shenlong-tanwen) in [#29884](https://github.com/immich-app/immich/pull/29884) - fix: system appbar icon color has incorrect color in asset viewer by [@alextran1502](https://github.com/alextran1502) in [#29885](https://github.com/immich-app/immich/pull/29885) - fix: locked visibility in search random endpoint by [@danieldietzler](https://github.com/danieldietzler) in [#29887](https://github.com/immich-app/immich/pull/29887) - fix(mobile): send a full datetime from the android memories widget by [@santoshakil](https://github.com/santoshakil) in [#29689](https://github.com/immich-app/immich/pull/29689) - fix: memory search date validation by [@danieldietzler](https://github.com/danieldietzler) in [#29907](https://github.com/immich-app/immich/pull/29907) - fix(server): set hvc1 tag when using hwa by [@mertalev](https://github.com/mertalev) in [#29908](https://github.com/immich-app/immich/pull/29908) - fix(mobile): clear zoom state when swapping assets by [@agg23](https://github.com/agg23) in [#29909](https://github.com/immich-app/immich/pull/29909) - fix: Ken Burns effect on sliver app bar jittery on Android by [@alextran1502](https://github.com/alextran1502) in [#29890](https://github.com/immich-app/immich/pull/29890) ##### 📚 Documentation - fix(docs): update fdroid link by [@mmomjian](https://github.com/mmomjian) in [#29797](https://github.com/immich-app/immich/pull/29797) - feat: system integrity docs by [@danieldietzler](https://github.com/danieldietzler) in [#29911](https://github.com/immich-app/immich/pull/29911) ##### 🌐 Translations - chore(web): update translations by [@weblate](https://github.com/weblate) in [#29774](https://github.com/immich-app/immich/pull/29774) - fix(mobile): correct person age singular pluralization by [@tech00exploere](https://github.com/tech00exploere) in [#29868](https://github.com/immich-app/immich/pull/29868) ##### New Contributors - [@tech00exploere](https://github.com/tech00exploere) made their first contribution in [#29868](https://github.com/immich-app/immich/pull/29868) **Full Changelog**: <https://github.com/immich-app/immich/compare/v3.0.2...v3.0.3> ### [`v3.0.2`](https://github.com/immich-app/immich/releases/tag/v3.0.2) [Compare Source](https://github.com/immich-app/immich/compare/v3.0.1...v3.0.2) ### v3.0.2 This patch release addresses various bugs from v3 release and adds an additional filter to workflows  #### What's Changed ##### 🌟 Enhancements - fix(web): add ARIA label to ServerStatisticsCard by [@tjhorner](https://github.com/tjhorner) in [#29497](https://github.com/immich-app/immich/pull/29497) - feat(server): hls variant configuration by [@mertalev](https://github.com/mertalev) in [#29613](https://github.com/immich-app/immich/pull/29613) - feat: user agnostic database restore by [@danieldietzler](https://github.com/danieldietzler) in [#29512](https://github.com/immich-app/immich/pull/29512) - feat(server): date workflow filter by [@benbeckford](https://github.com/benbeckford) in [#29040](https://github.com/immich-app/immich/pull/29040) ##### 🐛 Bug fixes - fix: re-add gCastEnabled negation by [@bo0tzz](https://github.com/bo0tzz) in [#29499](https://github.com/immich-app/immich/pull/29499) - fix: downmix audio to stereo to fix broken channel layout by [@lukasdotcom](https://github.com/lukasdotcom) in [#29485](https://github.com/immich-app/immich/pull/29485) - fix: live transcoding when viewing from a link share by [@lukasdotcom](https://github.com/lukasdotcom) in [#29471](https://github.com/immich-app/immich/pull/29471) - fix: web search timeline visibility by [@danieldietzler](https://github.com/danieldietzler) in [#29518](https://github.com/immich-app/immich/pull/29518) - fix(web): missing i18n strings by [@wonsukchoi](https://github.com/wonsukchoi) in [#29612](https://github.com/immich-app/immich/pull/29612) - fix: chinese browser locales recognition by [@danieldietzler](https://github.com/danieldietzler) in [#29622](https://github.com/immich-app/immich/pull/29622) - chore: improve added to album messages by [@danieldietzler](https://github.com/danieldietzler) in [#29641](https://github.com/immich-app/immich/pull/29641) - fix(mobile): fix 10-bit heic and avif colors on android by [@santoshakil](https://github.com/santoshakil) in [#29631](https://github.com/immich-app/immich/pull/29631) - fix(mobile): match iOS scroll to top and tabbar scroll ([#28469](https://github.com/immich-app/immich/issues/28469)) by [@agg23](https://github.com/agg23) in [#29705](https://github.com/immich-app/immich/pull/29705) - fix: wrap migrations in transaction by [@shenlong-tanwen](https://github.com/shenlong-tanwen) in [#29664](https://github.com/immich-app/immich/pull/29664) - fix: oauth account linking by [@danieldietzler](https://github.com/danieldietzler) in [#29624](https://github.com/immich-app/immich/pull/29624) - fix: incorrect grouping of recently added assets by [@benbeckford](https://github.com/benbeckford) in [#29666](https://github.com/immich-app/immich/pull/29666) - fix: integrity checks checksum pagination by [@danieldietzler](https://github.com/danieldietzler) in [#29516](https://github.com/immich-app/immich/pull/29516) - fix(mobile): missing crop options and rotation scaling by [@bwees](https://github.com/bwees) in [#29645](https://github.com/immich-app/immich/pull/29645) - fix(mobile): properly handle live photos locally by [@agg23](https://github.com/agg23) in [#29462](https://github.com/immich-app/immich/pull/29462) - fix: integrity checks dto validation by [@danieldietzler](https://github.com/danieldietzler) in [#29621](https://github.com/immich-app/immich/pull/29621) - fix(mobile): http request handling after isolate death by [@mertalev](https://github.com/mertalev) in [#29714](https://github.com/immich-app/immich/pull/29714) - fix: do not log out on automatic url switch by [@shenlong-tanwen](https://github.com/shenlong-tanwen) in [#29715](https://github.com/immich-app/immich/pull/29715) - fix(server): stream ffprobe packets by [@mertalev](https://github.com/mertalev) in [#29723](https://github.com/immich-app/immich/pull/29723) - fix: search metadata for album shared links by [@danieldietzler](https://github.com/danieldietzler) in [#29742](https://github.com/immich-app/immich/pull/29742) - fix(web): clear asset selection when search context changes by [@khanguyen74](https://github.com/khanguyen74) in [#29738](https://github.com/immich-app/immich/pull/29738) - fix(mobile): update timeline args on layout constraint changes by [@santoshakil](https://github.com/santoshakil) in [#29653](https://github.com/immich-app/immich/pull/29653) - fix: iso date parsing for three digit years by [@danieldietzler](https://github.com/danieldietzler) in [#29739](https://github.com/immich-app/immich/pull/29739) - fix: missing files integrity checks by [@danieldietzler](https://github.com/danieldietzler) in [#29737](https://github.com/immich-app/immich/pull/29737) - fix(mobile): play videos from search results and folder view by [@santoshakil](https://github.com/santoshakil) in [#29693](https://github.com/immich-app/immich/pull/29693) - fix(web): recursively unnest class arrays by [@meesfrensel](https://github.com/meesfrensel) in [#29755](https://github.com/immich-app/immich/pull/29755) - fix: emit album update event when uploading assets through shared link by [@danieldietzler](https://github.com/danieldietzler) in [#29757](https://github.com/immich-app/immich/pull/29757) - fix(web): always initialize language manager to set lang and dir by [@meesfrensel](https://github.com/meesfrensel) in [#29696](https://github.com/immich-app/immich/pull/29696) ##### 📚 Documentation - chore: update docs with v3 tags by [@alextran1502](https://github.com/alextran1502) in [#29312](https://github.com/immich-app/immich/pull/29312) - fix(docs): use correct heading name for DB dump by [@track0x1](https://github.com/track0x1) in [#29483](https://github.com/immich-app/immich/pull/29483) - feat(docs): add Malayalam language support in README files by [@jinskjoy](https://github.com/jinskjoy) in [#29593](https://github.com/immich-app/immich/pull/29593) - fix(docs): clarify version policy by [@mmomjian](https://github.com/mmomjian) in [#29654](https://github.com/immich-app/immich/pull/29654) ##### 🌐 Translations - chore(web): update translations by [@weblate](https://github.com/weblate) in [#29415](https://github.com/immich-app/immich/pull/29415) #### New Contributors - [@tjhorner](https://github.com/tjhorner) made their first contribution in [#29497](https://github.com/immich-app/immich/pull/29497) - [@wonsukchoi](https://github.com/wonsukchoi) made their first contribution in [#29612](https://github.com/immich-app/immich/pull/29612) - [@track0x1](https://github.com/track0x1) made their first contribution in [#29483](https://github.com/immich-app/immich/pull/29483) - [@jinskjoy](https://github.com/jinskjoy) made their first contribution in [#29593](https://github.com/immich-app/immich/pull/29593) - [@khanguyen74](https://github.com/khanguyen74) made their first contribution in [#29738](https://github.com/immich-app/immich/pull/29738) **Full Changelog**: <https://github.com/immich-app/immich/compare/v3.0.1...v3.0.2> </details> <details> <summary>metallb/metallb (metallb/metallb)</summary> ### [`v0.16.1`](https://github.com/metallb/metallb/compare/v0.16.0...v0.16.1) [Compare Source](https://github.com/metallb/metallb/compare/v0.16.0...v0.16.1) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v10.34.5`](https://github.com/pnpm/pnpm/releases/tag/v10.34.5): pnpm 10.34.5 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.4...v10.34.5) ##### Patch Changes - [`78e29fe`](https://github.com/pnpm/pnpm/commit/78e29fe): Prevent a crafted `pnpm-lock.yaml` from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. `../../../tmp/x@1.0.0`) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot `version: "../../x"`) is now rejected at `iterateHashedGraphNodes`, the single point every global-virtual-store slot path funnels through. - [`78e29fe`](https://github.com/pnpm/pnpm/commit/78e29fe): Fixed a path traversal vulnerability where a dependency whose manifest `name` was a scoped path traversal (e.g. `@x/../../../<path>`) could be written outside `node_modules` to an attacker-controlled location during `pnpm install`, even with `--ignore-scripts`. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker. - [`47ef6f0`](https://github.com/pnpm/pnpm/commit/47ef6f0): Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the `pnpm` and `@pnpm/exe` npm packages whose bins are placeholders replaced at install time by the host's native binary from a `@pnpm/exe.<platform>-<arch>[-musl]` optional dependency. Because pnpm installs its own engine with `--ignore-scripts`, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native `pnpm` package), and verifies the native binary's npm registry signature before running it. - [`36928be`](https://github.com/pnpm/pnpm/commit/36928be): `${...}` environment-variable placeholders in the `httpProxy`, `httpsProxy`, `noProxy`, `proxy`, and `noproxy` settings are no longer expanded when these settings come from a project's `pnpm-workspace.yaml`. They now receive the same protection already applied to `registry`.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.34.4`](https://github.com/pnpm/pnpm/releases/tag/v10.34.4): pnpm 10.34.4 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.3...v10.34.4) ##### Patch Changes - [`352ae48`](https://github.com/pnpm/pnpm/commit/352ae48): Security: validate config dependency names and versions before using them to build filesystem paths. A `pnpm-workspace.yaml` with a traversal-shaped `configDependencies` name (such as `../../PWNED`) or version (such as `../../../PWNED`) could previously cause `pnpm install` to create symlinks or write package files outside `node_modules/.pnpm-config` and the store. Names must now be valid npm package names and versions must be exact semver versions. See [GHSA-qrv3-253h-g69c](https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c). - [`352ae48`](https://github.com/pnpm/pnpm/commit/352ae48): Reject path-traversal and reserved dependency aliases (such as `../../../escape`, `.bin`, `.pnpm`, or `node_modules`) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted `node_modules` directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout. The `nodeLinker: hoisted` graph builder now validates each alias at the directory sink (`safeJoinModulesDir`), matching the validation pnpm already performs when resolving aliases from manifests. See [GHSA-fr4h-3cph-29xv](https://github.com/pnpm/pnpm/security/advisories/GHSA-fr4h-3cph-29xv). - [`352ae48`](https://github.com/pnpm/pnpm/commit/352ae48): Prevent `pnpm patch-remove` from removing files outside the configured patches directory. - [`217fbe0`](https://github.com/pnpm/pnpm/commit/217fbe0): Hardened the warning printed when a project `.npmrc` uses environment variables in registry/auth settings: the suggested `pnpm config set` command is now only included for keys made up of shell-inert characters. Because the key comes from a repository-controlled `.npmrc` and a shell expands `$(...)`, backticks, and `$VAR` even inside double quotes, a crafted key could otherwise have turned the suggested copy-paste command into command execution.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.34.3`](https://github.com/pnpm/pnpm/releases/tag/v10.34.3): pnpm 10.34.3 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.2...v10.34.3) ##### ⚠️ Security fix — environment variables in a project `.npmrc` (action may be required) Following [GHSA-3qhv-2rgh-x77r](https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r), pnpm no longer expands `${ENV_VAR}` placeholders that come from a **repository-controlled** config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to: - the project/workspace `.npmrc` — `registry`, `@scope:registry`, proxy URLs, URL-scoped keys (`//host/…`), and credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`); - registry URLs in `pnpm-workspace.yaml`. This release also closes a bypass where a project `.npmrc` could set `userconfig`, `globalconfig`, or `prefix` to make pnpm load a repo-supplied file as *trusted* config (via `@pnpm/npm-conf@3.0.3`). Environment variables are **still** expanded in trusted config: your user-level `~/.npmrc`, the global config, CLI options, and environment config. **If your authentication broke after upgrading**, move the token out of the committed `.npmrc`: ```sh # Writes to your user/global config, not the repository: pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN" ``` Or keep the `${NPM_TOKEN}` line but put it in your user-level `~/.npmrc` instead of the repo. In **GitHub Actions**, `actions/setup-node` with `registry-url` already writes a user-level `.npmrc`, so `NODE_AUTH_TOKEN` keeps working. For other CI where editing each pipeline is hard, set `NPM_CONFIG_USERCONFIG=.npmrc` in the CI environment to declare the project `.npmrc` trusted. See <https://pnpm.io/npmrc> for full migration details. ##### Patch Changes - Improved the warning printed when a project `.npmrc` uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by running `pnpm config set "<key>" <value>` to store it in the global config, or by keeping the `${...}` line in the user-level `~/.npmrc` — with a link to <https://pnpm.io/npmrc>. - A repository-controlled project or workspace `.npmrc` can no longer redirect which files pnpm loads as its trusted user and global configuration. Previously such a file could set `userconfig`, `globalconfig`, or `prefix` to point at an attacker-supplied file shipped in the repository, and pnpm would load it as a trusted config source — bypassing the protection that prevents repository config from expanding environment variables into registry request destinations and credentials, and allowing it to set `tokenHelper`. The user/global config file locations are now resolved only from trusted sources (CLI options, environment config, the npm builtin config, and defaults) before the project and workspace `.npmrc` files are read. Fixed by upgrading `@pnpm/npm-conf` to `3.0.3`.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.34.2`](https://github.com/pnpm/pnpm/releases/tag/v10.34.2): pnpm 10.34.2 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.1...v10.34.2) ##### ⚠️ Security fix — environment variables in a project `.npmrc` (action may be required) Following [GHSA-3qhv-2rgh-x77r](https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r), pnpm no longer expands `${ENV_VAR}` placeholders that come from a **repository-controlled** config file, because a malicious repository could otherwise use them to leak your environment secrets (npm tokens, CI job tokens, etc.) to an attacker-controlled registry during install. This applies to: - the project/workspace `.npmrc` — `registry`, `@scope:registry`, proxy URLs, URL-scoped keys (`//host/…`), and credential values (`_authToken`, `_auth`, `_password`, `username`, `tokenHelper`, `cert`, `key`); - registry URLs in `pnpm-workspace.yaml`. This release also closes a bypass where a project `.npmrc` could set `userconfig`, `globalconfig`, or `prefix` to make pnpm load a repo-supplied file as *trusted* config (via `@pnpm/npm-conf@3.0.3`). Environment variables are **still** expanded in trusted config: your user-level `~/.npmrc`, the global config, CLI options, and environment config. **If your authentication broke after upgrading**, move the token out of the committed `.npmrc`: ```sh # Writes to your user/global config, not the repository: pnpm config set "//registry.npmjs.org/:_authToken" "$NPM_TOKEN" ``` Or keep the `${NPM_TOKEN}` line but put it in your user-level `~/.npmrc` instead of the repo. In **GitHub Actions**, `actions/setup-node` with `registry-url` already writes a user-level `.npmrc`, so `NODE_AUTH_TOKEN` keeps working. For other CI where editing each pipeline is hard, set `NPM_CONFIG_USERCONFIG=.npmrc` in the CI environment to declare the project `.npmrc` trusted. See <https://pnpm.io/npmrc> for full migration details. ##### Patch Changes - Package-manager bootstrap traffic is now resolved through trusted registries and trusted network config. When pnpm downloads the pnpm version requested by a repository's `packageManager` field, the registry it fetches from (and the proxy/TLS settings used for that traffic) now come exclusively from trusted config sources — CLI options, env config, user and global `.npmrc` — defaulting to the public npm registry, instead of the repository's project/workspace settings. - pnpm now verifies the npm registry signature of a package-manager binary before spawning it. When the `packageManager` field (or `pnpm self-update`) makes pnpm download another pnpm version, the staged install is verified corepack-style: the integrity recorded in the staged lockfile must carry a valid npm registry signature for the exact `name@version`, validated against npm's public signing keys that ship embedded in the pnpm CLI. Verification fails closed — a tampered download, an unsigned package, or an unreachable registry refuses the version switch rather than running an unverified binary. It runs only when the wanted version is actually downloaded (a tools-directory cache miss), so repeated commands pay no extra network round trip. - Environment variable expansion is now trust-aware for registry/auth config and request destinations. Repository-controlled config files (the project and workspace `.npmrc` and `pnpm-workspace.yaml`) can no longer expand `${...}` placeholders in registry/proxy request destinations, URL-scoped keys, or registry credential values, preventing repository-controlled configuration from exfiltrating environment secrets through request URLs. Trusted user/global/CLI/env config keeps full env expansion, so existing token and registry setup flows continue to work. - Reject reserved manifest `bin` names (`""`, `"."`, `".."`, and scoped forms such as `@scope/..`) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted. - Require trusted package identity before package-name `onlyBuiltDependencies` (and `allowBuilds`) entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the key. Lockfile entries are now rejected when a registry-style dependency path (`name@semver`) is backed by a git, directory, or git-hosted tarball resolution (`ERR_PNPM_RESOLUTION_SHAPE_MISMATCH`), so the dependency path is a reliable artifact identity by the time scripts can run. - pnpm now verifies the detached OpenPGP signature of a Node.js release's `SHASUMS256.txt` against the Node.js release team's public keys (embedded in the pnpm CLI) before trusting its hashes. The Node.js download mirror is repository-configurable (`node-mirror:<channel>` in `.npmrc`), and the integrity check previously trusted a `SHASUMS256.txt` fetched from that same mirror — a circular check that a malicious mirror could satisfy with a tampered binary and matching hashes. A mirror that proxies the real signed SHASUMS keeps working unchanged. Only the `release` channel publishes signed SHASUMS files, so pre-release channels (rc, nightly, …) remain unverified.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.34.1`](https://github.com/pnpm/pnpm/releases/tag/v10.34.1): pnpm 10.34.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.34.0...v10.34.1) ##### Patch Changes - Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:` block is missing the `integrity` field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips `integrity:`) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under `--frozen-lockfile`. pnpm now fails closed at lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted tarballs (`gitHosted: true` or a URL on codeload.github.com / bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.34.0`](https://github.com/pnpm/pnpm/releases/tag/v10.34.0): pnpm 10.34 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.33.4...v10.34.0) ##### Minor Changes - Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, `pnpm install` (non-frozen) would log `ERR_PNPM_TARBALL_INTEGRITY`, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile. `pnpm install` now exits with `ERR_PNPM_TARBALL_INTEGRITY` and a hint pointing at the new opt-in flag. The only opt-in is **`pnpm install --update-checksums`** — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable. `--force` and `pnpm update` deliberately do **not** bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. `--frozen-lockfile` behavior is unchanged. `--fix-lockfile` keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass. ##### Patch Changes - Pin unscoped per-registry settings (`_authToken`, `_auth`, `username`/`_password`, `tokenHelper`, inline `cert`/`key`) to the registry declared in the same config source at load time, so a later layer overriding `registry=` (workspace `.npmrc`, `pnpm-workspace.yaml`, CLI `--registry`) cannot redirect a credential or client certificate authored for a different host. A deprecation warning is emitted whenever an unscoped per-registry setting is encountered, naming the source and the URL it was pinned to. Reported by JUNYI LIU. - Fixed `minimumReleaseAge` handling when cached metadata is abbreviated. The npm registry returns abbreviated package metadata (without the per-version `time` field) by default, which made the maturity check throw `ERR_PNPM_MISSING_TIME` whenever cached abbreviated metadata was reused. pnpm now upgrades cached abbreviated metadata to the full document via a follow-up fetch when `minimumReleaseAge` is active, persists the upgrade to the on-disk cache so subsequent installs skip the extra fetch, and lets `ERR_PNPM_MISSING_TIME` from the cache fast-path fall through to the network fetch even under strict mode. - Reject git resolutions whose `commit` field is not a 40-character hexadecimal SHA before invoking `git`. A malicious lockfile could otherwise smuggle a value such as `--upload-pack=<command>` through `git fetch` / `git checkout`, which on SSH or local-file transports executes the supplied command. - Reject patch files whose `diff --git` headers reference paths outside the patched package directory. Previously a malicious `.patch` file added via a pull request could write, delete, or rename arbitrary files reachable by the user running `pnpm install`. - Fixed `--prefix=<dir>` not being honored when locating the workspace root. The `--prefix → dir` rename was applied after workspace detection, so workspace settings declared in `<dir>/pnpm-workspace.yaml` were not loaded when pnpm was invoked from outside `<dir>` [#11535](https://github.com/pnpm/pnpm/issues/11535). - Reject dependency aliases that contain path-traversal segments (such as `@x/../../../../../.git/hooks`) when reading them from a package manifest or symlinking them into `node_modules`. A malicious registry package could otherwise use a transitive dependency key to make `pnpm install` create symlinks at attacker-chosen paths outside the intended `node_modules` directory.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.4`](https://github.com/pnpm/pnpm/releases/tag/v10.33.4): pnpm 10.33.4 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.33.3...v10.33.4) ##### Patch Changes - Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes. A new `gitHosted: true` field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase. - Fix a regression where `pnpm --recursive --filter '!<pkg>' run/exec/test/add` would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative `--filter` arguments are provided, matching the [documented behavior](https://pnpm.io/cli/recursive). To include the root, pass `--include-workspace-root` [#11341](https://github.com/pnpm/pnpm/issues/11341).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.3`](https://github.com/pnpm/pnpm/releases/tag/v10.33.3): pnpm 10.33.3 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.33.2...v10.33.3) ##### Patch Changes - When self-updating from v10's `@pnpm/exe` to v11+ on Intel macOS (darwin-x64), `pnpm self-update` now transparently switches to the JS-only `pnpm` package on npm instead of installing `@pnpm/exe@v11+` (which doesn't ship a working binary for Intel Macs because of an upstream Node.js SEA bug — see [#11423](https://github.com/pnpm/pnpm/issues/11423) and [nodejs/node#62893](https://github.com/nodejs/node/issues/62893)). Without this, the self-update would silently leave the user with no working `pnpm` binary. The new install requires Node.js to be available on `PATH`; a warning is printed when the swap happens. All other host/version combinations are unchanged. - `pnpm self-update` (with no version argument) no longer downgrades pnpm when the registry's `latest` dist-tag points to an older release than the currently active version. Run `pnpm self-update latest` to force a downgrade [#11418](https://github.com/pnpm/pnpm/issues/11418).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.2`](https://github.com/pnpm/pnpm/releases/tag/v10.33.2): pnpm 10.33.2 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.33.1...v10.33.2) ##### Patch Changes - Globally-installed bins no longer fail with `ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND` when pnpm was installed via the standalone `@pnpm/exe` binary (e.g. `curl -fsSL https://get.pnpm.io/install.sh | sh -`) on a system without a separate Node.js installation. Previously, when `which('node')` failed during `pnpm add --global`, pnpm fell back to `process.execPath`, which in `@pnpm/exe` is the pnpm binary itself — and that path was baked into the generated bin shim, causing the shim to invoke pnpm instead of Node [#11291](https://github.com/pnpm/pnpm/issues/11291), [#4645](https://github.com/pnpm/pnpm/issues/4645). - Fix an infinite fork-bomb that could happen when pnpm was installed with one version (e.g. `npm install -g pnpm@A`) and run inside a project whose `package.json` selected a different pnpm version via the `packageManager` field (e.g. `pnpm@B`), while a `pnpm-workspace.yaml` also existed at the project root. The child's environment is now forced to `manage-package-manager-versions=false` (v10) and `pm-on-fail=ignore` (v11+), which disables the package-manager-version handling in whichever pnpm runs as the child. Fixes [#11337](https://github.com/pnpm/pnpm/issues/11337).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.1`](https://github.com/pnpm/pnpm/releases/tag/v10.33.1): pnpm 10.33.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.33.0...v10.33.1) ##### Patch Changes - When a project's `packageManager` field selects pnpm v11 or newer, commands that v10 would have passed through to npm (`version`, `login`, `logout`, `publish`, `unpublish`, `deprecate`, `dist-tag`, `docs`, `ping`, `search`, `star`, `stars`, `unstar`, `whoami`, etc.) are now handed over to the wanted pnpm, which implements them natively. Previously they silently shelled out to npm — making, for example, `pnpm version --help` print npm's help on a project with `packageManager: pnpm@11.0.0-rc.3` [#11328](https://github.com/pnpm/pnpm/issues/11328).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.33.0`](https://github.com/pnpm/pnpm/releases/tag/v10.33.0): pnpm 10.33 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.32.1...v10.33.0) ##### Minor Changes - Added a new `dedupePeers` setting that reduces peer dependency duplication. When enabled, peer dependency suffixes use version-only identifiers (`name@version`) instead of full dep paths, eliminating nested suffixes like `(foo@1.0.0(bar@2.0.0))`. This dramatically reduces the number of package instances in projects with many recursive peer dependencies [#11070](https://github.com/pnpm/pnpm/issues/11070). ##### Patch Changes - Fail on incompatible lockfiles in CI when frozen lockfile mode is enabled, while preserving non-frozen CI fallback behavior. - When package metadata is malformed or can't be fetched, the error thrown will now show the originating error. - Fixed intermittent failures when multiple `pnpm dlx` calls run concurrently for the same package. When the global virtual store is enabled, the importer now verifies file content before skipping a rename, avoiding destructive swap-renames that break concurrent processes. Also tolerates EPERM during bin creation on Windows and properly propagates `enableGlobalVirtualStore` through the install pipeline. - Fixed handling of non-string version selectors in `hoistPeers`, preventing invalid peer dependency specifiers. - Improve the non-interactive modules purge error hint to include the `confirmModulesPurge=false` workaround. When pnpm needs to recreate `node_modules` but no TTY is available, the error now suggests either setting `CI=true` or disabling the purge confirmation prompt via `confirmModulesPurge=false`. Adds a regression test for the non-TTY flow. - Fixed false "Command not found" errors on Windows when a command exists in PATH but exits with a non-zero code. Also fixed path resolution for `--filter` contexts where the command runs in a different package directory. - When a pnpm-lock.yaml contains two documents, ignore the first one. pnpm v11 will write two lockfile documents into pnpm-lock.yaml in order to store pnpm version integrities and config dependency resolutions. - Fixed a bug preventing the `clearCache` function returned by `createNpmResolver` from properly clearing metadata cache.  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.32.1`](https://github.com/pnpm/pnpm/releases/tag/v10.32.1): pnpm 10.32.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.32.0...v10.32.1) ##### Patch Changes - Fix a regression where `pnpm-workspace.yaml` without a `packages` field caused all directories to be treated as workspace projects. This broke projects that use `pnpm-workspace.yaml` only for settings (e.g. `minimumReleaseAge`) without defining workspace packages [#10909](https://github.com/pnpm/pnpm/issues/10909).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.32.0`](https://github.com/pnpm/pnpm/releases/tag/v10.32.0): pnpm 10.32 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.31.0...v10.32.0) ##### Minor Changes - Added `--all` flag to `pnpm approve-builds` that approves all pending builds without interactive prompts [#10136](https://github.com/pnpm/pnpm/issues/10136). ##### Patch Changes - Reverted change related to setting explicitly the npm config file path, which caused regressions. - Reverted fix related to `lockfile-include-tarball-url`. Fixes [#10915](https://github.com/pnpm/pnpm/issues/10915).  ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.31.0`](https://github.com/pnpm/pnpm/releases/tag/v10.31.0): pnpm 10.31 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.30.3...v10.31.0) #### Minor Changes - When pnpm updates the `pnpm-workspace.yaml`, comments, string formatting, and whitespace will be preserved. #### Patch Changes - Added `-F` as a short alias for the `--filter` option in the help output. - Handle undefined pkgSnapshot in `pnpm why -r` [#10700](https://github.com/pnpm/pnpm/issues/10700). - Fix headless install not being used when a project has an injected self-referencing `file:` dependency that resolves to `link:` in the lockfile. - Fixed a race condition when multiple worker threads import the same package to the global virtual store concurrently. The rename operation now tolerates `ENOTEMPTY`/`EEXIST` errors if another thread already completed the import. - When `lockfile-include-tarball-url` is set to `false`, tarball URLs are now always excluded from the lockfile. Previously, tarball URLs could still appear for packages hosted under non-standard URLs, making the behavior flaky and inconsistent [#6667](https://github.com/pnpm/pnpm/issues/6667). - Fixed `optimisticRepeatInstall` skipping install when `overrides`, `packageExtensions`, `ignoredOptionalDependencies`, `patchedDependencies`, or `peersSuffixMaxLength` changed. - Fixed `pnpm patch-commit` failing with "unable to access '/.config/git/attributes': Permission denied" error in environments where HOME is unset or non-standard (Docker containers, CI systems). The issue occurred because pnpm was setting `HOME` and the Windows user profile env var to empty strings to suppress user git configuration when running `git diff`. This caused git to resolve the home directory (`~`) as root (`/`), leading to permission errors when attempting to access `/.config/git/attributes`. Now uses `GIT_CONFIG_GLOBAL: os.devNull` instead, which is git's proper mechanism for bypassing user-level configuration without corrupting the home directory path resolution. Fixes [#6537](https://github.com/pnpm/pnpm/issues/6537) - Fix `pnpm why -r --parseable` missing dependents when multiple workspace packages share the same dependency [#8100](https://github.com/pnpm/pnpm/issues/8100). - Fix `link-workspace-packages=true` incorrectly linking workspace packages when the requested version doesn't match the workspace package's version. Previously, on fresh installs the version constraint is overridden to `*` in the fallback resolution paths, causing any workspace package with a matching name to be linked regardless of version [#10173](https://github.com/pnpm/pnpm/issues/10173). - Fixed `pnpm update --interactive` table breaking with long version strings (e.g., prerelease versions like `7.0.0-dev.20251209.1`) by dynamically calculating column widths instead of using hardcoded values [#10316](https://github.com/pnpm/pnpm/issues/10316). - Explicitly tell `npm` the path to the global `rc` config file. - The parameter set by the `--allow-build` flag is written to `allowBuilds`. - Fix a bug in which specifying `filter` on `pnpm-workspace.yaml` would cause pnpm to not detect any projects. - Print help message on running pnpm dlx without arguments and exit.  #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table>  ### [`v10.30.3`](https://github.com/pnpm/pnpm/releases/tag/v10.30.3): pnpm 10.30.3 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.30.2...v10.30.3) ##### Patch Changes - Fixed version switching via `packageManager` field failing when pnpm is installed as a standalone executable in environments without a system Node.js [#10687](https://github.com/pnpm/pnpm/issues/10687). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.30.2`](https://github.com/pnpm/pnpm/releases/tag/v10.30.2): pnpm 10.30.2 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.30.1...v10.30.2) ##### Patch Changes - Fix auto-installed peer dependencies ignoring overrides when a stale version exists in the lockfile. - Fixed "input line too long" error on Windows when running lifecycle scripts with the global virtual store enabled [#10673](https://github.com/pnpm/pnpm/pull/10673). - Update [@zkochan/js-yaml](https://github.com/zkochan/js-yaml) to fix moderate vulnerability. ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.30.1`](https://github.com/pnpm/pnpm/releases/tag/v10.30.1): pnpm 10.30.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.30.0...v10.30.1) ##### Patch Changes - Use the `/-/npm/v1/security/audits/quick` endpoint as the primary audit endpoint, falling back to `/-/npm/v1/security/audits` when it fails [#10649](https://github.com/pnpm/pnpm/issues/10649). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.30.0`](https://github.com/pnpm/pnpm/releases/tag/v10.30.0): pnpm 10.30 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.29.3...v10.30.0) ##### Minor Changes - `pnpm why` now shows a reverse dependency tree. The searched package appears at the root with its dependents as branches, walking back to workspace roots. This replaces the previous forward-tree output which was noisy and hard to read for deeply nested dependencies. ##### Patch Changes - Revert `pnpm why` dependency pruning to prefer correctness over memory consumption. Reverted PR: [#7122](https://github.com/pnpm/pnpm/pull/7122). - Optimize `pnpm why` and `pnpm list` performance in workspaces with many importers by sharing the dependency graph and materialization cache across all importers instead of rebuilding them independently for each one [#10596](https://github.com/pnpm/pnpm/pull/10596/changes). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.29.3`](https://github.com/pnpm/pnpm/releases/tag/v10.29.3): pnpm 10.29.3 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.29.2...v10.29.3) ##### Patch Changes - Fixed an out-of-memory error in `pnpm list` (and `pnpm why`) on large dependency graphs by replacing the recursive tree builder with a two-phase approach: a BFS dependency graph followed by cached tree materialization. Duplicate subtrees are now deduplicated in the output, shown as "deduped (N deps hidden)" [#10586](https://github.com/pnpm/pnpm/pull/10586). - Fixed `allowBuilds` not working when set via `.pnpmfile.cjs` [#10516](https://github.com/pnpm/pnpm/issues/10516). - When the [`enableGlobalVirtualStore`](https://pnpm.io/settings#enableglobalvirtualstore) option is set, the `pnpm deploy` command would incorrectly create symlinks to the global virtual store. To keep the deploy directory self-contained, `pnpm deploy` now ignores this setting and always creates a localized virtual store within the deploy directory. - Fixed `minimumReleaseAgeExclude` not being respected by `pnpm dlx` [#10338](https://github.com/pnpm/pnpm/issues/10338). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> ### [`v10.29.2`](https://github.com/pnpm/pnpm/releases/tag/v10.29.2): pnpm 10.29.2 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.29.1...v10.29.2) ##### Patch Changes - Reverted a fix shipped in v10.29.1, which caused another issue [#10571](https://github.com/pnpm/pnpm/issues/10571). Reverted fix: Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists [#10497](https://github.com/pnpm/pnpm/issues/10497). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> ### [`v10.29.1`](https://github.com/pnpm/pnpm/releases/tag/v10.29.1): pnpm 10.29.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.28.2...v10.29.1) #### Minor Changes - The `pnpm dlx` / `pnpx` command now supports the `catalog:` protocol. Example: `pnpm dlx shx@catalog:`. - Support configuring `auditLevel` in the `pnpm-workspace.yaml` file [#10540](https://github.com/pnpm/pnpm/issues/10540). - Support bare `workspace:` protocol without version specifier. It is now treated as `workspace:*` and resolves to the concrete version during publish [#10436](https://github.com/pnpm/pnpm/pull/10436). #### Patch Changes - Fixed `pnpm list --json` returning incorrect paths when using global virtual store [#10187](https://github.com/pnpm/pnpm/issues/10187). - Fix `pnpm store path` and `pnpm store status` using workspace root for path resolution when `storeDir` is relative [#10290](https://github.com/pnpm/pnpm/issues/10290). - Fixed `pnpm run -r` failing with "No projects matched the filters" when an empty `pnpm-workspace.yaml` exists [#10497](https://github.com/pnpm/pnpm/issues/10497). - Fixed a bug where `catalogMode: strict` would write the literal string `"catalog:"` to `pnpm-workspace.yaml` instead of the resolved version specifier when re-adding an existing catalog dependency [#10176](https://github.com/pnpm/pnpm/issues/10176). - Fixed the documentation URL shown in `pnpm completion --help` to point to the correct page at <https://pnpm.io/completion> [#10281](https://github.com/pnpm/pnpm/issues/10281). - Skip local `file:` protocol dependencies during `pnpm fetch`. This fixes an issue where `pnpm fetch` would fail in Docker builds when local directory dependencies were not available [#10460](https://github.com/pnpm/pnpm/issues/10460). - Fixed `pnpm audit --json` to respect the `--audit-level` setting for both exit code and output filtering [#10540](https://github.com/pnpm/pnpm/issues/10540). - update tar to version 7.5.7 to fix security issue Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: <a href="https://github.com/advisories/GHSA-34x7-hfp2-rc4v">CVE-2026-24842</a> - Fix `pnpm audit --fix` replacing reference overrides (e.g. `$foo`) with concrete versions [#10325](https://github.com/pnpm/pnpm/issues/10325). - Fix `shamefullyHoist` set via `updateConfig` in `.pnpmfile.cjs` not being converted to `publicHoistPattern` [#10271](https://github.com/pnpm/pnpm/issues/10271). - `pnpm help` should correctly report if the currently running pnpm CLI is bundled with Node.js [#10561](https://github.com/pnpm/pnpm/issues/10561). - Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for `node_modules/.bin`, causing binaries to not be found when running commands like `pnpm exec` [#10457](https://github.com/pnpm/pnpm/issues/10457). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> ### [`v10.28.2`](https://github.com/pnpm/pnpm/releases/tag/v10.28.2): pnpm 10.28.2 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.28.1...v10.28.2) ##### Patch Changes - Security fix: prevent path traversal in `directories.bin` field. - When pnpm installs a `file:` or `git:` dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into `node_modules`. This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) and have their contents copied when the package is installed. Note: This only affects `file:` and `git:` dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected. - Fixed optional dependencies to request full metadata from the registry to get the `libc` field, which is required for proper platform compatibility checks [#9950](https://github.com/pnpm/pnpm/issues/9950). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> ### [`v10.28.1`](https://github.com/pnpm/pnpm/releases/tag/v10.28.1): pnpm 10.28.1 [Compare Source](https://github.com/pnpm/pnpm/compare/v10.28.0...v10.28.1) ##### Patch Changes - Fixed installation of config dependencies from private registries. Added support for object type in `configDependencies` when the tarball URL returned from package metadata differs from the computed URL [#10431](https://github.com/pnpm/pnpm/pull/10431). - Fix path traversal vulnerability in binary fetcher ZIP extraction - Validate ZIP entry paths before extraction to prevent writing files outside target directory - Validate BinaryResolution.prefix (basename) to prevent directory escape via crafted prefix - Both attack vectors now throw `ERR_PNPM_PATH_TRAVERSAL` error - Support plain `http://` and `https://` URLs ending with `.git` as git repository dependencies. Previously, URLs like `https://gitea.example.org/user/repo.git#commit` were not recognized as git repositories because they lacked the `git+` prefix (e.g., `git+https://`). This caused issues when installing dependencies from self-hosted git servers like Gitea or Forgejo that don't provide tarball downloads. Changes: - The git resolver now runs before the tarball resolver, ensuring git URLs are handled by the correct resolver - The git resolver now recognizes plain `http://` and `https://` URLs ending in `.git` as git repositories - Removed the `isRepository` check from the tarball resolver since it's no longer needed with the new resolver order Fixes [#10468](https://github.com/pnpm/pnpm/issues/10468) - `pnpm run -r` and `pnpm run --filter` now fail with a non-zero exit code when no packages have the specified script. Previously, this only failed when all packages were selected. Use `--if-present` to suppress this error [#6844](https://github.com/pnpm/pnpm/issues/6844). - Fixed a path traversal vulnerability in tarball extraction on Windows. The path normalization was only checking for `./` but not `.\`. Since backslashes are directory separators on Windows, malicious packages could use paths like `foo\..\..\.npmrc` to write files outside the package directory. - When running "pnpm exec" from a subdirectory of a project, don't change the current working directory to the root of the project [#5759](https://github.com/pnpm/pnpm/issues/5759). - Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with `@` bypassed validation, and after scope normalization, path traversal sequences like `../../` remained intact. - Revert Try to avoid making network calls with preferOffline [#10334](https://github.com/pnpm/pnpm/pull/10334). - Fix `--save-peer` to write valid semver ranges to `peerDependencies` for protocol-based installs (e.g. `jsr:`) by deriving from resolved versions when available and falling back to `*` if none is available [#10417](https://github.com/pnpm/pnpm/issues/10417). - Do not exclude the root workspace project, when it is explicitly selected via a filter [#10465](https://github.com/pnpm/pnpm/pull/10465). ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"> </a> </td> </tr> </tbody> </table> </details> <details> <summary>bpg/terraform-provider-proxmox (proxmox)</summary> ### [`v0.111.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01111-2026-07-03) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.111.0...v0.111.1) ##### Bug Fixes - **cluster:** handle `influx_token` write-only status in `metrics_server` ([#2972](https://github.com/bpg/terraform-provider-proxmox/issues/2972)) ([65831bb](https://github.com/bpg/terraform-provider-proxmox/commit/65831bb78abe518998cf298b74212bf3eb94c45e)) - **hwmapping:** percent-encode comments to survive PVE round-trip ([#2980](https://github.com/bpg/terraform-provider-proxmox/issues/2980)) ([dcc0c36](https://github.com/bpg/terraform-provider-proxmox/commit/dcc0c3601e05a7d357c35e02f76396a4df8a3297)) - **vm:** persist `boot_order` on first apply when cloning ([#2969](https://github.com/bpg/terraform-provider-proxmox/issues/2969)) ([505cb8d](https://github.com/bpg/terraform-provider-proxmox/commit/505cb8d2f78d80e59034ff0112aaf3f5effad909)) ##### Miscellaneous - **ci:** update actions/attest-build-provenance digest ([`a2bbfa2`](https://github.com/bpg/terraform-provider-proxmox/commit/a2bbfa2) → [`0f67c3f`](https://github.com/bpg/terraform-provider-proxmox/commit/0f67c3f)) ([#2976](https://github.com/bpg/terraform-provider-proxmox/issues/2976)) ([1a3c1b1](https://github.com/bpg/terraform-provider-proxmox/commit/1a3c1b1071ec5d84cd7d9780ab4a1c018033ea69)) - **ci:** update actions/setup-go digest ([`4a36011`](https://github.com/bpg/terraform-provider-proxmox/commit/4a36011) → [`924ae3a`](https://github.com/bpg/terraform-provider-proxmox/commit/924ae3a)) ([#2970](https://github.com/bpg/terraform-provider-proxmox/issues/2970)) ([41f4c40](https://github.com/bpg/terraform-provider-proxmox/commit/41f4c407b8a2fe75979ddddaa79330d9a731948a)) - **ci:** update dorny/paths-filter action (v4.0.1 → v4.0.2) ([#2979](https://github.com/bpg/terraform-provider-proxmox/issues/2979)) ([90d03f7](https://github.com/bpg/terraform-provider-proxmox/commit/90d03f7015e5045dcabae06d6b07b2e898ff2d98)) - **ci:** update golangci/golangci-lint-action digest ([`82606bf`](https://github.com/bpg/terraform-provider-proxmox/commit/82606bf) → [`ba0d7d2`](https://github.com/bpg/terraform-provider-proxmox/commit/ba0d7d2)) ([#2977](https://github.com/bpg/terraform-provider-proxmox/issues/2977)) ([2cc0206](https://github.com/bpg/terraform-provider-proxmox/commit/2cc0206bbd2a1588215a69d6085b7edb9ad77db7)) - **deps:** update image golang ([`32c0e6e`](https://github.com/bpg/terraform-provider-proxmox/commit/32c0e6e) → [`f96cc55`](https://github.com/bpg/terraform-provider-proxmox/commit/f96cc55)) ([#2978](https://github.com/bpg/terraform-provider-proxmox/issues/2978)) ([95d97fe](https://github.com/bpg/terraform-provider-proxmox/commit/95d97fea630f3a55db06451931ea2786afb00895)) - **deps:** update image golang ([`792443b`](https://github.com/bpg/terraform-provider-proxmox/commit/792443b) → [`32c0e6e`](https://github.com/bpg/terraform-provider-proxmox/commit/32c0e6e)) ([#2967](https://github.com/bpg/terraform-provider-proxmox/issues/2967)) ([efd1e95](https://github.com/bpg/terraform-provider-proxmox/commit/efd1e95b10efdf13df686495b1738a0570b65e82)) ### [`v0.111.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01110-2026-06-23) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.110.0...v0.111.0) ##### Features - **acme:** add write-only data\_wo argument to proxmox\_acme\_dns\_plugin ([#2962](https://github.com/bpg/terraform-provider-proxmox/issues/2962)) ([cd4ecd7](https://github.com/bpg/terraform-provider-proxmox/commit/cd4ecd7156f6ff6df610a79c586e5d15eb6da8a6)) - **disk:** add support for ZFS disk/zpool creation with `proxmox_node_disk_zfs` ([#2952](https://github.com/bpg/terraform-provider-proxmox/issues/2952)) ([087b1d0](https://github.com/bpg/terraform-provider-proxmox/commit/087b1d0a7a034d1935a0f9d976cd43806483dbfa)) - **openid:** add write-only client\_key\_wo to proxmox\_realm\_openid ([#2964](https://github.com/bpg/terraform-provider-proxmox/issues/2964)) ([0ef7bdc](https://github.com/bpg/terraform-provider-proxmox/commit/0ef7bdcc258cf01e05f2d5609356171641eb02f5)) ##### Miscellaneous - **ci:** Update actions/checkout action (v6.0.3 → v7.0.0) ([#2958](https://github.com/bpg/terraform-provider-proxmox/issues/2958)) ([0a5bf04](https://github.com/bpg/terraform-provider-proxmox/commit/0a5bf04053200e99446409dd813ee66ad4b19163)) - **docs:** update README.md ([5fd272a](https://github.com/bpg/terraform-provider-proxmox/commit/5fd272a4d6439a6f33be1fecef9b0e1080d5d407)) ### [`v0.110.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01100-2026-06-18) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.109.0...v0.110.0) ##### Features - **cluster:** add dynamic crs ha scheduler and auto-rebalance options ([#2940](https://github.com/bpg/terraform-provider-proxmox/issues/2940)) ([1b14b39](https://github.com/bpg/terraform-provider-proxmox/commit/1b14b39de0c174cf9b9f11bf9322b2ab61b64cee)) - **file:** add ImportState to `proxmox_virtual_environment_download_file` ([#2938](https://github.com/bpg/terraform-provider-proxmox/issues/2938)) ([e7a1032](https://github.com/bpg/terraform-provider-proxmox/commit/e7a1032ca8340597c027fe3ea0b479035b3409a3)) - **storage:** add `options` parameter for proxmox\_storage\_cifs resource ([#2947](https://github.com/bpg/terraform-provider-proxmox/issues/2947)) ([e152990](https://github.com/bpg/terraform-provider-proxmox/commit/e152990cdea28898c0055d77fd06ee356d162d97)) - **storage:** add create\_base\_path and create\_subdirs base options for cifs,nfs,dir storage resources ([#2949](https://github.com/bpg/terraform-provider-proxmox/issues/2949)) ([c1262fd](https://github.com/bpg/terraform-provider-proxmox/commit/c1262fd3c73dd326de42b67a459d9b86f70b8a34)) ##### Bug Fixes - **core:** surface underlying error on SSH file transfer failure ([#2956](https://github.com/bpg/terraform-provider-proxmox/issues/2956)) ([45d73a6](https://github.com/bpg/terraform-provider-proxmox/commit/45d73a6e3511de6ea82d8e97b6bc9a0ac7cc7dab)) - **node:** accept string-typed startall-onboot-delay in node config ([#2957](https://github.com/bpg/terraform-provider-proxmox/issues/2957)) ([87b7992](https://github.com/bpg/terraform-provider-proxmox/commit/87b7992cbb73ddf28cf532e528601ec2ee5b9a34)) ##### Miscellaneous - **deps:** update image golang ([`68cb6d6`](https://github.com/bpg/terraform-provider-proxmox/commit/68cb6d6) → [`87a41d2`](https://github.com/bpg/terraform-provider-proxmox/commit/87a41d2)) ([#2941](https://github.com/bpg/terraform-provider-proxmox/issues/2941)) ([b5dafd8](https://github.com/bpg/terraform-provider-proxmox/commit/b5dafd84c96e45c6ff573faf8339f1bc4d82c731)) - **deps:** update module golang.org/x/crypto (v0.52.0 → v0.53.0) ([#2942](https://github.com/bpg/terraform-provider-proxmox/issues/2942)) ([5bedef1](https://github.com/bpg/terraform-provider-proxmox/commit/5bedef142033fb8112dca06fcd983931f6a7daa1)) - **deps:** update module golang.org/x/net (v0.55.0 → v0.56.0) ([#2943](https://github.com/bpg/terraform-provider-proxmox/issues/2943)) ([804860f](https://github.com/bpg/terraform-provider-proxmox/commit/804860f6252a27d9d032517235589c0283d18cb8)) ### [`v0.109.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01090-2026-06-06) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.108.0...v0.109.0) ##### ⚠ BREAKING CHANGES - **vm:** restore ipv4\_addresses on refresh for existing VMs ([#2932](https://github.com/bpg/terraform-provider-proxmox/issues/2932)) ##### Features - **vm:** add queues option for scsi disks ([#2931](https://github.com/bpg/terraform-provider-proxmox/issues/2931)) ([f95abbc](https://github.com/bpg/terraform-provider-proxmox/commit/f95abbc00c87750e8f498c94c785b1f5310bd7a7)) ##### Bug Fixes - **core:** bound SSH dial and handshake with a timeout, improve concurrent sudo checks ([#2924](https://github.com/bpg/terraform-provider-proxmox/issues/2924)) ([d59b7bb](https://github.com/bpg/terraform-provider-proxmox/commit/d59b7bb71b884737ce11400b7ae8d1deb10da29d)) - **vm:** restore ipv4\_addresses on refresh for existing VMs ([#2932](https://github.com/bpg/terraform-provider-proxmox/issues/2932)) ([fdcc890](https://github.com/bpg/terraform-provider-proxmox/commit/fdcc890d6eb71ac8cb51d43d6227b13ce0dd63c5)) ##### Miscellaneous - **ci:** update actions/checkout action (v6.0.2 → v6.0.3) ([#2937](https://github.com/bpg/terraform-provider-proxmox/issues/2937)) ([832d2f8](https://github.com/bpg/terraform-provider-proxmox/commit/832d2f8bb2cb1a686dfb3f475afeb399aecabf00)) - **ci:** update actions/checkout digest ([`de0fac2`](https://github.com/bpg/terraform-provider-proxmox/commit/de0fac2) → [`df4cb1c`](https://github.com/bpg/terraform-provider-proxmox/commit/df4cb1c)) ([#2936](https://github.com/bpg/terraform-provider-proxmox/issues/2936)) ([e064604](https://github.com/bpg/terraform-provider-proxmox/commit/e064604608f56948ef6ae11efa2aa128680e32b5)) - **deps:** update image golang (1.26.3 → 1.26.4) ([#2933](https://github.com/bpg/terraform-provider-proxmox/issues/2933)) ([3159f24](https://github.com/bpg/terraform-provider-proxmox/commit/3159f2461250559d2a1412be2cf5c861acde865b)) ### [`v0.108.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01080-2026-06-01) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.107.0...v0.108.0) ##### Features - **access:** add audiences parameter to openid realm resource ([#2907](https://github.com/bpg/terraform-provider-proxmox/issues/2907)) ([71cfead](https://github.com/bpg/terraform-provider-proxmox/commit/71cfeadb6cfdd6cad434090ed0537d07b4108f9f)) - **ceph:** add proxmox\_ceph\_status data source ([#2910](https://github.com/bpg/terraform-provider-proxmox/issues/2910)) ([776d8bf](https://github.com/bpg/terraform-provider-proxmox/commit/776d8bfbf243f9614e2c7887e0a8c3a7c4df769c)) - **vm:** add agent.wait\_for\_ip.enabled to disable IP lookup ([#2923](https://github.com/bpg/terraform-provider-proxmox/issues/2923)) ([58db0a0](https://github.com/bpg/terraform-provider-proxmox/commit/58db0a04c422de4ca31995758b33e2e62d67d28a)) ##### Bug Fixes - **access:** only warn on inline acl when set in config ([#2918](https://github.com/bpg/terraform-provider-proxmox/issues/2918)) ([05f106b](https://github.com/bpg/terraform-provider-proxmox/commit/05f106b5a8fb1eeafd5dadf1a7c2b362e1199725)) - **core:** correct errors in diagnostic messages ([#2873](https://github.com/bpg/terraform-provider-proxmox/issues/2873)) ([6dfdfb6](https://github.com/bpg/terraform-provider-proxmox/commit/6dfdfb65b7951aa1bb58e151e5bdd568a2464efb)) - **lxc:** apply idmap on first boot after container create ([#2922](https://github.com/bpg/terraform-provider-proxmox/issues/2922)) ([f062e3e](https://github.com/bpg/terraform-provider-proxmox/commit/f062e3e4758f118c41047e586f38cee15a931c51)) - **vm:** prevent VM restart on import from keyboard/agent defaults ([#2911](https://github.com/bpg/terraform-provider-proxmox/issues/2911)) ([7080ae0](https://github.com/bpg/terraform-provider-proxmox/commit/7080ae06721934fe61b6e8c8c16d6dbe33a32ce7)) - **vm:** refresh hook\_script\_file\_id in read ([#2921](https://github.com/bpg/terraform-provider-proxmox/issues/2921)) ([f8b2dd9](https://github.com/bpg/terraform-provider-proxmox/commit/f8b2dd9f7dfc1caee0f3e92981c2d9d80bb9f194)) - **vm:** remove node-local devices before migration ([#2837](https://github.com/bpg/terraform-provider-proxmox/issues/2837)) ([7290812](https://github.com/bpg/terraform-provider-proxmox/commit/72908129a5dba98e4233eb3fa13e7e78f2dde129)) ##### Miscellaneous - **ci:** update actions/stale digest ([`b5d41d4`](https://github.com/bpg/terraform-provider-proxmox/commit/b5d41d4) → [`eb5cf3a`](https://github.com/bpg/terraform-provider-proxmox/commit/eb5cf3a)) ([#2920](https://github.com/bpg/terraform-provider-proxmox/issues/2920)) ([8e93ff7](https://github.com/bpg/terraform-provider-proxmox/commit/8e93ff7b00ab2e95f6c7d354f609e650428fafd3)) - **deps:** update image golang ([`6df14f4`](https://github.com/bpg/terraform-provider-proxmox/commit/6df14f4) → [`2d6c802`](https://github.com/bpg/terraform-provider-proxmox/commit/2d6c802)) ([#2916](https://github.com/bpg/terraform-provider-proxmox/issues/2916)) ([50673a0](https://github.com/bpg/terraform-provider-proxmox/commit/50673a0622096f96cd6defdba1914fbba05d5d77)) - **deps:** update module github.com/rogpeppe/go-internal (v1.14.1 → v1.15.0) ([#2917](https://github.com/bpg/terraform-provider-proxmox/issues/2917)) ([b0c896e](https://github.com/bpg/terraform-provider-proxmox/commit/b0c896ed6d80882463f5355b0b14573f7bbd0b54)) ### [`v0.107.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01070-2026-05-24) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.106.0...v0.107.0) ##### Features - **ceph:** add proxmox\_ceph\_pool resource ([#2884](https://github.com/bpg/terraform-provider-proxmox/issues/2884)) ([8fb6738](https://github.com/bpg/terraform-provider-proxmox/commit/8fb673836fe15ad1db2e5ba4302494d40c661b04)) - **ha:** add failback attribute to haresource ([#2865](https://github.com/bpg/terraform-provider-proxmox/issues/2865)) ([1b5e7d8](https://github.com/bpg/terraform-provider-proxmox/commit/1b5e7d85e97c7c4ab05ab2b1f6f16ef1e1da813d)) - **node:** add `node_config` resource and datasource ([#2875](https://github.com/bpg/terraform-provider-proxmox/issues/2875)) ([e00e81a](https://github.com/bpg/terraform-provider-proxmox/commit/e00e81a43e61f9a440f5dfb38afa4a9137e0091b)) ##### Bug Fixes - **access:** gate user/group acl read; deprecate inline acl ([e40c1ab](https://github.com/bpg/terraform-provider-proxmox/commit/e40c1ab8e27ae87a75db3530c4062d5f7d659156)) - **lxc:** avoid nil-bool panic when disk block is omitted ([#2908](https://github.com/bpg/terraform-provider-proxmox/issues/2908)) ([053ce10](https://github.com/bpg/terraform-provider-proxmox/commit/053ce103eb6f01827535efabb794060e1fdbafda)) - **lxc:** skip empty config PUT for lifecycle-only updates ([#2888](https://github.com/bpg/terraform-provider-proxmox/issues/2888)) ([32b1194](https://github.com/bpg/terraform-provider-proxmox/commit/32b1194b2df88c61f2cf407f490dcd6592650512)) - **sdn:** add missing acceptance build tag to EVPN Zone test ([#2872](https://github.com/bpg/terraform-provider-proxmox/issues/2872)) ([93ed6a8](https://github.com/bpg/terraform-provider-proxmox/commit/93ed6a845674136833342539711660871c9c4967)) ##### Miscellaneous - **ci:** update actions/create-github-app-token action (v3.1.1 → v3.2.0) ([#2879](https://github.com/bpg/terraform-provider-proxmox/issues/2879)) ([84f9d53](https://github.com/bpg/terraform-provider-proxmox/commit/84f9d539b68be80b29dd6f36e57794d9a29387b3)) - **ci:** update golangci/golangci-lint-action digest ([`1e7e51e`](https://github.com/bpg/terraform-provider-proxmox/commit/1e7e51e) → [`82606bf`](https://github.com/bpg/terraform-provider-proxmox/commit/82606bf)) ([#2903](https://github.com/bpg/terraform-provider-proxmox/issues/2903)) ([287ae68](https://github.com/bpg/terraform-provider-proxmox/commit/287ae6837fe28c779cfdd4a93c18a5eeb337ec5b)) - **ci:** update goreleaser/goreleaser-action action (v7.2.1 → v7.2.2) ([#2909](https://github.com/bpg/terraform-provider-proxmox/issues/2909)) ([4e63070](https://github.com/bpg/terraform-provider-proxmox/commit/4e63070a87caada0c2ad7bb19d9a53ce8005029b)) - **ci:** update hashicorp/setup-terraform action (v4.0.0 → v4.0.1) ([#2878](https://github.com/bpg/terraform-provider-proxmox/issues/2878)) ([519319e](https://github.com/bpg/terraform-provider-proxmox/commit/519319e36e720a29760a46033f81fb2ec996eb6e)) - **ci:** update hashicorp/setup-terraform digest ([`5e8dbf3`](https://github.com/bpg/terraform-provider-proxmox/commit/5e8dbf3) → [`dfe3c3f`](https://github.com/bpg/terraform-provider-proxmox/commit/dfe3c3f)) ([#2876](https://github.com/bpg/terraform-provider-proxmox/issues/2876)) ([e9d0381](https://github.com/bpg/terraform-provider-proxmox/commit/e9d038136c0baac7652992c6fcdd302b129e08fd)) - **ci:** use pull\_request\_target in project-automation ([f40c393](https://github.com/bpg/terraform-provider-proxmox/commit/f40c3939713d34387d46bc5a17162bbea90039e8)) - **deps:** update golangci/golangci-lint (v2.12.1 → v2.12.2) ([#2867](https://github.com/bpg/terraform-provider-proxmox/issues/2867)) ([832e174](https://github.com/bpg/terraform-provider-proxmox/commit/832e1743f5d66183eedf4981dead9016a172d060)) - **deps:** update image golang (1.26.2 → 1.26.3) ([#2868](https://github.com/bpg/terraform-provider-proxmox/issues/2868)) ([a729891](https://github.com/bpg/terraform-provider-proxmox/commit/a7298914781465acbcd900e25788793315747653)) - **deps:** update image golang ([`2981696`](https://github.com/bpg/terraform-provider-proxmox/commit/2981696) → [`313faae`](https://github.com/bpg/terraform-provider-proxmox/commit/313faae)) ([#2877](https://github.com/bpg/terraform-provider-proxmox/issues/2877)) ([4237a30](https://github.com/bpg/terraform-provider-proxmox/commit/4237a3055f0a773ea0c9a9eba0ae70bbc0255358)) - **deps:** update image golang ([`313faae`](https://github.com/bpg/terraform-provider-proxmox/commit/313faae) → [`6df14f4`](https://github.com/bpg/terraform-provider-proxmox/commit/6df14f4)) ([#2904](https://github.com/bpg/terraform-provider-proxmox/issues/2904)) ([1c97160](https://github.com/bpg/terraform-provider-proxmox/commit/1c97160ab931c338e4ee352f9b8e6fe4eb24ba6b)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.14.1 → v7.15.0) ([#2885](https://github.com/bpg/terraform-provider-proxmox/issues/2885)) ([b4d87e8](https://github.com/bpg/terraform-provider-proxmox/commit/b4d87e8ef70a2c3dfbd40452cec7c02cdcdb6812)) - **deps:** update module golang.org/x/crypto (v0.51.0 → v0.52.0) ([#2905](https://github.com/bpg/terraform-provider-proxmox/issues/2905)) ([5c4d15d](https://github.com/bpg/terraform-provider-proxmox/commit/5c4d15d081a31ee0bc6155e986a2e00c90924dde)) - **deps:** update module golang.org/x/net (v0.53.0 → v0.54.0) ([#2870](https://github.com/bpg/terraform-provider-proxmox/issues/2870)) ([c4f2de6](https://github.com/bpg/terraform-provider-proxmox/commit/c4f2de66446f8c1a155637ab1f62aee117f58ae6)) - **deps:** update module golang.org/x/net (v0.54.0 → v0.55.0) ([#2906](https://github.com/bpg/terraform-provider-proxmox/issues/2906)) ([ecb905d](https://github.com/bpg/terraform-provider-proxmox/commit/ecb905dc3623b1d7c09c7361e0c0a645e841fcfa)) - **docs:** update terraform local (2.8.0 → 2.9.0) ([#2880](https://github.com/bpg/terraform-provider-proxmox/issues/2880)) ([7b51658](https://github.com/bpg/terraform-provider-proxmox/commit/7b51658860c6e6c28ebce1e6d487921a234672c8)) - **docs:** update terraform tls (4.2.1 → 4.3.0) ([#2881](https://github.com/bpg/terraform-provider-proxmox/issues/2881)) ([15fc5ab](https://github.com/bpg/terraform-provider-proxmox/commit/15fc5abfe1c911cd0459181be1ace00f1af45fa8)) - **vm2:** error format sweep ([#2861](https://github.com/bpg/terraform-provider-proxmox/issues/2861)) ([047c4d4](https://github.com/bpg/terraform-provider-proxmox/commit/047c4d426c682030c6988479393bf32976908c4d)) ### [`v0.106.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01060-2026-05-06) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.105.0...v0.106.0) ##### Features - **lxc:** add support for `mknod()` feature ([#2845](https://github.com/bpg/terraform-provider-proxmox/issues/2845)) ([07f91b4](https://github.com/bpg/terraform-provider-proxmox/commit/07f91b4228f6989869c80b2e54f718e5db35e82d)) ##### Bug Fixes - **lxc:** allow disabling feature flags on update ([#2857](https://github.com/bpg/terraform-provider-proxmox/issues/2857)) ([2f3ae58](https://github.com/bpg/terraform-provider-proxmox/commit/2f3ae58a7d8c7414aa1589acb5cb2c37bff0a63e)) - **lxc:** refresh `features`, `start_on_boot`, `hookscript` in read ([#2852](https://github.com/bpg/terraform-provider-proxmox/issues/2852)) ([e316aba](https://github.com/bpg/terraform-provider-proxmox/commit/e316aba0d6040466ae028cef7262efb96be5f539)) - **network:** allow unknown `ports` on linux bridge validate ([#2855](https://github.com/bpg/terraform-provider-proxmox/issues/2855)) ([dacac9c](https://github.com/bpg/terraform-provider-proxmox/commit/dacac9cf581480523c31e5869c91d56cba00bceb)) ##### Miscellaneous - **ci:** Update actions/add-to-project action (v1.0.2 → v2) ([#2860](https://github.com/bpg/terraform-provider-proxmox/issues/2860)) ([5939390](https://github.com/bpg/terraform-provider-proxmox/commit/59393904ad7c17d94dd3c6b59d6768fd91585943)) ### [`v0.105.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01050-2026-05-02) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.104.0...v0.105.0) ##### Features - **core:** add SFTP file upload method ([#2836](https://github.com/bpg/terraform-provider-proxmox/issues/2836)) ([39ca5d3](https://github.com/bpg/terraform-provider-proxmox/commit/39ca5d39951f2d3f6c6ff6bfe1f19d08dfbf1c3d)) - **network:** add `vids` attribute to `proxmox_network_linux_bridge` ([#2841](https://github.com/bpg/terraform-provider-proxmox/issues/2841)) ([f391b1c](https://github.com/bpg/terraform-provider-proxmox/commit/f391b1c214cc86c6d35a037184d401844476650d)) - **sdn:** add support for EVPN controller ([#2839](https://github.com/bpg/terraform-provider-proxmox/issues/2839)) ([ed23beb](https://github.com/bpg/terraform-provider-proxmox/commit/ed23beb315b0afca5ac52bf1eca40a594ec8c0df)) ##### Bug Fixes - **acme:** mark `eab_hmac_key` and `eab_kid` as Sensitive ([#2838](https://github.com/bpg/terraform-provider-proxmox/issues/2838)) ([30051b2](https://github.com/bpg/terraform-provider-proxmox/commit/30051b2909f0c618df25936a5ec52c77435c41e1)) - **ci:** derive bot identity from app-slug output, not /app endpoint ([b801d67](https://github.com/bpg/terraform-provider-proxmox/commit/b801d67a21100832aeadb3911b13b70c709767d5)) - **ci:** read release PR branch from action output, not gh pr view ([52565bb](https://github.com/bpg/terraform-provider-proxmox/commit/52565bbba6f3b082fa05f9bbc6bd589961e16b58)) - **lxc:** gate `host_managed` on PVE 9.1+, not 9.0+ ([#2828](https://github.com/bpg/terraform-provider-proxmox/issues/2828)) ([d348aed](https://github.com/bpg/terraform-provider-proxmox/commit/d348aed3f980ce5d56eb22d1112e51fac9d16361)) - **network:** catch omitted `vlan_aware` in `vids` validator ([#2849](https://github.com/bpg/terraform-provider-proxmox/issues/2849)) ([9e47424](https://github.com/bpg/terraform-provider-proxmox/commit/9e47424a53832906b18a8f5c93d65496261b5efe)) ##### Miscellaneous - **ci:** update goreleaser/goreleaser-action action (v7.1.0 → v7.2.1) ([#2831](https://github.com/bpg/terraform-provider-proxmox/issues/2831)) ([2506f61](https://github.com/bpg/terraform-provider-proxmox/commit/2506f6132e7fc21e0d092be2d75e562d270e5471)) - **ci:** Update JetBrains/qodana-action action (v2025.3.2 → v2026.1.0) ([#2834](https://github.com/bpg/terraform-provider-proxmox/issues/2834)) ([d485cc9](https://github.com/bpg/terraform-provider-proxmox/commit/d485cc9a9eef90e6563e17ab253bd9ac5f152ee7)) - **code:** address Qodana code-quality findings ([#2827](https://github.com/bpg/terraform-provider-proxmox/issues/2827)) ([b0e08d7](https://github.com/bpg/terraform-provider-proxmox/commit/b0e08d72137bb2d391735c1928325602f40b7bb4)) - **core:** add nil-safe helpers for nil to value conversion ([#2829](https://github.com/bpg/terraform-provider-proxmox/issues/2829)) ([03493e9](https://github.com/bpg/terraform-provider-proxmox/commit/03493e988bd0cd51b5ae698faea0286d34c1a2a8)) - **deps:** update golangci/golangci-lint (v2.11.4 → v2.12.1) ([#2844](https://github.com/bpg/terraform-provider-proxmox/issues/2844)) ([c3a14a3](https://github.com/bpg/terraform-provider-proxmox/commit/c3a14a3e69047695df0d221a54797c90d388bc48)) - **deps:** update image golang ([`1e598ea`](https://github.com/bpg/terraform-provider-proxmox/commit/1e598ea) → [`b54cbf5`](https://github.com/bpg/terraform-provider-proxmox/commit/b54cbf5)) ([#2830](https://github.com/bpg/terraform-provider-proxmox/issues/2830)) ([16c2280](https://github.com/bpg/terraform-provider-proxmox/commit/16c228053938f6dd1741690b63a5f9da83bdf21d)) - **deps:** update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.40.0 → v2.40.1) ([#2843](https://github.com/bpg/terraform-provider-proxmox/issues/2843)) ([114ce5a](https://github.com/bpg/terraform-provider-proxmox/commit/114ce5a112be53f2ec4754b661b995fe9ee69178)) - **docs:** configure context7.json indexing with version sync ([ac70974](https://github.com/bpg/terraform-provider-proxmox/commit/ac7097469ee598315f7fe2d8ac8b7dcfeb96efa4)) - **lxc:** restructure container docs for LLM retrieval ([#2833](https://github.com/bpg/terraform-provider-proxmox/issues/2833)) ([7d264d8](https://github.com/bpg/terraform-provider-proxmox/commit/7d264d814ce4eec5952c6b79017d3a9b1c507d38)) ### [`v0.104.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01040-2026-04-25) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.103.0...v0.104.0) ##### Features - **lxc:** add `host_managed` option for container networking ([#2812](https://github.com/bpg/terraform-provider-proxmox/issues/2812)) ([03dcffb](https://github.com/bpg/terraform-provider-proxmox/commit/03dcffbfc15eac84f8f8edfeb605f6bf483ad051)) ##### Bug Fixes - **lxc:** apply disk acl/quota/replicate on container create ([#2824](https://github.com/bpg/terraform-provider-proxmox/issues/2824)) ([0d64b73](https://github.com/bpg/terraform-provider-proxmox/commit/0d64b73018a1698fa630e3958a24849dc20e4cce)) - **vm:** stop re-emitting `format=` on existing `import_from` disks ([#2822](https://github.com/bpg/terraform-provider-proxmox/issues/2822)) ([edfdac6](https://github.com/bpg/terraform-provider-proxmox/commit/edfdac61e99ad2e4474a3fdf9bd06062fb840a28)) - **vm:** treat missing disk volume as not-found during read ([#2821](https://github.com/bpg/terraform-provider-proxmox/issues/2821)) ([07cd772](https://github.com/bpg/terraform-provider-proxmox/commit/07cd77256451af736a07af3439e4480a2267caaf)) ##### Miscellaneous - **ci:** Update googleapis/release-please-action action (v4.4.1 → v5) ([#2820](https://github.com/bpg/terraform-provider-proxmox/issues/2820)) ([c607cbc](https://github.com/bpg/terraform-provider-proxmox/commit/c607cbcb01923bc7a7119b5e4b20ce91992fefbe)) - **ci:** update goreleaser/goreleaser-action action (v7.0.0 → v7.1.0) ([#2823](https://github.com/bpg/terraform-provider-proxmox/issues/2823)) ([4d86ada](https://github.com/bpg/terraform-provider-proxmox/commit/4d86ada87f875905af03b3cdf814d8af0a9c9b79)) - **deps:** update github.com/hashicorp/terraform-plugin-\* ([#2819](https://github.com/bpg/terraform-provider-proxmox/issues/2819)) ([65e1e16](https://github.com/bpg/terraform-provider-proxmox/commit/65e1e164eb214d10249dadaf0bb8101ca7ad481d)) - **deps:** update image golang ([`5f3787b`](https://github.com/bpg/terraform-provider-proxmox/commit/5f3787b) → [`1e598ea`](https://github.com/bpg/terraform-provider-proxmox/commit/1e598ea)) ([#2818](https://github.com/bpg/terraform-provider-proxmox/issues/2818)) ([4e2d74e](https://github.com/bpg/terraform-provider-proxmox/commit/4e2d74e42154bf4b941f8a432f972e466d0cedd0)) - **vm2:** add design for VM Plugin Framework migration ([d824227](https://github.com/bpg/terraform-provider-proxmox/commit/d824227aed86a89b2f2415af69b6d344bd82a6aa)) - **vm2:** audit VM resource implementation ([#2810](https://github.com/bpg/terraform-provider-proxmox/issues/2810)) ([618e0cb](https://github.com/bpg/terraform-provider-proxmox/commit/618e0cb357297c7c77b0778d2483cb3a0969b812)) - **vm2:** mark PR [#1](https://github.com/bpg/terraform-provider-proxmox/issues/1) merged in tracker ([8624144](https://github.com/bpg/terraform-provider-proxmox/commit/862414482b0d94ca5c56211d834b26dbda85990b)) ### [`v0.103.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01030-2026-04-18) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.102.0...v0.103.0) ##### Features - **cluster:** refactoring and improving `proxmox_metrics_server` ([#2805](https://github.com/bpg/terraform-provider-proxmox/issues/2805)) ([354abf4](https://github.com/bpg/terraform-provider-proxmox/commit/354abf450e7d37c0d866a94e9d714a70d1ba5e43)) - **file:** add `file_name_regex` filter to `proxmox_files` data source ([#2802](https://github.com/bpg/terraform-provider-proxmox/issues/2802)) ([c84eca9](https://github.com/bpg/terraform-provider-proxmox/commit/c84eca9d13180c11019ca91262a081506c5f28d6)) - **hw:** add `proxmox_hardware_pci` data source ([#2799](https://github.com/bpg/terraform-provider-proxmox/issues/2799)) ([76618a1](https://github.com/bpg/terraform-provider-proxmox/commit/76618a142c643ecc6820822120c583508ddc5c2f)) ##### Miscellaneous - **cluster:** align cluster\_options with ADR-003/005 ([#2804](https://github.com/bpg/terraform-provider-proxmox/issues/2804)) ([829ba6b](https://github.com/bpg/terraform-provider-proxmox/commit/829ba6bafcf86e740ca3fe09838775390d83efc9)) - **deps:** update image golang ([`fcdb3e4`](https://github.com/bpg/terraform-provider-proxmox/commit/fcdb3e4) → [`5f3787b`](https://github.com/bpg/terraform-provider-proxmox/commit/5f3787b)) ([#2807](https://github.com/bpg/terraform-provider-proxmox/issues/2807)) ([d067ce0](https://github.com/bpg/terraform-provider-proxmox/commit/d067ce083ea1ed5ab849d06253fcc52c4cedd629)) ### [`v0.102.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01020-2026-04-14) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.101.1...v0.102.0) ##### ⚠ BREAKING CHANGES - **lxc:** use computed `cpu.units` value instead of hardcoded 1024 ([#2791](https://github.com/bpg/terraform-provider-proxmox/issues/2791)) ##### Features - **provider:** add `node_address_source` ssh attribute for DNS-based node resolution ([#2792](https://github.com/bpg/terraform-provider-proxmox/issues/2792)) ([87d0abb](https://github.com/bpg/terraform-provider-proxmox/commit/87d0abb07a08f67599051b2711e572f69e292a96)) - **vm:** add `upgrade` attribute to cloud-init initialization block ([#2788](https://github.com/bpg/terraform-provider-proxmox/issues/2788)) ([e828b52](https://github.com/bpg/terraform-provider-proxmox/commit/e828b52f5028b3def9231e2617ced4550a161f84)) - **vm:** wait for guest agent readiness before reboot ([#2790](https://github.com/bpg/terraform-provider-proxmox/issues/2790)) ([40317ec](https://github.com/bpg/terraform-provider-proxmox/commit/40317ec995ba22ed713457502e35277276d8458e)) ##### Bug Fixes - **example:** update /example/\* to use short aliases ([d6f1680](https://github.com/bpg/terraform-provider-proxmox/commit/d6f168092f16e76e3bc4e5cd90e86eb3fdb63815)) - **lxc:** use computed `cpu.units` value instead of hardcoded 1024 ([#2791](https://github.com/bpg/terraform-provider-proxmox/issues/2791)) ([b54e6c5](https://github.com/bpg/terraform-provider-proxmox/commit/b54e6c5ce014a74a7ffe3440800d3e9d6a194b18)) ##### Miscellaneous - **ci:** update actions/create-github-app-token action (v3.0.0 → v3.1.1) ([#2796](https://github.com/bpg/terraform-provider-proxmox/issues/2796)) ([8397ff6](https://github.com/bpg/terraform-provider-proxmox/commit/8397ff69c37d2ea3d67c84897f2046e83746ffc4)) - **ci:** update actions/setup-go digest ([`4b73464`](https://github.com/bpg/terraform-provider-proxmox/commit/4b73464) → [`4a36011`](https://github.com/bpg/terraform-provider-proxmox/commit/4a36011)) ([#2793](https://github.com/bpg/terraform-provider-proxmox/issues/2793)) ([bfbf78c](https://github.com/bpg/terraform-provider-proxmox/commit/bfbf78c3b803c3348d0de7d5f988ac8f15cc17fe)) - **ci:** update actions/upload-artifact digest ([`bbbca2d`](https://github.com/bpg/terraform-provider-proxmox/commit/bbbca2d) → [`043fb46`](https://github.com/bpg/terraform-provider-proxmox/commit/043fb46)) ([#2794](https://github.com/bpg/terraform-provider-proxmox/issues/2794)) ([5c82af8](https://github.com/bpg/terraform-provider-proxmox/commit/5c82af893e3c569fab33933ba575851359171a54)) - **ci:** update googleapis/release-please-action action (v4.4.0 → v4.4.1) ([#2798](https://github.com/bpg/terraform-provider-proxmox/issues/2798)) ([7b10d95](https://github.com/bpg/terraform-provider-proxmox/commit/7b10d9523c68054f5b2e78c2da48c138225c8bb2)) - **code:** update to use Golang 1.26.x ([#2785](https://github.com/bpg/terraform-provider-proxmox/issues/2785)) ([d2f3c70](https://github.com/bpg/terraform-provider-proxmox/commit/d2f3c7039fcffc28060077c8b83a70986f2ea75a)) - **deps:** update image golang ([`2a2b4b5`](https://github.com/bpg/terraform-provider-proxmox/commit/2a2b4b5) → [`fcdb3e4`](https://github.com/bpg/terraform-provider-proxmox/commit/fcdb3e4)) ([#2797](https://github.com/bpg/terraform-provider-proxmox/issues/2797)) ([32d0937](https://github.com/bpg/terraform-provider-proxmox/commit/32d09376caef3019f3dc733be8393cc1ad0227f4)) - **deps:** update module github.com/hashicorp/terraform-plugin-mux (v0.23.0 → v0.23.1) ([#2795](https://github.com/bpg/terraform-provider-proxmox/issues/2795)) ([19925da](https://github.com/bpg/terraform-provider-proxmox/commit/19925da906ed176b96f4550b4f4070adfdba159e)) - **docs:** codify audit-discovered conventions into ADR-003/004/005 ([#2787](https://github.com/bpg/terraform-provider-proxmox/issues/2787)) ([d8c8c75](https://github.com/bpg/terraform-provider-proxmox/commit/d8c8c75a46ff8b1f90dce9067ebc9332b145b3ac)) - **docs:** update links to reference bpg.sh for documentation ([b36528a](https://github.com/bpg/terraform-provider-proxmox/commit/b36528a6faf3012eca92bed4ed5e0ee1acef648f)) - **docs:** update upgrade.md guide ([befb41d](https://github.com/bpg/terraform-provider-proxmox/commit/befb41dc80f73c9e62e2e8199685821a8653aea0)) ### [`v0.101.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01011-2026-04-10) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.101.0...v0.101.1) ##### Bug Fixes - **docs:** add missing examples and import sections for short-name aliases ([#2784](https://github.com/bpg/terraform-provider-proxmox/issues/2784)) ([5f59d52](https://github.com/bpg/terraform-provider-proxmox/commit/5f59d5263d112163ba5fb8eaeff0ff1af459fda7)) ##### Miscellaneous - **ci:** Update actions/github-script action (v8 → v9) ([#2782](https://github.com/bpg/terraform-provider-proxmox/issues/2782)) ([c8c9823](https://github.com/bpg/terraform-provider-proxmox/commit/c8c98237d813d2b1b4963f342d139701a9ef499a)) - **deps:** update image golang (1.26.1 → 1.26.2) ([#2778](https://github.com/bpg/terraform-provider-proxmox/issues/2778)) ([6805a82](https://github.com/bpg/terraform-provider-proxmox/commit/6805a82aae8a84fa7ab10e2ee48113001d2e373a)) - **deps:** update image golang ([`595c784`](https://github.com/bpg/terraform-provider-proxmox/commit/595c784) → [`cd78d88`](https://github.com/bpg/terraform-provider-proxmox/commit/cd78d88)) ([#2777](https://github.com/bpg/terraform-provider-proxmox/issues/2777)) ([ef0c04d](https://github.com/bpg/terraform-provider-proxmox/commit/ef0c04db7285be60474accc6c5caec3a99bf09f2)) - **deps:** update module golang.org/x/crypto (v0.49.0 → v0.50.0) ([#2780](https://github.com/bpg/terraform-provider-proxmox/issues/2780)) ([a963a30](https://github.com/bpg/terraform-provider-proxmox/commit/a963a30ef9dfdeb9988369700053132e44d00c9a)) - **deps:** update module golang.org/x/net (v0.52.0 → v0.53.0) ([#2781](https://github.com/bpg/terraform-provider-proxmox/issues/2781)) ([d167c32](https://github.com/bpg/terraform-provider-proxmox/commit/d167c32feb8cea5eb4dbe3068d5441da534c8300)) ### [`v0.101.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01010-2026-04-09) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.100.0...v0.101.0) ##### ⚠ BREAKING CHANGES - **vm:** fix and improve VM datasources, deprecate SDK datasource ([#2764](https://github.com/bpg/terraform-provider-proxmox/issues/2764)) ##### Features - **core:** surface PVE task warnings from VM/container operations ([#2761](https://github.com/bpg/terraform-provider-proxmox/issues/2761)) ([28850c8](https://github.com/bpg/terraform-provider-proxmox/commit/28850c82c257bed169f0bb878fe92372f37a162a)) - **lxc:** add `cpu.limit` attribute for containers ([#2744](https://github.com/bpg/terraform-provider-proxmox/issues/2744)) ([cb25180](https://github.com/bpg/terraform-provider-proxmox/commit/cb25180262b01eb61fa30194f9926cb1fb016e0a)) - **lxc:** add `full` flag to clone block ([#2755](https://github.com/bpg/terraform-provider-proxmox/issues/2755)) ([f7010e1](https://github.com/bpg/terraform-provider-proxmox/commit/f7010e1de932c2e7c3c3aa4964d67484d5e2bed5)) - **network:** add linux bond interface resource ([5db6deb](https://github.com/bpg/terraform-provider-proxmox/commit/5db6deb0ac7ae3bebb28adce96be8f36b9bc2a1f)), closes [#1980](https://github.com/bpg/terraform-provider-proxmox/issues/1980) ##### Bug Fixes - **docs:** add storage import docs ([#2759](https://github.com/bpg/terraform-provider-proxmox/issues/2759)) ([079902f](https://github.com/bpg/terraform-provider-proxmox/commit/079902ff7733613202269b9d454e98892bf20f4e)) - **hwmapping,ha:** better 'not-found' detection in read and delete ([#2767](https://github.com/bpg/terraform-provider-proxmox/issues/2767)) ([ac53f8c](https://github.com/bpg/terraform-provider-proxmox/commit/ac53f8c19e500395e313171dce43fdc40ff203f5)) - **network:** adjust Linux Bridge name validator to PVE UI constraint ([#2762](https://github.com/bpg/terraform-provider-proxmox/issues/2762)) ([190f7fa](https://github.com/bpg/terraform-provider-proxmox/commit/190f7fab74cc27ebacb267b84307f111779d71aa)) - **network:** improve consistency of linux network interface resources ([#2776](https://github.com/bpg/terraform-provider-proxmox/issues/2776)) ([57a97ce](https://github.com/bpg/terraform-provider-proxmox/commit/57a97ce4cce760756cf63706c5ed583f84faceb2)) - **vm:** fix and improve VM datasources, deprecate SDK datasource ([#2764](https://github.com/bpg/terraform-provider-proxmox/issues/2764)) ([0ce6d0c](https://github.com/bpg/terraform-provider-proxmox/commit/0ce6d0c0b936a6183508c8c41f4260649903057f)) - **vm:** use move\_disk API for EFI disk and TPM state storage migration ([#2757](https://github.com/bpg/terraform-provider-proxmox/issues/2757)) ([c78c873](https://github.com/bpg/terraform-provider-proxmox/commit/c78c8735727f4619981b3548cd1c8b303108cd79)) ##### Miscellaneous - **deps:** update module github.com/hashicorp/go-version (v1.8.0 → v1.9.0) ([#2760](https://github.com/bpg/terraform-provider-proxmox/issues/2760)) ([7362ba5](https://github.com/bpg/terraform-provider-proxmox/commit/7362ba5ed2b2b9790593572c1a82d7feddd487ac)) - **docs:** update terraform local (2.7.0 → 2.8.0) ([#2765](https://github.com/bpg/terraform-provider-proxmox/issues/2765)) ([0424b01](https://github.com/bpg/terraform-provider-proxmox/commit/0424b0169e3041db538b13abca391b148479aaa6)) ### [`v0.100.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#01000-2026-04-01) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.99.0...v0.100.0) ##### ⚠ BREAKING CHANGES - **vm:** set power state of VM centrally ([#2508](https://github.com/bpg/terraform-provider-proxmox/issues/2508)) ##### Features - **access:** add short-name aliases for access resources ([#2720](https://github.com/bpg/terraform-provider-proxmox/issues/2720)) ([8b690cf](https://github.com/bpg/terraform-provider-proxmox/commit/8b690cf835a507cf7c631b966815277f0d14fe42)) - **acme:** add short-name aliases for ACME resources ([#2721](https://github.com/bpg/terraform-provider-proxmox/issues/2721)) ([d386759](https://github.com/bpg/terraform-provider-proxmox/commit/d386759ffca09a6d84eb06ff457a64b62022c2a7)) - **cluster:** add short-name aliases for cluster resources ([#2725](https://github.com/bpg/terraform-provider-proxmox/issues/2725)) ([8fafc04](https://github.com/bpg/terraform-provider-proxmox/commit/8fafc043c699ea7cf4f2fefa71f5c8258a61c5da)) - **ha:** add short-name aliases for HA resources ([#2722](https://github.com/bpg/terraform-provider-proxmox/issues/2722)) ([acd0d9f](https://github.com/bpg/terraform-provider-proxmox/commit/acd0d9f7fdc15c3059a6cbeb02e49c1f0a26b532)) - **node:** add short-name aliases for node resources ([#2726](https://github.com/bpg/terraform-provider-proxmox/issues/2726)) ([33914d5](https://github.com/bpg/terraform-provider-proxmox/commit/33914d55808d25d97b9cf8123d54f501640dd290)) - **provider:** add short-name aliases for vm, version, and pool resources ([#2728](https://github.com/bpg/terraform-provider-proxmox/issues/2728)) ([38dca5a](https://github.com/bpg/terraform-provider-proxmox/commit/38dca5a91f1ea739e49e4b97e57d164f5570ad7b)) - **sdn:** add short-name aliases for SDN resources ([#2724](https://github.com/bpg/terraform-provider-proxmox/issues/2724)) ([0028588](https://github.com/bpg/terraform-provider-proxmox/commit/0028588ce3ed6a8808da5c50084755860e43d1ea)) - **storage:** add short-name aliases for storage resources ([#2727](https://github.com/bpg/terraform-provider-proxmox/issues/2727)) ([798f1ea](https://github.com/bpg/terraform-provider-proxmox/commit/798f1ea2f74186659601365589904691b1f91e7d)) ##### Bug Fixes - **cpu:** update docs, tests ([033b8f5](https://github.com/bpg/terraform-provider-proxmox/commit/033b8f5027eb2fdb83686de11bd4b67820201efb)) - **docs:** update broken doc links ([#2754](https://github.com/bpg/terraform-provider-proxmox/issues/2754)) ([b7d0242](https://github.com/bpg/terraform-provider-proxmox/commit/b7d0242a81a6bb3d36662ac1fab8b1dfe1d7eb83)) - **lychee:** update comments for clarity ([6fea54e](https://github.com/bpg/terraform-provider-proxmox/commit/6fea54e47f422cf03d0b3e333ff6eb96840c327c)) - **vm:** mark disk size as computed to prevent passthrough drift ([#2718](https://github.com/bpg/terraform-provider-proxmox/issues/2718)) ([cba4dd6](https://github.com/bpg/terraform-provider-proxmox/commit/cba4dd6936276e73a9411375378c8c05d9a5ddc9)) - **vm:** prevent disk resize revert when combined with config changes ([#2751](https://github.com/bpg/terraform-provider-proxmox/issues/2751)) ([f45cf78](https://github.com/bpg/terraform-provider-proxmox/commit/f45cf78cc7cba91ffe26f91feeb3cfcae5ad8a9a)) - **vm:** set power state of VM centrally ([#2508](https://github.com/bpg/terraform-provider-proxmox/issues/2508)) ([b8ceecd](https://github.com/bpg/terraform-provider-proxmox/commit/b8ceecd5afb2ab799b60dc90672c42538cb925b8)) - **vm:** support fractional cpulimit values ([#2745](https://github.com/bpg/terraform-provider-proxmox/issues/2745)) ([445e47c](https://github.com/bpg/terraform-provider-proxmox/commit/445e47c17c0764b0c1e3f8aadd73e9b505b8c06b)) ##### Miscellaneous - **core:** add migration helpers for resource type name rename (ADR-007) ([#2719](https://github.com/bpg/terraform-provider-proxmox/issues/2719)) ([b2bb732](https://github.com/bpg/terraform-provider-proxmox/commit/b2bb7324d2660cc79b520a02626086ed7971d7b5)) - **deps:** update golangci/golangci-lint (v2.11.3 → v2.11.4) ([#2729](https://github.com/bpg/terraform-provider-proxmox/issues/2729)) ([f95bc46](https://github.com/bpg/terraform-provider-proxmox/commit/f95bc4696720e2cb1bacac517301238a336812eb)) - **dev:** update ADRs and reference examples ([#2752](https://github.com/bpg/terraform-provider-proxmox/issues/2752)) ([15afbe8](https://github.com/bpg/terraform-provider-proxmox/commit/15afbe849fe9594e3be6cb0257b155ef41bcb3e0)) - **dev:** update code-review skill ([a7a489f](https://github.com/bpg/terraform-provider-proxmox/commit/a7a489f2924b70d5758deaebcd374b61653fc733)) - **docs:** document usage of ZFS storage in acc tests ([2eca921](https://github.com/bpg/terraform-provider-proxmox/commit/2eca921f9fde90bec3d883f46dc4b40a80638e04)) - **docs:** update FWK reference examples documentation ([c20d0be](https://github.com/bpg/terraform-provider-proxmox/commit/c20d0be5ab4a632b7c340e3781e7f60250a41d7f)) - **test:** add tier-based and resource-targeted test execution ([#2753](https://github.com/bpg/terraform-provider-proxmox/issues/2753)) ([31b4706](https://github.com/bpg/terraform-provider-proxmox/commit/31b4706600585700a4276c1b680ac3c5f58ef742)) - **test:** improve acceptance test stability and reliability ([#2746](https://github.com/bpg/terraform-provider-proxmox/issues/2746)) ([f54fca2](https://github.com/bpg/terraform-provider-proxmox/commit/f54fca2e1ff119ce4c6733dc9ba1034cc90e050c)) ### [`v0.99.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0990-2026-03-21) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.98.1...v0.99.0) ##### Features - **backup:** add `proxmox_backup_job` resource and `proxmox_backup_jobs` data source ([#2711](https://github.com/bpg/terraform-provider-proxmox/issues/2711)) ([92b3e88](https://github.com/bpg/terraform-provider-proxmox/commit/92b3e8856b1259319c23548fccb585b4c68a7adb)) - **file:** add `proxmox_files` data source ([#2703](https://github.com/bpg/terraform-provider-proxmox/issues/2703)) ([e848a57](https://github.com/bpg/terraform-provider-proxmox/commit/e848a5780816a9c525f6a224f4c0f028b8ec69e9)) - **ha:** add `proxmox_virtual_environment_harule` resource (PVE 9+) ([#2682](https://github.com/bpg/terraform-provider-proxmox/issues/2682)) ([31ab05a](https://github.com/bpg/terraform-provider-proxmox/commit/31ab05ac610c5caf0221cfd3c9b2c362052060d7)) - **provider:** add support for replication ([#2661](https://github.com/bpg/terraform-provider-proxmox/issues/2661)) ([ca9a5f7](https://github.com/bpg/terraform-provider-proxmox/commit/ca9a5f7c0029096790750d0d3f4b57507d57b4ba)) ##### Bug Fixes - **access:** remove overly restrictive `username_claim` validation on openid realm ([#2685](https://github.com/bpg/terraform-provider-proxmox/issues/2685)) ([7782dc5](https://github.com/bpg/terraform-provider-proxmox/commit/7782dc5d033a91dd0f1c962d0a3458c6497072a8)) - **ci:** correct repository reference in sync-docs workflow ([f225107](https://github.com/bpg/terraform-provider-proxmox/commit/f225107457e08a7a5b51fe51c51f3138d898f0b2)) - **ha:** handle nil Strict value in HARule and update API response validation ([3bf1e8c](https://github.com/bpg/terraform-provider-proxmox/commit/3bf1e8c764f009517123d86b7b14f46795927045)) - **lxc:** ignore warnings in container create and clone tasks ([#2701](https://github.com/bpg/terraform-provider-proxmox/issues/2701)) ([7f7e36d](https://github.com/bpg/terraform-provider-proxmox/commit/7f7e36d5a9193a86e17629c1dd58bada22a9ae6a)) - **vm:** reboot after disk resize when disk is not hotpluggable ([#2686](https://github.com/bpg/terraform-provider-proxmox/issues/2686)) ([4ffb2f1](https://github.com/bpg/terraform-provider-proxmox/commit/4ffb2f18688ec4b31e6e301782985a65e009aa67)) - **vm:** skip cloud-init device update when only config changed ([#2709](https://github.com/bpg/terraform-provider-proxmox/issues/2709)) ([46e8362](https://github.com/bpg/terraform-provider-proxmox/commit/46e8362cbce08e7fd0d44538dd43a28a85abbb17)) ##### Miscellaneous - **ci:** Update actions/create-github-app-token action (v2.2.1 → v3.0.0) ([#2698](https://github.com/bpg/terraform-provider-proxmox/issues/2698)) ([7983416](https://github.com/bpg/terraform-provider-proxmox/commit/798341634be600fcb4589138f0f8c6adddf654e7)) - **ci:** Update dorny/paths-filter action (v3.0.2 → v4.0.1) ([#2699](https://github.com/bpg/terraform-provider-proxmox/issues/2699)) ([9828faa](https://github.com/bpg/terraform-provider-proxmox/commit/9828faa09c7bd1642654aa11fc8263a8fa681527)) - **ci:** update jetbrains/qodana-action action (v2025.3.1 → v2025.3.2) ([#2712](https://github.com/bpg/terraform-provider-proxmox/issues/2712)) ([98e9407](https://github.com/bpg/terraform-provider-proxmox/commit/98e9407de5132176ea9c52a0f14296da6f0ef26f)) - **deps:** bump google.golang.org/grpc from 1.79.2 to 1.79.3 ([#2713](https://github.com/bpg/terraform-provider-proxmox/issues/2713)) ([c653d7c](https://github.com/bpg/terraform-provider-proxmox/commit/c653d7c190cdd2f1a0664c23229a4641b69efae3)) - **deps:** update github.com/hashicorp/terraform-plugin-\* ([#2693](https://github.com/bpg/terraform-provider-proxmox/issues/2693)) ([db6522f](https://github.com/bpg/terraform-provider-proxmox/commit/db6522fd4ab9ea54beb1b59ade2835fe47ca6af2)) - **deps:** update golangci/golangci-lint ([#2670](https://github.com/bpg/terraform-provider-proxmox/issues/2670)) ([979ce29](https://github.com/bpg/terraform-provider-proxmox/commit/979ce29246bc6f3ff2b54184b2bffc0e25cf0f5d)) - **deps:** update golangci/golangci-lint (v2.11.2 → v2.11.3) ([#2692](https://github.com/bpg/terraform-provider-proxmox/issues/2692)) ([a737b37](https://github.com/bpg/terraform-provider-proxmox/commit/a737b37cd2cea8aa4c786ba875ba42c995ab58c8)) - **deps:** update image golang ([`c7e98cc`](https://github.com/bpg/terraform-provider-proxmox/commit/c7e98cc) → [`595c784`](https://github.com/bpg/terraform-provider-proxmox/commit/595c784)) ([#2708](https://github.com/bpg/terraform-provider-proxmox/issues/2708)) ([d6339f9](https://github.com/bpg/terraform-provider-proxmox/commit/d6339f9333c18f3127cdf24d31161f5cf2df9341)) - **deps:** update image golang ([`e2ddb15`](https://github.com/bpg/terraform-provider-proxmox/commit/e2ddb15) → [`c7e98cc`](https://github.com/bpg/terraform-provider-proxmox/commit/c7e98cc)) ([#2691](https://github.com/bpg/terraform-provider-proxmox/issues/2691)) ([c33b2ab](https://github.com/bpg/terraform-provider-proxmox/commit/c33b2ab481c76a2d746e89b31267b2ae186a942c)) - **deps:** update module golang.org/x/crypto (v0.48.0 → v0.49.0) ([#2696](https://github.com/bpg/terraform-provider-proxmox/issues/2696)) ([e7484c2](https://github.com/bpg/terraform-provider-proxmox/commit/e7484c292907c35c8444650ad2eea2690de93e9e)) - **deps:** update module golang.org/x/net (v0.51.0 → v0.52.0) ([#2697](https://github.com/bpg/terraform-provider-proxmox/issues/2697)) ([951bc29](https://github.com/bpg/terraform-provider-proxmox/commit/951bc292fc5efb7f420ea0cd21e8811dfdfd726b)) - **dev:** introduce ADR-007 for resource type name migration to shorter prefix ([1c07f6d](https://github.com/bpg/terraform-provider-proxmox/commit/1c07f6d9c958c11dd05721bbfd74bba3155b119a)) ### [`v0.98.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0981-2026-03-09) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.98.0...v0.98.1) ##### Bug Fixes - **pool:** support nested pool IDs in API endpoints ([#2680](https://github.com/bpg/terraform-provider-proxmox/issues/2680)) ([c6c726b](https://github.com/bpg/terraform-provider-proxmox/commit/c6c726b6af4396c870c2572561523634c7634cc4)) - **provider:** preserve null `tos` in ACME account when API returns empty string ([#2672](https://github.com/bpg/terraform-provider-proxmox/issues/2672)) ([f9bbd7d](https://github.com/bpg/terraform-provider-proxmox/commit/f9bbd7dd97a2b459e73b06627e415dc2198fde42)) - **vm:** replace enumerated network and IP config fields with dynamic unmarshaling ([#2679](https://github.com/bpg/terraform-provider-proxmox/issues/2679)) ([e5b2771](https://github.com/bpg/terraform-provider-proxmox/commit/e5b277145c719ce5f99e4e38d2277a87546b921f)) - **vm:** support removal of network devices from VM configuration ([#2674](https://github.com/bpg/terraform-provider-proxmox/issues/2674)) ([9b5a978](https://github.com/bpg/terraform-provider-proxmox/commit/9b5a9786e14e2d852ef362fb238494f54a02405e)) ##### Miscellaneous - **deps:** update image golang (1.26.0 → 1.26.1) ([#2669](https://github.com/bpg/terraform-provider-proxmox/issues/2669)) ([9a8d85b](https://github.com/bpg/terraform-provider-proxmox/commit/9a8d85b43fb51b550e49566257ed670b827572de)) - **docs:** clarify example prerequisites for SSH, node name, timezone, and DHCP ([8f97a34](https://github.com/bpg/terraform-provider-proxmox/commit/8f97a34a7f631d925abec12a0254ddded04e36d9)) - **vm:** deprecate 'enabled' attribute on 'network\_device' block ([#2678](https://github.com/bpg/terraform-provider-proxmox/issues/2678)) ([65b809d](https://github.com/bpg/terraform-provider-proxmox/commit/65b809d6205337f023c78b22f442d2d5e3606530)) ### [`v0.98.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0980-2026-03-06) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.97.1...v0.98.0) ##### Features - **access:** add OpenID Connect realm resource and documentation ([#2655](https://github.com/bpg/terraform-provider-proxmox/issues/2655)) ([51c7535](https://github.com/bpg/terraform-provider-proxmox/commit/51c75354e0aae13c1f7b7e16bf0091b8a5fa526d)) - **lxc:** add support for `entrypoint` attribute ([#2543](https://github.com/bpg/terraform-provider-proxmox/issues/2543)) ([178a8ad](https://github.com/bpg/terraform-provider-proxmox/commit/178a8add4a738c1409184af1983f33966e8c5cb7)) ##### Bug Fixes - **lxc:** wrong mapping of `ignore-unpack-errors` attr in `create` API request ([8fe621d](https://github.com/bpg/terraform-provider-proxmox/commit/8fe621ddd6132c7131fa26e10e81b592241d9c3f)) - **vm:** add `started` attribute to `cloned_vm` resource ([#2666](https://github.com/bpg/terraform-provider-proxmox/issues/2666)) ([d9b292a](https://github.com/bpg/terraform-provider-proxmox/commit/d9b292ab05309e934873ebff8f0d16ef56b2e474)) ##### Miscellaneous - **ci:** Update crazy-max/ghaction-import-gpg action (v6.3.0 → v7.0.0) ([#2665](https://github.com/bpg/terraform-provider-proxmox/issues/2665)) ([e77ea1e](https://github.com/bpg/terraform-provider-proxmox/commit/e77ea1ed79752a5533c9bbf5fb902befac63f691)) - **ci:** Update peter-evans/repository-dispatch action (v3 → v4) ([#2653](https://github.com/bpg/terraform-provider-proxmox/issues/2653)) ([3408558](https://github.com/bpg/terraform-provider-proxmox/commit/34085582164e9c56933ca4c3b781b1492d021317)) - **deps:** bump cloudflare/circl to v1.6.3 ([da4b6ab](https://github.com/bpg/terraform-provider-proxmox/commit/da4b6ab101e6eefc96d450c0b602d8070bd3ff0f)) - **deps:** update image golang ([`9edf713`](https://github.com/bpg/terraform-provider-proxmox/commit/9edf713) → [`fb612b7`](https://github.com/bpg/terraform-provider-proxmox/commit/fb612b7)) ([#2663](https://github.com/bpg/terraform-provider-proxmox/issues/2663)) ([369254f](https://github.com/bpg/terraform-provider-proxmox/commit/369254f78dc25017159e6d9ad4dedb77c6347386)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.14.0 → v7.14.1) ([#2664](https://github.com/bpg/terraform-provider-proxmox/issues/2664)) ([b25f773](https://github.com/bpg/terraform-provider-proxmox/commit/b25f773aaaea96716ab91339a3997a730c070867)) - **docs:** fix broken links ([c792dc9](https://github.com/bpg/terraform-provider-proxmox/commit/c792dc93827658741d5339a90d00422b0daf242c)) - **docs:** remove TOC section from the main documentation page ([d6638f7](https://github.com/bpg/terraform-provider-proxmox/commit/d6638f79e13bc2196728eebc7df253915f0449b1)) - **docs:** update badge links in readme.md ([7de7db1](https://github.com/bpg/terraform-provider-proxmox/commit/7de7db1ad516a874ad3b6189d1e5e8447f8980f7)) - **docs:** update os type `l26` linux kernel range for vm ([#2657](https://github.com/bpg/terraform-provider-proxmox/issues/2657)) ([cdd7356](https://github.com/bpg/terraform-provider-proxmox/commit/cdd7356f5333f516c4edee63530ce4fc9ff76838)) - **docs:** update shields in readme.md ([8988f21](https://github.com/bpg/terraform-provider-proxmox/commit/8988f21eecb56b10a6f4ec7dcb596e45d77fa96b)) - **docs:** update terraform proxmox (0.97.0 → 0.97.1) ([#2648](https://github.com/bpg/terraform-provider-proxmox/issues/2648)) ([6811fb3](https://github.com/bpg/terraform-provider-proxmox/commit/6811fb3b749ff313dfd082b09459b9fe9d3c6eb8)) - **fwk:** standardize model files ([#2651](https://github.com/bpg/terraform-provider-proxmox/issues/2651)) ([911d8d3](https://github.com/bpg/terraform-provider-proxmox/commit/911d8d3430d5f416f24dd6ec3dc018be51694b2e)) ### [`v0.97.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0971-2026-02-27) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.97.0...v0.97.1) ##### Bug Fixes - **firewall:** handle missing security group in `Read` and fix id override `Create` ([#2647](https://github.com/bpg/terraform-provider-proxmox/issues/2647)) ([f526c39](https://github.com/bpg/terraform-provider-proxmox/commit/f526c3992321de337efa4d420549aa2baa9b4e48)) - **hwmapping:** enable nested USB hubs ([#2636](https://github.com/bpg/terraform-provider-proxmox/issues/2636)) ([d42fe74](https://github.com/bpg/terraform-provider-proxmox/commit/d42fe74c75c788a575aee92c4a80da4a18fa22c7)) - **vm,lxc:** add name validation ([#2631](https://github.com/bpg/terraform-provider-proxmox/issues/2631)) ([53cce6f](https://github.com/bpg/terraform-provider-proxmox/commit/53cce6fb4302ab9c0f9f697f24718afc35d3bfe0)) - **vm:** allow adding EFI disk without forcing VM replacement ([#2645](https://github.com/bpg/terraform-provider-proxmox/issues/2645)) ([d636403](https://github.com/bpg/terraform-provider-proxmox/commit/d63640316c1499aa0c61b2ba301470685b4d6b6d)) ##### Miscellaneous - **ci:** Update actions/attest-build-provenance action (v3 → v4) ([#2641](https://github.com/bpg/terraform-provider-proxmox/issues/2641)) ([de5f833](https://github.com/bpg/terraform-provider-proxmox/commit/de5f8334517f44e602fff28e31307d8d0c91eb3f)) - **ci:** update actions/setup-go digest ([`7a3fe6c`](https://github.com/bpg/terraform-provider-proxmox/commit/7a3fe6c) → [`4b73464`](https://github.com/bpg/terraform-provider-proxmox/commit/4b73464)) ([#2643](https://github.com/bpg/terraform-provider-proxmox/issues/2643)) ([9af341a](https://github.com/bpg/terraform-provider-proxmox/commit/9af341a94a2dfbf6e7df9762d94934a9e50d4bf1)) - **ci:** Update actions/upload-artifact action (v6 → v7) ([#2642](https://github.com/bpg/terraform-provider-proxmox/issues/2642)) ([4d84904](https://github.com/bpg/terraform-provider-proxmox/commit/4d84904b5764957ae66a600f3888aa681715e855)) - **ci:** Update hashicorp/setup-terraform action ([#2635](https://github.com/bpg/terraform-provider-proxmox/issues/2635)) ([af078b7](https://github.com/bpg/terraform-provider-proxmox/commit/af078b7dab3638b8d9da87f7acbc59ba1c3170c1)) - **ci:** update lycheeverse/lychee-action action (v2.7.0 → v2.8.0) ([#2638](https://github.com/bpg/terraform-provider-proxmox/issues/2638)) ([5271851](https://github.com/bpg/terraform-provider-proxmox/commit/5271851dc97a143db6a7870cfb8d549d52c2f1fd)) - **deps:** update github.com/hashicorp/terraform-plugin-\* ([#2634](https://github.com/bpg/terraform-provider-proxmox/issues/2634)) ([345f785](https://github.com/bpg/terraform-provider-proxmox/commit/345f785b7026dbeaf87c3751b3531c46380a1f8c)) - **deps:** update image golang ([`c83e68f`](https://github.com/bpg/terraform-provider-proxmox/commit/c83e68f) → [`9edf713`](https://github.com/bpg/terraform-provider-proxmox/commit/9edf713)) ([#2633](https://github.com/bpg/terraform-provider-proxmox/issues/2633)) ([c47a705](https://github.com/bpg/terraform-provider-proxmox/commit/c47a70569b7842ece5bc9e8f6f4c3b17c269dac0)) - **deps:** update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.38.2 → v2.39.0) ([#2639](https://github.com/bpg/terraform-provider-proxmox/issues/2639)) ([8b3bff1](https://github.com/bpg/terraform-provider-proxmox/commit/8b3bff197e7ea8a5be85effa65759443ef976a8b)) - **deps:** update module golang.org/x/net (v0.50.0 → v0.51.0) ([#2640](https://github.com/bpg/terraform-provider-proxmox/issues/2640)) ([587d1fe](https://github.com/bpg/terraform-provider-proxmox/commit/587d1feb7b8d6492741f9975ba807fef50193e1a)) - **docs:** add vm-lifecycle, multi-node, and upgrade guides ([#2628](https://github.com/bpg/terraform-provider-proxmox/issues/2628)) ([d2b8729](https://github.com/bpg/terraform-provider-proxmox/commit/d2b87294e72181caa12ccae497a3d4bf7837b766)) ### [`v0.97.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0970-2026-02-23) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.96.0...v0.97.0) ##### Features - **lxc:** implement idmap support via SSH config file editing ([#2579](https://github.com/bpg/terraform-provider-proxmox/issues/2579)) ([63334e1](https://github.com/bpg/terraform-provider-proxmox/commit/63334e163fe4562dce7cbfbc446d6a77b5671a62)) ##### Bug Fixes - **ci:** exclude ARM architecture for Windows builds in goreleaser ([9c268a5](https://github.com/bpg/terraform-provider-proxmox/commit/9c268a57504ba61a7516069c4478d88d0e746a86)) - **docs:** clarify SSH password inheritance with API token auth ([#2624](https://github.com/bpg/terraform-provider-proxmox/issues/2624)) ([d453924](https://github.com/bpg/terraform-provider-proxmox/commit/d4539245714a3d243d0343bf7b85e1c3a4451642)) - **firewall:** handle "already exists" error in SG and IPSet create ([#2627](https://github.com/bpg/terraform-provider-proxmox/issues/2627)) ([06f3c6f](https://github.com/bpg/terraform-provider-proxmox/commit/06f3c6f9ff78db56ddcb2db2a7db6f655898a3d1)) - **firewall:** update rules with position awareness ([#2593](https://github.com/bpg/terraform-provider-proxmox/issues/2593)) ([2bd6b98](https://github.com/bpg/terraform-provider-proxmox/commit/2bd6b98a004380e02ff672251cb841dd279a4a07)) - **lxc, vm:** add retries for LXC operations, unify retry logic into shared package ([#2616](https://github.com/bpg/terraform-provider-proxmox/issues/2616)) ([39c0198](https://github.com/bpg/terraform-provider-proxmox/commit/39c01984184eed019dcad8b8f6f4c8660bd05060)) - **storage:** unknown `encryption_key_fingerprint` after PBS apply ([#2625](https://github.com/bpg/terraform-provider-proxmox/issues/2625)) ([82c49fd](https://github.com/bpg/terraform-provider-proxmox/commit/82c49fdc87c182a0d71ed705320c8aa265f8d793)) - **vm:** preserve disk deletions in update request ([#2614](https://github.com/bpg/terraform-provider-proxmox/issues/2614)) ([b12111f](https://github.com/bpg/terraform-provider-proxmox/commit/b12111fa5d29b27349569500675515f140de1da6)) - **vm:** remove duplicate line in ipConfigObjects ([#2618](https://github.com/bpg/terraform-provider-proxmox/issues/2618)) ([0a4ab5b](https://github.com/bpg/terraform-provider-proxmox/commit/0a4ab5beee272c95bb3c9887adcfebf08e4aa3f3)) - **vm:** skip cdrom devices during disk read-back on import ([#2626](https://github.com/bpg/terraform-provider-proxmox/issues/2626)) ([64c2db2](https://github.com/bpg/terraform-provider-proxmox/commit/64c2db25f60c35a1d61bbf9a2eb9ac87cd34ccf2)) ##### Miscellaneous - **ci:** update actions/stale digest ([`9971854`](https://github.com/bpg/terraform-provider-proxmox/commit/9971854) → [`b5d41d4`](https://github.com/bpg/terraform-provider-proxmox/commit/b5d41d4)) ([#2611](https://github.com/bpg/terraform-provider-proxmox/issues/2611)) ([fcead36](https://github.com/bpg/terraform-provider-proxmox/commit/fcead36a03f65c7e538ed6ceb1c2a5af4dcd9ee8)) - **ci:** Update goreleaser/goreleaser-action action (v6.4.0 → v7.0.0) ([#2623](https://github.com/bpg/terraform-provider-proxmox/issues/2623)) ([f7ab67d](https://github.com/bpg/terraform-provider-proxmox/commit/f7ab67de8338be8d9341da1b7de65c44e1f35f92)) - **deps:** update golangci/golangci-lint (v2.9.0 → v2.10.1) ([#2603](https://github.com/bpg/terraform-provider-proxmox/issues/2603)) ([3e64ec4](https://github.com/bpg/terraform-provider-proxmox/commit/3e64ec42e28b962b528fd103107a985637f1e7f8)) - **docs:** update terraform local (2.6.2 → 2.7.0) ([#2612](https://github.com/bpg/terraform-provider-proxmox/issues/2612)) ([6da27f6](https://github.com/bpg/terraform-provider-proxmox/commit/6da27f6042997d8d32062824685ebe95ea5af93d)) ### [`v0.96.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0960-2026-02-18) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.95.0...v0.96.0) ##### Features - **cluster:** add otel options to metrics server resource ([#2595](https://github.com/bpg/terraform-provider-proxmox/issues/2595)) ([32dfac8](https://github.com/bpg/terraform-provider-proxmox/commit/32dfac87b9689a1ad768e8a12e03606ad8398006)) - **network:** add configurable timeout for network reload operations ([#2573](https://github.com/bpg/terraform-provider-proxmox/issues/2573)) ([ed8593d](https://github.com/bpg/terraform-provider-proxmox/commit/ed8593db8de12bbb3ab940ee4db1e887d4205b53)) ##### Bug Fixes - **cluster:** fix `Description` body-building bug and standardize delete handling in options ([#2601](https://github.com/bpg/terraform-provider-proxmox/issues/2601)) ([a704bb1](https://github.com/bpg/terraform-provider-proxmox/commit/a704bb17e7ec78bf7a1bf03451575e95b20aaee3)) - **file:** retry read-back after upload for distributed storage consistency ([#2571](https://github.com/bpg/terraform-provider-proxmox/issues/2571)) ([989a4ba](https://github.com/bpg/terraform-provider-proxmox/commit/989a4bad8fcd93914492a8deb190125dfbc66ad2)) - **hwmapping:** add comment validator, fix acceptance tests ([#2609](https://github.com/bpg/terraform-provider-proxmox/issues/2609)) ([f943051](https://github.com/bpg/terraform-provider-proxmox/commit/f943051bd79bd2f5d9e478eee595c524818fb2dd)) - **network:** properly delete cidr/cidr6 when address is removed from linux ([#2587](https://github.com/bpg/terraform-provider-proxmox/issues/2587)) ([a52a11f](https://github.com/bpg/terraform-provider-proxmox/commit/a52a11ff461d3b2a650cfa61d4dcebcdf1ce45e2)) - **network:** properly delete optional fields when removed from VLAN config ([#2599](https://github.com/bpg/terraform-provider-proxmox/issues/2599)) ([d0f1704](https://github.com/bpg/terraform-provider-proxmox/commit/d0f17048766efdb0a139e13c607e1507acba3c2a)) - **node:** add CPU utilization to node data source ([#2605](https://github.com/bpg/terraform-provider-proxmox/issues/2605)) ([1a1cbbb](https://github.com/bpg/terraform-provider-proxmox/commit/1a1cbbb2b205d9e0cbd2e29eb2c8dfbbb2dec8d9)) - **sdn:** avoid mtu=0 when omitted for sdn zones ([#2584](https://github.com/bpg/terraform-provider-proxmox/issues/2584)) ([66c43d8](https://github.com/bpg/terraform-provider-proxmox/commit/66c43d8366dc2957926887c2ee08d1066d8de781)) - **sdn:** better `apply` resiliency, fix import of a pending zone ([#2610](https://github.com/bpg/terraform-provider-proxmox/issues/2610)) ([a9ea3c1](https://github.com/bpg/terraform-provider-proxmox/commit/a9ea3c14c93877cea587d0cbc8261371a7b40e9a)) - **vm:** clean up orphaned re-import code and clarify `import_from` as create-only ([#2568](https://github.com/bpg/terraform-provider-proxmox/issues/2568)) ([2160f00](https://github.com/bpg/terraform-provider-proxmox/commit/2160f00e624ff83e954574c87dbdb2c542739f4b)) ##### Miscellaneous - **core:** unify Delete field type across API client structs ([#2604](https://github.com/bpg/terraform-provider-proxmox/issues/2604)) ([d6a66f4](https://github.com/bpg/terraform-provider-proxmox/commit/d6a66f445fbb164aae998d5d28e7bb24d121bcdc)) - **deps:** update golangci/golangci-lint (v2.8.0 → v2.9.0) ([#2589](https://github.com/bpg/terraform-provider-proxmox/issues/2589)) ([ee0f07f](https://github.com/bpg/terraform-provider-proxmox/commit/ee0f07f1577f77f19a1c384464eab35441dedc14)) - **deps:** update image golang (1.25.7 → 1.26.0) ([#2590](https://github.com/bpg/terraform-provider-proxmox/issues/2590)) ([8f5d598](https://github.com/bpg/terraform-provider-proxmox/commit/8f5d598b8ac927f430aa87eaaea45ac061d9a7cc)) - **deps:** update module golang.org/x/crypto (v0.47.0 → v0.48.0) ([#2591](https://github.com/bpg/terraform-provider-proxmox/issues/2591)) ([43c295b](https://github.com/bpg/terraform-provider-proxmox/commit/43c295b014118bcf9768ca81fbf1c1daa6ba771a)) - **deps:** update module golang.org/x/net (v0.49.0 → v0.50.0) ([#2592](https://github.com/bpg/terraform-provider-proxmox/issues/2592)) ([7b83dd8](https://github.com/bpg/terraform-provider-proxmox/commit/7b83dd872b9caf49056bea48fa145f1cec9ae898)) - **test:** do not run SDN acceptance tests in parallel ([#2607](https://github.com/bpg/terraform-provider-proxmox/issues/2607)) ([ac1fabd](https://github.com/bpg/terraform-provider-proxmox/commit/ac1fabd6c108da320ef5eda0b7a10563f9870e65)) - **test:** fix parallel VM tests execution ([#2608](https://github.com/bpg/terraform-provider-proxmox/issues/2608)) ([09500be](https://github.com/bpg/terraform-provider-proxmox/commit/09500be52827f7d273058834ae4c660b722ce89c)) ### [`v0.95.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0950-2026-02-08) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.94.0...v0.95.0) ##### ⚠ BREAKING CHANGES - **node:** correct `cpu_count` inconsistency between `_node` and `_nodes` data sources ([#2559](https://github.com/bpg/terraform-provider-proxmox/issues/2559)) ##### Bug Fixes - **docs:** update PR title guidelines for breaking changes and contributor notes ([d884c4a](https://github.com/bpg/terraform-provider-proxmox/commit/d884c4aaccac54ba641ffe3e91dff34bee6dccb2)) - **lxc:** apply start\_on\_boot and features on clone and update ([#2562](https://github.com/bpg/terraform-provider-proxmox/issues/2562)) ([b21616a](https://github.com/bpg/terraform-provider-proxmox/commit/b21616a0bd37e48e18307a9cadd2ca47ef209e7a)) - **node:** correct `cpu_count` inconsistency between `_node` and `_nodes` data sources ([#2559](https://github.com/bpg/terraform-provider-proxmox/issues/2559)) ([c4d8d6b](https://github.com/bpg/terraform-provider-proxmox/commit/c4d8d6b17d7140fcd21e901a817d2688111dd6bf)) - **vm:** apply custom timeouts on update operations ([#2561](https://github.com/bpg/terraform-provider-proxmox/issues/2561)) ([e9bb225](https://github.com/bpg/terraform-provider-proxmox/commit/e9bb22571d1dd1db10fe961b44a0f6dadbab91c1)) - **vm:** correctly update hotpluggable devices ([#2556](https://github.com/bpg/terraform-provider-proxmox/issues/2556)) ([9d4155a](https://github.com/bpg/terraform-provider-proxmox/commit/9d4155aeafad16b31f728df30649c79879685e61)) - **vm:** reboot before disk resize to prevent pending changes from reverting size ([#2563](https://github.com/bpg/terraform-provider-proxmox/issues/2563)) ([3465c84](https://github.com/bpg/terraform-provider-proxmox/commit/3465c84cbc5f8e2f3f79acdf9519aa181eb66607)) ##### Miscellaneous - **ci:** Update actions/checkout action (v4.2.2 → v6.0.2) ([#2554](https://github.com/bpg/terraform-provider-proxmox/issues/2554)) ([9262783](https://github.com/bpg/terraform-provider-proxmox/commit/9262783b80d08a3bd40d81aeaa9d00a37ff02c32)) - **ci:** update actions/checkout digest ([`8e8c483`](https://github.com/bpg/terraform-provider-proxmox/commit/8e8c483) → [`de0fac2`](https://github.com/bpg/terraform-provider-proxmox/commit/de0fac2)) ([#2557](https://github.com/bpg/terraform-provider-proxmox/issues/2557)) ([db2bba1](https://github.com/bpg/terraform-provider-proxmox/commit/db2bba15922b54f28ed06efa4b5d84e41f2e0e13)) - **deps:** update image golang ([`011d6e2`](https://github.com/bpg/terraform-provider-proxmox/commit/011d6e2) → [`cc73743`](https://github.com/bpg/terraform-provider-proxmox/commit/cc73743)) ([#2564](https://github.com/bpg/terraform-provider-proxmox/issues/2564)) ([5b10da9](https://github.com/bpg/terraform-provider-proxmox/commit/5b10da9f2d4a8b9435b776a0c2a5d246372d672e)) - **deps:** update image golang (1.25.6 → 1.25.7) ([#2552](https://github.com/bpg/terraform-provider-proxmox/issues/2552)) ([d148eb0](https://github.com/bpg/terraform-provider-proxmox/commit/d148eb08d3a7fcc26ae02e59058f98e28181d7fe)) - **deps:** update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.38.1 → v2.38.2) ([#2553](https://github.com/bpg/terraform-provider-proxmox/issues/2553)) ([aa1b8ce](https://github.com/bpg/terraform-provider-proxmox/commit/aa1b8cea32ee5f8c86109f49654c5c8528ed49ca)) - **dev:** update templates and define skills for LLM agent flows ([#2542](https://github.com/bpg/terraform-provider-proxmox/issues/2542)) ([615c670](https://github.com/bpg/terraform-provider-proxmox/commit/615c6705b20d8743ff81f440a89f55ed7a5728aa)) - **docs:** add Architecture Decision Records for the dev process ([#2546](https://github.com/bpg/terraform-provider-proxmox/issues/2546)) ([97317f6](https://github.com/bpg/terraform-provider-proxmox/commit/97317f6ef11a02d13fbdeec447cc48c6f87cbafd)) - **docs:** add notice to enable 'Import' content type to allow its use with file resources ([#2558](https://github.com/bpg/terraform-provider-proxmox/issues/2558)) ([90ce565](https://github.com/bpg/terraform-provider-proxmox/commit/90ce565e7dc855fc9855d3d0f29c3e41504364d9)) - **docs:** fix links in DEBUGGING.md ([8beb699](https://github.com/bpg/terraform-provider-proxmox/commit/8beb699d395d135283874852288335ecc633cdbd)) ### [`v0.94.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0940-2026-02-02) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.93.1...v0.94.0) ##### Features - **firewall:** add `proxmox_virtual_environment_node_firewall` ([#2502](https://github.com/bpg/terraform-provider-proxmox/issues/2502)) ([d45f269](https://github.com/bpg/terraform-provider-proxmox/commit/d45f26920e7ff8266793d885c7ff3dddd6a6651f)) ##### Bug Fixes - **lxc:** provision mount points when cloning containers ([#2529](https://github.com/bpg/terraform-provider-proxmox/issues/2529)) ([67990d7](https://github.com/bpg/terraform-provider-proxmox/commit/67990d72c664a46c496097946ee48eddac29ae1a)), closes [#2518](https://github.com/bpg/terraform-provider-proxmox/issues/2518) [#2507](https://github.com/bpg/terraform-provider-proxmox/issues/2507) - **network:** update reload timeout and retry ([#2510](https://github.com/bpg/terraform-provider-proxmox/issues/2510)) ([f66b9dd](https://github.com/bpg/terraform-provider-proxmox/commit/f66b9dde260d740415990b7fc275f6564fecf712)) - **sdn:** correct EVPN resource handling and improvements to base zone ([#2501](https://github.com/bpg/terraform-provider-proxmox/issues/2501)) ([c159715](https://github.com/bpg/terraform-provider-proxmox/commit/c159715e4341e87168d73f1cc58e9ead2a15be82)) - **storage:** add validator for acceptable values for storage content and update docs ([#2519](https://github.com/bpg/terraform-provider-proxmox/issues/2519)) ([fc8b018](https://github.com/bpg/terraform-provider-proxmox/commit/fc8b0181b87e9c2dcb148fb2c81d92562e6e3230)) - **vm:** add missing cpu types ([#2499](https://github.com/bpg/terraform-provider-proxmox/issues/2499)) ([f51c8df](https://github.com/bpg/terraform-provider-proxmox/commit/f51c8dfd08360808d41201bb81fd2db1896a1238)) - **vm:** handle nil `ip_config` block in cloud-init during clone ([#2527](https://github.com/bpg/terraform-provider-proxmox/issues/2527)) ([4ed5433](https://github.com/bpg/terraform-provider-proxmox/commit/4ed543348ea5357874d8d4415252ceb8c835c3bb)) - **vm:** require reboot for CPU core or socket changes ([#2534](https://github.com/bpg/terraform-provider-proxmox/issues/2534)) ([3ca754c](https://github.com/bpg/terraform-provider-proxmox/commit/3ca754cf73439a9b0e817b07926e91806a42603a)), closes [#2516](https://github.com/bpg/terraform-provider-proxmox/issues/2516) ### [`v0.93.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0931-2026-01-31) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.93.0...v0.93.1) ##### Bug Fixes - **docs:** prevent path traversal in sudoers tee configuration ([#2524](https://github.com/bpg/terraform-provider-proxmox/issues/2524)) ([bd604c4](https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023)) ##### Miscellaneous - **ci:** update actions/checkout action (v6.0.1 → v6.0.2) ([#2521](https://github.com/bpg/terraform-provider-proxmox/issues/2521)) ([84e0b97](https://github.com/bpg/terraform-provider-proxmox/commit/84e0b97aa0d2fbc111e1db5432a97f98ed25ca6b)) - **ci:** update actions/setup-go digest ([`4dc6199`](https://github.com/bpg/terraform-provider-proxmox/commit/4dc6199) → [`7a3fe6c`](https://github.com/bpg/terraform-provider-proxmox/commit/7a3fe6c)) ([#2520](https://github.com/bpg/terraform-provider-proxmox/issues/2520)) ([1a1174c](https://github.com/bpg/terraform-provider-proxmox/commit/1a1174c73ce6089af1c66f006a51ff1acb99699f)) - **deps:** update image golang (1.25.5 → 1.25.6) ([#2504](https://github.com/bpg/terraform-provider-proxmox/issues/2504)) ([3e75bbb](https://github.com/bpg/terraform-provider-proxmox/commit/3e75bbb41f3b967f7602bb38182052518bcedbfd)) - **deps:** update image golang ([`6cc2338`](https://github.com/bpg/terraform-provider-proxmox/commit/6cc2338) → [`8bbd140`](https://github.com/bpg/terraform-provider-proxmox/commit/8bbd140)) ([#2503](https://github.com/bpg/terraform-provider-proxmox/issues/2503)) ([d087c97](https://github.com/bpg/terraform-provider-proxmox/commit/d087c97870d992711a6131ac1913e19af2f936b1)) - **deps:** update module golang.org/x/net (v0.48.0 → v0.49.0) ([#2506](https://github.com/bpg/terraform-provider-proxmox/issues/2506)) ([9fe808a](https://github.com/bpg/terraform-provider-proxmox/commit/9fe808adc8fb8aadf1d68a7540b7a9b205f123b3)) - **docs:** update terraform local (2.6.1 → 2.6.2) ([#2522](https://github.com/bpg/terraform-provider-proxmox/issues/2522)) ([8c64b5e](https://github.com/bpg/terraform-provider-proxmox/commit/8c64b5e0199eb9aad85d41739e3b0d2ef0134f18)) - **docs:** update terraform tls (4.1.0 → 4.2.1) ([#2523](https://github.com/bpg/terraform-provider-proxmox/issues/2523)) ([94d9dd3](https://github.com/bpg/terraform-provider-proxmox/commit/94d9dd3feca1a8ff285de92b58601ff2261b74a3)) ### [`v0.93.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0930-2026-01-12) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.92.0...v0.93.0) ##### Features - **lxc:** add `path_in_datastore` computed attribute for cross-resource refs ([#2493](https://github.com/bpg/terraform-provider-proxmox/issues/2493)) ([616ec37](https://github.com/bpg/terraform-provider-proxmox/commit/616ec379f2052bd1a512e123c0c363ee2cb894aa)) - **lxc:** enable root disk resize without recreate ([#2321](https://github.com/bpg/terraform-provider-proxmox/issues/2321)) ([581782c](https://github.com/bpg/terraform-provider-proxmox/commit/581782c4b12a6e9d35b2734194ee6c05d52c79d8)) - **vm:** add ha-aware migration for ha-managed vms ([#2476](https://github.com/bpg/terraform-provider-proxmox/issues/2476)) ([4f5b4fb](https://github.com/bpg/terraform-provider-proxmox/commit/4f5b4fb27865f1acdd884a040ad8c686a64d5036)) - **vm:** add support for `hotplug` parameter ([#2356](https://github.com/bpg/terraform-provider-proxmox/issues/2356)) ([891fd41](https://github.com/bpg/terraform-provider-proxmox/commit/891fd4185f7dad1d022c90bda137b9aa9c179106)) ##### Bug Fixes - **docs:** improve provider documentation readability and structure ([#2487](https://github.com/bpg/terraform-provider-proxmox/issues/2487)) ([b9457fa](https://github.com/bpg/terraform-provider-proxmox/commit/b9457fa9b3b30c8d5535bedfba40d81dc7a527e2)) - **example:** make lxc container use root provider so it works ([#2458](https://github.com/bpg/terraform-provider-proxmox/issues/2458)) ([7e1a379](https://github.com/bpg/terraform-provider-proxmox/commit/7e1a3796855e390d4afb2885b8d7c8ae10b7ef42)) - **lxc:** allow mounting existing subvol with size argument ([#2491](https://github.com/bpg/terraform-provider-proxmox/issues/2491)) ([0b9e1e0](https://github.com/bpg/terraform-provider-proxmox/commit/0b9e1e08999f044a1613107c3f8eadef60512267)) - **ssh:** harden try\_sudo for PVE 9, improve shell compatibility ([#2480](https://github.com/bpg/terraform-provider-proxmox/issues/2480)) ([f3dd703](https://github.com/bpg/terraform-provider-proxmox/commit/f3dd703f398697f88db5ea369a2b9355d25fdf1a)) - **vm:** prevent initialization drift when cloning VM with user\_account ([#2486](https://github.com/bpg/terraform-provider-proxmox/issues/2486)) ([dbd4fd5](https://github.com/bpg/terraform-provider-proxmox/commit/dbd4fd50526393ae3f1d9dd50ea7ba4439bb6c31)) - **vm:** resizing disk deletes cdrom / cloud-init ([#2484](https://github.com/bpg/terraform-provider-proxmox/issues/2484)) ([ae17149](https://github.com/bpg/terraform-provider-proxmox/commit/ae171496250f17c67436f22aaeccdf975f205c4c)) ##### Miscellaneous - **docs:** minor docs fixes and improvements ([#2481](https://github.com/bpg/terraform-provider-proxmox/issues/2481)) ([b52af8d](https://github.com/bpg/terraform-provider-proxmox/commit/b52af8d7948ebbf3d268699f17fc0d7fcc62eafe)) ### [`v0.92.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0920-2026-01-10) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.91.0...v0.92.0) ##### ⚠ BREAKING CHANGES - The `proxmox_virtual_environment_download_file` resource now checks the upstream URL's Content-Length during every refresh with `overwrite=true` (default). This restores the original behavior from v0.33.0 that was accidentally removed in v0.78.2. Users who want to disable upstream checking should set `overwrite=false`. - The `proxmox_virtual_environment_firewall_options` resource now requires exactly one of `vm_id` or `container_id` to be specified. Previously, configurations with only `node_name` would pass validation but fail at runtime. This change enforces the requirement at validation time. ##### Features - **access:** add LDAP realm and sync resources ([#2454](https://github.com/bpg/terraform-provider-proxmox/issues/2454)) ([085b73b](https://github.com/bpg/terraform-provider-proxmox/commit/085b73b91d5049be878a83dce67059a7bb4ba9c7)), closes [#1871](https://github.com/bpg/terraform-provider-proxmox/issues/1871) - **docs:** add universal LLM Agent instructions and contribution guidelines ([#2473](https://github.com/bpg/terraform-provider-proxmox/issues/2473)) ([16abacc](https://github.com/bpg/terraform-provider-proxmox/commit/16abacc4da7c1075b0bd4f8fb7dbb044ee6bfa01)) ##### Bug Fixes - **api:** detect TFA requirement and return clear error message ([#2477](https://github.com/bpg/terraform-provider-proxmox/issues/2477)) ([876849d](https://github.com/bpg/terraform-provider-proxmox/commit/876849dda5e8340a09028cc9a15dc2880f6c2a41)) - **docs:** clarify documentation workflow for FWK resources ([#2475](https://github.com/bpg/terraform-provider-proxmox/issues/2475)) ([7bd295a](https://github.com/bpg/terraform-provider-proxmox/commit/7bd295ab26022621216085eb63295f876722bcd5)) - **docs:** fix broken links in docs ([#2464](https://github.com/bpg/terraform-provider-proxmox/issues/2464)) ([cdeddf8](https://github.com/bpg/terraform-provider-proxmox/commit/cdeddf86c63231dbc31c5c177f5b2c1430f21326)) - **docs:** update reference to setting up proxmox ([#2455](https://github.com/bpg/terraform-provider-proxmox/issues/2455)) ([3c11ffd](https://github.com/bpg/terraform-provider-proxmox/commit/3c11ffdbb64981eb1330c197530b6f3a13858381)) - **file:** restore upstream URL change detection in `download_file` ([#2474](https://github.com/bpg/terraform-provider-proxmox/issues/2474)) ([ad181ee](https://github.com/bpg/terraform-provider-proxmox/commit/ad181ee835eeecc496fce529ac0f89e09501a277)), closes [#2470](https://github.com/bpg/terraform-provider-proxmox/issues/2470) - **firewall:** make `vm_id`/`container_id` required in VM/Container -level firewall options ([#2453](https://github.com/bpg/terraform-provider-proxmox/issues/2453)) ([5ded5d4](https://github.com/bpg/terraform-provider-proxmox/commit/5ded5d48a16eb001994e1a3c735428a1530e45c8)) - **storage:** prevent "was absent, but now present" error for backups block ([#2465](https://github.com/bpg/terraform-provider-proxmox/issues/2465)) ([501c09b](https://github.com/bpg/terraform-provider-proxmox/commit/501c09b58678c3a51d89285f2af3e4f3fd8b9f20)) - **vm:** allow vcpus hotplug without reboot ([#2466](https://github.com/bpg/terraform-provider-proxmox/issues/2466)) ([f864d36](https://github.com/bpg/terraform-provider-proxmox/commit/f864d36a557f1883e0823e15f6b37826683c5ba2)) - **vm:** correct disk speed settings for multiple disks and update detection ([#2478](https://github.com/bpg/terraform-provider-proxmox/issues/2478)) ([0889c74](https://github.com/bpg/terraform-provider-proxmox/commit/0889c74019c7711616e586a38bcc0e5a98f3d496)) ##### Miscellaneous - **deps:** update golangci/golangci-lint (v2.7.2 → v2.8.0) ([#2472](https://github.com/bpg/terraform-provider-proxmox/issues/2472)) ([5009161](https://github.com/bpg/terraform-provider-proxmox/commit/5009161379f9cb5ef1fa156a22ed262184c1b45b)) - **deps:** Update module github.com/avast/retry-go/v4 (v4.7.0 → v5.0.0) ([#2452](https://github.com/bpg/terraform-provider-proxmox/issues/2452)) ([1f664be](https://github.com/bpg/terraform-provider-proxmox/commit/1f664bed9fc5c15099983728bc5d3068aab0d03a)) - **docs:** remove outdated Ceph handles from `apt_standard_repository` docs ([#2471](https://github.com/bpg/terraform-provider-proxmox/issues/2471)) ([ccbaabd](https://github.com/bpg/terraform-provider-proxmox/commit/ccbaabd28d67596e047478f6518501b645c41fce)), closes [#2421](https://github.com/bpg/terraform-provider-proxmox/issues/2421) - **docs:** update terraform proxmox (0.90.0 → 0.91.0) ([#2459](https://github.com/bpg/terraform-provider-proxmox/issues/2459)) ([d175ef0](https://github.com/bpg/terraform-provider-proxmox/commit/d175ef0dccb529983e1eccf156aabaf38d828445)) ### [`v0.91.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0910-2026-01-03) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.90.0...v0.91.0) ##### Features - **acme:** add support for certificate ordering ([#2292](https://github.com/bpg/terraform-provider-proxmox/issues/2292)) ([a2a970d](https://github.com/bpg/terraform-provider-proxmox/commit/a2a970d06836c7740e1b6b040ebb8cfc622714c6)) - **sdn:** add support for Fabric resources ([#2444](https://github.com/bpg/terraform-provider-proxmox/issues/2444)) ([b223dad](https://github.com/bpg/terraform-provider-proxmox/commit/b223dad82886db6738f1d2a6845720267c1742d4)) - **storage:** add support for provisioning storage types (NFS/CIFS/PBS/Directory/LVM) ([#2130](https://github.com/bpg/terraform-provider-proxmox/issues/2130)) ([f361704](https://github.com/bpg/terraform-provider-proxmox/commit/f361704ccaa7d794d83c6803e120c29f0178640c)) ##### Bug Fixes - **core:** handle scientific notation in CustomInt/CustomInt64 unmarshaling ([#2431](https://github.com/bpg/terraform-provider-proxmox/issues/2431)) ([4baff92](https://github.com/bpg/terraform-provider-proxmox/commit/4baff92038235f7e4e7830a7a9b239c0a1eadf45)) - **vm:** allow TPM state updates in place ([#2446](https://github.com/bpg/terraform-provider-proxmox/issues/2446)) ([f8717c4](https://github.com/bpg/terraform-provider-proxmox/commit/f8717c41a14af6ea1d0dc31cc62f14649fae7653)) ##### Miscellaneous - **code:** cleanup issues reported by static code alalysis ([#2442](https://github.com/bpg/terraform-provider-proxmox/issues/2442)) ([686e575](https://github.com/bpg/terraform-provider-proxmox/commit/686e575fac3ac220cd8e397fa2e41770cf7b2ca3)) - **code:** cleanups and linter rules adjustment ([#2443](https://github.com/bpg/terraform-provider-proxmox/issues/2443)) ([1eee491](https://github.com/bpg/terraform-provider-proxmox/commit/1eee491ebb96f7c27dca9c962157b9af58ea9af3)) - **deps:** update image golang ([`36b4f45`](https://github.com/bpg/terraform-provider-proxmox/commit/36b4f45) → [`b6ba523`](https://github.com/bpg/terraform-provider-proxmox/commit/b6ba523)) ([#2439](https://github.com/bpg/terraform-provider-proxmox/issues/2439)) ([f82f03c](https://github.com/bpg/terraform-provider-proxmox/commit/f82f03c85fa039b705e80eeb6f2fb78859fbab24)) - **deps:** update image golang ([`b6ba523`](https://github.com/bpg/terraform-provider-proxmox/commit/b6ba523) → [`6cc2338`](https://github.com/bpg/terraform-provider-proxmox/commit/6cc2338)) ([#2448](https://github.com/bpg/terraform-provider-proxmox/issues/2448)) ([2b22bde](https://github.com/bpg/terraform-provider-proxmox/commit/2b22bde2cfb804818d2fedd31dded719614859ce)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.12.1 → v7.14.0) ([#2438](https://github.com/bpg/terraform-provider-proxmox/issues/2438)) ([4bdd335](https://github.com/bpg/terraform-provider-proxmox/commit/4bdd335fc66e38069806b9fa03d723c8cb6a307e)) - **deps:** update module github.com/google/go-querystring (v1.1.0 → v1.2.0) ([#2440](https://github.com/bpg/terraform-provider-proxmox/issues/2440)) ([ad6b9b2](https://github.com/bpg/terraform-provider-proxmox/commit/ad6b9b26f0ce37019b54649ba469d983921b67e8)) - **docs:** add guide for creating VMs from compressed cloud images ([#2449](https://github.com/bpg/terraform-provider-proxmox/issues/2449)) ([daa339b](https://github.com/bpg/terraform-provider-proxmox/commit/daa339b063c7ba3614347bc4877ffe2a3e592cd6)) - **docs:** update contributing guidelines and dev setup guides ([#2447](https://github.com/bpg/terraform-provider-proxmox/issues/2447)) ([371e0a1](https://github.com/bpg/terraform-provider-proxmox/commit/371e0a17b63ed1c16a094df220d69718d6695dcf)) - **docs:** update terraform proxmox (0.89.1 → 0.90.0) ([#2435](https://github.com/bpg/terraform-provider-proxmox/issues/2435)) ([975f818](https://github.com/bpg/terraform-provider-proxmox/commit/975f8186e20ad7d296f52a484b7b4dc7ec895f4d)) ### [`v0.90.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0900-2025-12-24) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.89.1...v0.90.0) ##### Features - **cloned\_vm:** add cloned VM resource implementation ([#2424](https://github.com/bpg/terraform-provider-proxmox/issues/2424)) ([88cad5c](https://github.com/bpg/terraform-provider-proxmox/commit/88cad5c006c9d9521ce625b5316373100c1ef60c)) - **provider:** add ContentType in ListDatastoreFiles ([#2423](https://github.com/bpg/terraform-provider-proxmox/issues/2423)) ([773b174](https://github.com/bpg/terraform-provider-proxmox/commit/773b174ce06f482280474211b60e71095b831274)) ##### Miscellaneous - **ci:** Update actions/upload-artifact action (v5 → v6) ([#2419](https://github.com/bpg/terraform-provider-proxmox/issues/2419)) ([3021c54](https://github.com/bpg/terraform-provider-proxmox/commit/3021c540d9fb027a3ebbe97f0b6e17b187d16b9f)) - **ci:** update jetbrains/qodana-action action (v2025.2.3 → v2025.2.4) ([#2426](https://github.com/bpg/terraform-provider-proxmox/issues/2426)) ([5b2e9ea](https://github.com/bpg/terraform-provider-proxmox/commit/5b2e9ea503b2171568743ff3de6cb8e048c5f2dc)) - **ci:** update jetbrains/qodana-action action (v2025.2.4 → v2025.3.1) ([#2434](https://github.com/bpg/terraform-provider-proxmox/issues/2434)) ([db3c5bf](https://github.com/bpg/terraform-provider-proxmox/commit/db3c5bf76878ef95c5030307249325256f9c1b5d)) - **deps:** update image golang ([`20b91ed`](https://github.com/bpg/terraform-provider-proxmox/commit/20b91ed) → [`a22b2e6`](https://github.com/bpg/terraform-provider-proxmox/commit/a22b2e6)) ([#2418](https://github.com/bpg/terraform-provider-proxmox/issues/2418)) ([fa883ec](https://github.com/bpg/terraform-provider-proxmox/commit/fa883ec42276d5cdd36f1e1604f61b14b7d4cc3a)) - **deps:** update image golang ([`a22b2e6`](https://github.com/bpg/terraform-provider-proxmox/commit/a22b2e6) → [`36b4f45`](https://github.com/bpg/terraform-provider-proxmox/commit/36b4f45)) ([#2425](https://github.com/bpg/terraform-provider-proxmox/issues/2425)) ([11fccbe](https://github.com/bpg/terraform-provider-proxmox/commit/11fccbe62eface03b21b16e6deb60efbfc1119ce)) - docs and dev UX improvements ([#2427](https://github.com/bpg/terraform-provider-proxmox/issues/2427)) ([a034e8b](https://github.com/bpg/terraform-provider-proxmox/commit/a034e8b6561b480d7884bf7c90d667f90e06ba32)) ### [`v0.89.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0891-2025-12-09) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.89.0...v0.89.1) ##### Bug Fixes - **vm,lxc:** revert deprecation notice for `pool_id` attribute ([#2405](https://github.com/bpg/terraform-provider-proxmox/issues/2405)) ([af3efa9](https://github.com/bpg/terraform-provider-proxmox/commit/af3efa9b41bfb16463e441aec25a08e86952c8d0)) - **vm:** allow EFI disk parameter updates without VM recreation ([51b8d39](https://github.com/bpg/terraform-provider-proxmox/commit/51b8d39b39821b0692a6c5bb880173463af50e3d)), closes [#1515](https://github.com/bpg/terraform-provider-proxmox/issues/1515) - **vm:** handle disk size mismatch when re-adding removed disk ([#2411](https://github.com/bpg/terraform-provider-proxmox/issues/2411)) ([d7346d4](https://github.com/bpg/terraform-provider-proxmox/commit/d7346d434c88a1262978d3b8137f978406cc41c8)) - **vm:** match CPU type format with PVE ([#2409](https://github.com/bpg/terraform-provider-proxmox/issues/2409)) ([63f22db](https://github.com/bpg/terraform-provider-proxmox/commit/63f22db63782af230cbf7101ecc64af86fb30568)) - **vm:** prevent perpetual diff when using `pool_membership` without `pool_id` ([#2408](https://github.com/bpg/terraform-provider-proxmox/issues/2408)) ([acc95bf](https://github.com/bpg/terraform-provider-proxmox/commit/acc95bf372d270c38e76f47c0f6eb8cacfb97a7b)) - **vm:** prevent unnecessary reboots on hotplug operations ([#2412](https://github.com/bpg/terraform-provider-proxmox/issues/2412)) ([77dc49e](https://github.com/bpg/terraform-provider-proxmox/commit/77dc49ea7cc70b7a43a7fb0cea2a0987338f7297)), closes [#538](https://github.com/bpg/terraform-provider-proxmox/issues/538) - **vm:** retry disk resize on 'does not exist' errors ([#2407](https://github.com/bpg/terraform-provider-proxmox/issues/2407)) ([f5f5437](https://github.com/bpg/terraform-provider-proxmox/commit/f5f5437c9f118690eded006cd3897dc5cce8d75e)) - **vm:** retry HTTP 500 errors when waiting for agent retrieving IPs ([#2410](https://github.com/bpg/terraform-provider-proxmox/issues/2410)) ([c324ef0](https://github.com/bpg/terraform-provider-proxmox/commit/c324ef090127dd934ace863fc2ca5d148430275a)) ##### Miscellaneous - **ci:** update jetbrains/qodana-action action (v2025.2.2 → v2025.2.3) ([#2400](https://github.com/bpg/terraform-provider-proxmox/issues/2400)) ([893fd6d](https://github.com/bpg/terraform-provider-proxmox/commit/893fd6d61fce1d8fd1ebb1468180fe0fb9d09292)) - **deps:** update golangci/golangci-lint (v2.7.1 → v2.7.2) ([#2413](https://github.com/bpg/terraform-provider-proxmox/issues/2413)) ([99e30e1](https://github.com/bpg/terraform-provider-proxmox/commit/99e30e1d1eb9579a03f85e85b1bb2ce709f1a82f)) - **deps:** update module golang.org/x/crypto (v0.45.0 → v0.46.0) ([#2414](https://github.com/bpg/terraform-provider-proxmox/issues/2414)) ([67ac0b1](https://github.com/bpg/terraform-provider-proxmox/commit/67ac0b1b088583f703c6008318a77e26c29544cf)) - **deps:** update module golang.org/x/net (v0.47.0 → v0.48.0) ([#2415](https://github.com/bpg/terraform-provider-proxmox/issues/2415)) ([b0aabfd](https://github.com/bpg/terraform-provider-proxmox/commit/b0aabfda4eed6d3e7d61268b4769a1ba33985d58)) ### [`v0.89.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0890-2025-12-06) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.88.0...v0.89.0) ##### ⚠ BREAKING CHANGES - **vm:** revert cpu.units default to use PVE server default ([#2402](https://github.com/bpg/terraform-provider-proxmox/issues/2402)) ##### Features - **lxc:** add `env` parameter support ([#2383](https://github.com/bpg/terraform-provider-proxmox/issues/2383)) ([ef134fc](https://github.com/bpg/terraform-provider-proxmox/commit/ef134fc7c589cdbf3fa449a13a23355894e4e4a5)) - **oci:** add proxmox\_virtual\_environment\_oci\_image resource for OCI Images Management ([#2373](https://github.com/bpg/terraform-provider-proxmox/issues/2373)) ([86a5bf1](https://github.com/bpg/terraform-provider-proxmox/commit/86a5bf1f35c8b1ca20c285d91421daf815cfe430)) - **sdn:** add possibility to apply SDN changes on a particular actions ([#2386](https://github.com/bpg/terraform-provider-proxmox/issues/2386)) ([01e6433](https://github.com/bpg/terraform-provider-proxmox/commit/01e64339b63f2b33281b98e67072a325afe0ade8)) ##### Bug Fixes - **vm:** do not re-import existing disks during update ([#2401](https://github.com/bpg/terraform-provider-proxmox/issues/2401)) ([0c7fad9](https://github.com/bpg/terraform-provider-proxmox/commit/0c7fad95a2b77c343a245d714f297fd6f0cab24c)) - **vm:** revert cpu.units default to use PVE server default ([#2402](https://github.com/bpg/terraform-provider-proxmox/issues/2402)) ([c9b8a3f](https://github.com/bpg/terraform-provider-proxmox/commit/c9b8a3f3b73aac6dfaa797baf0f5c66fb529e8dc)) ##### Miscellaneous - **ci:** pin dependencies ([#2388](https://github.com/bpg/terraform-provider-proxmox/issues/2388)) ([84bf77d](https://github.com/bpg/terraform-provider-proxmox/commit/84bf77dd350cbd5ca69a954454587fd63e1c8b8d)) - **ci:** update actions/checkout action (v6.0.0 → v6.0.1) ([#2398](https://github.com/bpg/terraform-provider-proxmox/issues/2398)) ([5eb8020](https://github.com/bpg/terraform-provider-proxmox/commit/5eb8020b9e789fc695c18705b9a9e408b87c37f7)) - **ci:** update actions/checkout digest ([`1af3b93`](https://github.com/bpg/terraform-provider-proxmox/commit/1af3b93) → [`8e8c483`](https://github.com/bpg/terraform-provider-proxmox/commit/8e8c483)) ([#2396](https://github.com/bpg/terraform-provider-proxmox/issues/2396)) ([a9926ca](https://github.com/bpg/terraform-provider-proxmox/commit/a9926ca8a6f33b59fc066eca395dee39ca2fb165)) - **ci:** update actions/create-github-app-token action (v2.2.0 → v2.2.1) ([#2399](https://github.com/bpg/terraform-provider-proxmox/issues/2399)) ([2f6c1b4](https://github.com/bpg/terraform-provider-proxmox/commit/2f6c1b4d1179dfc4dd7da71592f2e6b42d80d475)) - **ci:** Update actions/github-script action (v7 → v8) ([#2394](https://github.com/bpg/terraform-provider-proxmox/issues/2394)) ([aaef00e](https://github.com/bpg/terraform-provider-proxmox/commit/aaef00efd2301013b42928412ddda149832c9237)) - **ci:** update actions/stale digest ([`5f858e3`](https://github.com/bpg/terraform-provider-proxmox/commit/5f858e3) → [`9971854`](https://github.com/bpg/terraform-provider-proxmox/commit/9971854)) ([#2397](https://github.com/bpg/terraform-provider-proxmox/issues/2397)) ([cd63393](https://github.com/bpg/terraform-provider-proxmox/commit/cd63393fabebc056ad5c6ff095ac13211b42b85f)) - **ci:** update golangci/golangci-lint-action digest ([`e7fa5ac`](https://github.com/bpg/terraform-provider-proxmox/commit/e7fa5ac) → [`1e7e51e`](https://github.com/bpg/terraform-provider-proxmox/commit/1e7e51e)) ([#2389](https://github.com/bpg/terraform-provider-proxmox/issues/2389)) ([6593102](https://github.com/bpg/terraform-provider-proxmox/commit/6593102295b5c98c85e7eedaf1946ebbfeeb1ab8)) - **deps:** update github.com/hashicorp/terraform-plugin-\* ([#2392](https://github.com/bpg/terraform-provider-proxmox/issues/2392)) ([459cdfc](https://github.com/bpg/terraform-provider-proxmox/commit/459cdfc60641d84f5ec99f00e22be11395ee548b)) - **deps:** update golangci/golangci-lint (v2.6.2 → v2.7.1) ([#2393](https://github.com/bpg/terraform-provider-proxmox/issues/2393)) ([4b5652f](https://github.com/bpg/terraform-provider-proxmox/commit/4b5652fbf957a37fa42bfdda683da0532c90d395)) - **deps:** update image golang (1.25.4 → 1.25.5) ([#2390](https://github.com/bpg/terraform-provider-proxmox/issues/2390)) ([54e6aa5](https://github.com/bpg/terraform-provider-proxmox/commit/54e6aa514d0aa2729b96f5ea1d2b853816e384bb)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.12.0 → v7.12.1) ([#2391](https://github.com/bpg/terraform-provider-proxmox/issues/2391)) ([5952ae7](https://github.com/bpg/terraform-provider-proxmox/commit/5952ae7d9e79a4260eb3833c5dbe08464e6a53ea)) ### [`v0.88.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0880-2025-12-01) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.87.0...v0.88.0) ##### Features - **provider:** add OTel implementation for `metrics` resource ([#2372](https://github.com/bpg/terraform-provider-proxmox/issues/2372)) ([d37a8bb](https://github.com/bpg/terraform-provider-proxmox/commit/d37a8bbb5699c2947506300d594621c4fb699701)) - **vm,lxc:** add `wait_for_ip` configuration for agent/network interfaces ([#2362](https://github.com/bpg/terraform-provider-proxmox/issues/2362)) ([f24add3](https://github.com/bpg/terraform-provider-proxmox/commit/f24add360a7d6ac37d9b23cc9229d533100b6d2c)) - **vm:** support custom cloud init drive file format ([#2375](https://github.com/bpg/terraform-provider-proxmox/issues/2375)) ([ddccd0a](https://github.com/bpg/terraform-provider-proxmox/commit/ddccd0af6fdc086e1d65f7be28bed85b4df2ef57)) ##### Bug Fixes - **apt:** add support for modern APT sources (PVE9+) ([#2376](https://github.com/bpg/terraform-provider-proxmox/issues/2376)) ([6f6edec](https://github.com/bpg/terraform-provider-proxmox/commit/6f6edec253ac73e3a8c132debd3315e25079fd93)) - **disk:** restore updating boot disk. ([#2150](https://github.com/bpg/terraform-provider-proxmox/issues/2150)) ([0da0bcb](https://github.com/bpg/terraform-provider-proxmox/commit/0da0bcb0dc62cc74c944f082c731167ee74ae8b8)) - **example:** comment out otel metrics server resource ([fc94e2a](https://github.com/bpg/terraform-provider-proxmox/commit/fc94e2a601a1570c6de582e22e5b96cb05a4f34f)) - **lxc:** allow container creation/update with correct mountoptions ([#2319](https://github.com/bpg/terraform-provider-proxmox/issues/2319)) ([c2dc3a7](https://github.com/bpg/terraform-provider-proxmox/commit/c2dc3a75385d11eaf9740d4d871c4c6eabcaaab8)) - **lxc:** ignore link-local addresses when waiting for network IPs ([#2357](https://github.com/bpg/terraform-provider-proxmox/issues/2357)) ([8c081f5](https://github.com/bpg/terraform-provider-proxmox/commit/8c081f542f2ecdf1bf3874e2e8696138d705ece4)) - **vm:** convert to template using proper endpoint ([#2340](https://github.com/bpg/terraform-provider-proxmox/issues/2340)) ([5615298](https://github.com/bpg/terraform-provider-proxmox/commit/561529885f2f3651df29122f694fcb983b1a8adf)) - **vm:** prevent state changes after VM import ([#2294](https://github.com/bpg/terraform-provider-proxmox/issues/2294)) ([f0bb501](https://github.com/bpg/terraform-provider-proxmox/commit/f0bb5016dd50036be53d9b67ee2e93c76bdadfba)) ##### Miscellaneous - **ci:** Update actions/checkout action ([#2361](https://github.com/bpg/terraform-provider-proxmox/issues/2361)) ([f5d4676](https://github.com/bpg/terraform-provider-proxmox/commit/f5d467660cdecd04e171fd6242b6049f622e6837)) - **ci:** update actions/create-github-app-token action (v2.1.4 → v2.2.0) ([#2366](https://github.com/bpg/terraform-provider-proxmox/issues/2366)) ([3055dc2](https://github.com/bpg/terraform-provider-proxmox/commit/3055dc28479983f2ce17fa9dca35b26d361f4b3d)) - **ci:** update actions/setup-go digest ([`4469467`](https://github.com/bpg/terraform-provider-proxmox/commit/4469467) → [`4dc6199`](https://github.com/bpg/terraform-provider-proxmox/commit/4dc6199)) ([#2365](https://github.com/bpg/terraform-provider-proxmox/issues/2365)) ([bcce7da](https://github.com/bpg/terraform-provider-proxmox/commit/bcce7da9973843c21b0c56e3a698440cd83c0977)) - **ci:** update golangci/golangci-lint-action digest ([`0a35821`](https://github.com/bpg/terraform-provider-proxmox/commit/0a35821) → [`e7fa5ac`](https://github.com/bpg/terraform-provider-proxmox/commit/e7fa5ac)) ([#2358](https://github.com/bpg/terraform-provider-proxmox/issues/2358)) ([dd416a1](https://github.com/bpg/terraform-provider-proxmox/commit/dd416a1a9739b53e1d7a5b3f1660a4af87704ded)) - **ci:** update jetbrains/qodana-action action (v2025.2.1 → v2025.2.2) ([#2360](https://github.com/bpg/terraform-provider-proxmox/issues/2360)) ([092df22](https://github.com/bpg/terraform-provider-proxmox/commit/092df2280132a7d5acfb636107efe4edb68a3d77)) - **deps:** update golangci/golangci-lint (v2.5.0 → v2.6.2) ([#2304](https://github.com/bpg/terraform-provider-proxmox/issues/2304)) ([0937f2b](https://github.com/bpg/terraform-provider-proxmox/commit/0937f2b5d421d8830b07dfb03285b6e11c5d51e4)) - **deps:** update image golang ([`e68f6a0`](https://github.com/bpg/terraform-provider-proxmox/commit/e68f6a0) → [`f60eaa8`](https://github.com/bpg/terraform-provider-proxmox/commit/f60eaa8)) ([#2359](https://github.com/bpg/terraform-provider-proxmox/issues/2359)) ([b80a193](https://github.com/bpg/terraform-provider-proxmox/commit/b80a1937a70461c6c78de199650b20a2245ce58e)) - **deps:** update image golang ([`f60eaa8`](https://github.com/bpg/terraform-provider-proxmox/commit/f60eaa8) → [`6981837`](https://github.com/bpg/terraform-provider-proxmox/commit/6981837)) ([#2370](https://github.com/bpg/terraform-provider-proxmox/issues/2370)) ([faf56bc](https://github.com/bpg/terraform-provider-proxmox/commit/faf56bce9a5dd09b9ad85351844542e026695816)) - **deps:** Update module github.com/avast/retry-go/v4 (v4.7.0 → v5.0.0) ([#2380](https://github.com/bpg/terraform-provider-proxmox/issues/2380)) ([630240d](https://github.com/bpg/terraform-provider-proxmox/commit/630240d31115bed69e002c61ee4993504663d4b3)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.10.0 → v7.11.0) ([#2379](https://github.com/bpg/terraform-provider-proxmox/issues/2379)) ([5e55d92](https://github.com/bpg/terraform-provider-proxmox/commit/5e55d9272f7bc2f545efd1a4c0f26ad522db8699)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.11.0 → v7.12.0) ([#2384](https://github.com/bpg/terraform-provider-proxmox/issues/2384)) ([2f7bbb1](https://github.com/bpg/terraform-provider-proxmox/commit/2f7bbb11befca972a858ff562d190c1a73d4c75c)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.9.0 → v7.10.0) ([#2371](https://github.com/bpg/terraform-provider-proxmox/issues/2371)) ([d3b4847](https://github.com/bpg/terraform-provider-proxmox/commit/d3b48474b4a2684f0f8678eaa5afb8ba1d2d358e)) - **deps:** update module github.com/hashicorp/go-version (v1.7.0 → v1.8.0) ([#2381](https://github.com/bpg/terraform-provider-proxmox/issues/2381)) ([ad38c5b](https://github.com/bpg/terraform-provider-proxmox/commit/ad38c5befc279c8312c689a8d7c80336a875573f)) - **deps:** update module golang.org/x/crypto (v0.44.0 → v0.45.0) \[security] ([#2348](https://github.com/bpg/terraform-provider-proxmox/issues/2348)) ([78ce72e](https://github.com/bpg/terraform-provider-proxmox/commit/78ce72edc85320c33ed06d719dbc9b27c0ba931d)) - **docs:** update terraform local (2.5.3 → 2.6.1) ([#2367](https://github.com/bpg/terraform-provider-proxmox/issues/2367)) ([d5b3c64](https://github.com/bpg/terraform-provider-proxmox/commit/d5b3c64693dd13d72294c356d3d663852fbe79c9)) - update docs to pve 9.1, fix example tests ([#2350](https://github.com/bpg/terraform-provider-proxmox/issues/2350)) ([6e2a5aa](https://github.com/bpg/terraform-provider-proxmox/commit/6e2a5aa5c806e1f46373f8ff73e59ec221ae8bdd)) - **vm:** refactor network devices update logic ([#2260](https://github.com/bpg/terraform-provider-proxmox/issues/2260)) ([db3d7ec](https://github.com/bpg/terraform-provider-proxmox/commit/db3d7ec9d9a57f72ada7ed88604b609d223b0e98)) ### [`v0.87.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0870-2025-11-20) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.86.0...v0.87.0) ##### Features - **pool:** add `pool_membership` resource ([#2297](https://github.com/bpg/terraform-provider-proxmox/issues/2297)) ([95f180b](https://github.com/bpg/terraform-provider-proxmox/commit/95f180b497f7c82fef4fed565fd79fe5c244292a)) - **sdn:** add support for VNets datasource ([#2299](https://github.com/bpg/terraform-provider-proxmox/issues/2299)) ([c25f19a](https://github.com/bpg/terraform-provider-proxmox/commit/c25f19aa43a7748939dbe35a750cbcee485634a8)) - **vm:** add `purge_on_destroy` and `delete_unreferenced_disks_on_destroy` parameters ([#2345](https://github.com/bpg/terraform-provider-proxmox/issues/2345)) ([05a59aa](https://github.com/bpg/terraform-provider-proxmox/commit/05a59aa507c5c3f1b91adb2c3240a5790313f730)) ##### Bug Fixes - **access:** imported `group` resource missing `group_id` ([#2333](https://github.com/bpg/terraform-provider-proxmox/issues/2333)) ([ee1c525](https://github.com/bpg/terraform-provider-proxmox/commit/ee1c5255259fb81103e3bb3c531ddb421bc384c9)) - **apt:** add missing Ceph Squid ([#2318](https://github.com/bpg/terraform-provider-proxmox/issues/2318)) ([8b9bf62](https://github.com/bpg/terraform-provider-proxmox/commit/8b9bf6240f0f75353d440f367c4b3016f126384c)) - **file:** better error message for unsupported `import` content type ([#2344](https://github.com/bpg/terraform-provider-proxmox/issues/2344)) ([f94e25d](https://github.com/bpg/terraform-provider-proxmox/commit/f94e25de03b3468ccff87cdeb591e13fcc88741e)) - **firewall:** appending a rule without re-creating the whole ruleset ([#2310](https://github.com/bpg/terraform-provider-proxmox/issues/2310)) ([6290cce](https://github.com/bpg/terraform-provider-proxmox/commit/6290ccebc48aa4f5f109762afe3017df95e79b34)) - **lxc:** panic when cloning a container with empty IP config ([#2347](https://github.com/bpg/terraform-provider-proxmox/issues/2347)) ([0a259ca](https://github.com/bpg/terraform-provider-proxmox/commit/0a259ca43a3e0f3404bbf6938bbcf3b6da723a9b)) - **lxc:** race condition in container clone / reboot operations ([#2320](https://github.com/bpg/terraform-provider-proxmox/issues/2320)) ([ce358d5](https://github.com/bpg/terraform-provider-proxmox/commit/ce358d5c782525435b0a6dd66e144511afb6be4a)) - **sdn:** fix subnet datasource IP address datatype ([#2300](https://github.com/bpg/terraform-provider-proxmox/issues/2300)) ([7ffb314](https://github.com/bpg/terraform-provider-proxmox/commit/7ffb31447599630b698101f0aacb58ead54768ed)) - **ssh:** update sudo check logic and cache check results ([#2309](https://github.com/bpg/terraform-provider-proxmox/issues/2309)) ([702500c](https://github.com/bpg/terraform-provider-proxmox/commit/702500cb3be6c0fa53f5c4f8bf105866fc52a1b3)) - **vm:** increase max disk limit to 31 ([#2302](https://github.com/bpg/terraform-provider-proxmox/issues/2302)) ([2ae021a](https://github.com/bpg/terraform-provider-proxmox/commit/2ae021a0c3818b42660591fbe64bdc2560e829a8)) ##### Miscellaneous - **ci:** Update golangci/golangci-lint-action action (v8 → v9) ([#2330](https://github.com/bpg/terraform-provider-proxmox/issues/2330)) ([90810fa](https://github.com/bpg/terraform-provider-proxmox/commit/90810fafacc1de3de8f699836397c3f193aae3a3)) - **ci:** update lycheeverse/lychee-action action (v2.6.1 → v2.7.0) ([#2305](https://github.com/bpg/terraform-provider-proxmox/issues/2305)) ([9a788da](https://github.com/bpg/terraform-provider-proxmox/commit/9a788da00679215aeb74e61e8ca60d48b2892933)) - **deps:** update image golang (1.25.3 → 1.25.4) ([#2328](https://github.com/bpg/terraform-provider-proxmox/issues/2328)) ([90f876f](https://github.com/bpg/terraform-provider-proxmox/commit/90f876f1965dcee836239e03e6e0f43f4876001e)) - **deps:** update image golang ([`6ca9eb0`](https://github.com/bpg/terraform-provider-proxmox/commit/6ca9eb0) → [`e68f6a0`](https://github.com/bpg/terraform-provider-proxmox/commit/e68f6a0)) ([#2335](https://github.com/bpg/terraform-provider-proxmox/issues/2335)) ([5354d6b](https://github.com/bpg/terraform-provider-proxmox/commit/5354d6bd9a69b10105ea66e5edee68e44daadad6)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.8.1 → v7.8.2) ([#2303](https://github.com/bpg/terraform-provider-proxmox/issues/2303)) ([cd9b5fb](https://github.com/bpg/terraform-provider-proxmox/commit/cd9b5fbbb3c98b5e9fb19bfc94db0c13bff222b0)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.8.2 → v7.9.0) ([#2329](https://github.com/bpg/terraform-provider-proxmox/issues/2329)) ([76680dd](https://github.com/bpg/terraform-provider-proxmox/commit/76680dd729875a87d7c7511257ecf5bd28811935)) - **deps:** update module github.com/hashicorp/terraform-plugin-log (v0.9.0 → v0.10.0) ([#2336](https://github.com/bpg/terraform-provider-proxmox/issues/2336)) ([6dd51fd](https://github.com/bpg/terraform-provider-proxmox/commit/6dd51fddc61b8461f721257dae43a1b6ac312ae6)) - **deps:** update module golang.org/x/crypto (v0.43.0 → v0.44.0) ([#2337](https://github.com/bpg/terraform-provider-proxmox/issues/2337)) ([fb3fbfc](https://github.com/bpg/terraform-provider-proxmox/commit/fb3fbfc9e76d1f8ed575f80fc84a2ff9e9b02b9d)) - **deps:** update module golang.org/x/net (v0.46.0 → v0.47.0) ([#2338](https://github.com/bpg/terraform-provider-proxmox/issues/2338)) ([9f57e9f](https://github.com/bpg/terraform-provider-proxmox/commit/9f57e9f92e72bd30601ba2885fe0b23be85b2889)) - **docs:** document auto option for enabling SLAAC in IPv6 config in vm and lxc ([#2317](https://github.com/bpg/terraform-provider-proxmox/issues/2317)) ([e8c70d7](https://github.com/bpg/terraform-provider-proxmox/commit/e8c70d7267bbb6e4e4b2278860c29d1838114a3b)) - **docs:** update the main doc page for consistency ([#2326](https://github.com/bpg/terraform-provider-proxmox/issues/2326)) ([7e4f421](https://github.com/bpg/terraform-provider-proxmox/commit/7e4f421faa84c53eb60dd8b9907912fbeb2c546f)) - **lxc,vm:** add deprecation notice for pool\_id attribute ([#2312](https://github.com/bpg/terraform-provider-proxmox/issues/2312)) ([3c507cc](https://github.com/bpg/terraform-provider-proxmox/commit/3c507ccc31802e5ed5fe0c05f7c07a18153c1893)) ### [`v0.86.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0860-2025-10-28) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.85.1...v0.86.0) ##### Features - **firewall:** ability to import firewall rules & options ([#2269](https://github.com/bpg/terraform-provider-proxmox/issues/2269)) ([dd1afe6](https://github.com/bpg/terraform-provider-proxmox/commit/dd1afe63446bae0487cab6c9344bce74d00bd4bb)) - **firewall:** add ability to import ipsets ([#2280](https://github.com/bpg/terraform-provider-proxmox/issues/2280)) ([33c751d](https://github.com/bpg/terraform-provider-proxmox/commit/33c751d58344b29255dde02256baffbdd88f9149)) - **firewall:** support node-level firewall rules ([#2281](https://github.com/bpg/terraform-provider-proxmox/issues/2281)) ([18c675b](https://github.com/bpg/terraform-provider-proxmox/commit/18c675bf9ada5eae2bf94a00f24800fdb8a5425b)) ##### Bug Fixes - **lxc:** delete dns attributes when set to null ([#2263](https://github.com/bpg/terraform-provider-proxmox/issues/2263)) ([a32988a](https://github.com/bpg/terraform-provider-proxmox/commit/a32988a12897dbffef8bb2d5e5270baa70eaa64f)) - **vm:** correctly detect pool membership for VM ([#2264](https://github.com/bpg/terraform-provider-proxmox/issues/2264)) ([5a5c9c6](https://github.com/bpg/terraform-provider-proxmox/commit/5a5c9c6fceaa25ac6296b87e9651996cc1286982)) ##### Miscellaneous - **ci:** Update actions/upload-artifact action (v4 → v5) ([#2275](https://github.com/bpg/terraform-provider-proxmox/issues/2275)) ([ad4bbd7](https://github.com/bpg/terraform-provider-proxmox/commit/ad4bbd7bb51137c9af6dbaff9fe5d898ffa56c27)) - **ci:** update googleapis/release-please-action action (v4.3.0 → v4.4.0) ([#2273](https://github.com/bpg/terraform-provider-proxmox/issues/2273)) ([0bcba7b](https://github.com/bpg/terraform-provider-proxmox/commit/0bcba7ba09b30a7fb707ac5a4963d27f3dcde1c8)) - **deps:** update image golang ([`7d73c4c`](https://github.com/bpg/terraform-provider-proxmox/commit/7d73c4c) → [`8c945d3`](https://github.com/bpg/terraform-provider-proxmox/commit/8c945d3)) ([#2253](https://github.com/bpg/terraform-provider-proxmox/issues/2253)) ([a2bb9b6](https://github.com/bpg/terraform-provider-proxmox/commit/a2bb9b6eaca00a38f43dd44f09bf76f3a74f5a24)) - **deps:** update image golang ([`8c945d3`](https://github.com/bpg/terraform-provider-proxmox/commit/8c945d3) → [`dd08f76`](https://github.com/bpg/terraform-provider-proxmox/commit/dd08f76)) ([#2270](https://github.com/bpg/terraform-provider-proxmox/issues/2270)) ([4c1514f](https://github.com/bpg/terraform-provider-proxmox/commit/4c1514fb9eb5da7e69be5fc62acf96176402ed22)) - **deps:** update image golang ([`dd08f76`](https://github.com/bpg/terraform-provider-proxmox/commit/dd08f76) → [`6bac879`](https://github.com/bpg/terraform-provider-proxmox/commit/6bac879)) ([#2283](https://github.com/bpg/terraform-provider-proxmox/issues/2283)) ([0c9879a](https://github.com/bpg/terraform-provider-proxmox/commit/0c9879ab0267223b30ae52b738edcbf79e949814)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.8.0 → v7.8.1) ([#2271](https://github.com/bpg/terraform-provider-proxmox/issues/2271)) ([11d4c71](https://github.com/bpg/terraform-provider-proxmox/commit/11d4c7122ba12954ee108de81a037bccaf305e76)) - **deps:** update module github.com/hashicorp/terraform-plugin-framework-timeouts (v0.6.0 → v0.7.0) ([#2274](https://github.com/bpg/terraform-provider-proxmox/issues/2274)) ([b9ccb0d](https://github.com/bpg/terraform-provider-proxmox/commit/b9ccb0dd4f1124f3d358644fbe540ac4270e9b97)) - **deps:** update module github.com/pkg/sftp (v1.13.9 → v1.13.10) ([#2272](https://github.com/bpg/terraform-provider-proxmox/issues/2272)) ([fdbe313](https://github.com/bpg/terraform-provider-proxmox/commit/fdbe313e32896f9bd72df6b9ccf0d1fb811694f6)) - **docs:** update CONTRIBUTING.md ([#2278](https://github.com/bpg/terraform-provider-proxmox/issues/2278)) ([110093b](https://github.com/bpg/terraform-provider-proxmox/commit/110093b4e4407aaa2cd0729a9846fa2c4a9b6c04)) ### [`v0.85.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0851-2025-10-15) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.85.0...v0.85.1) ##### Bug Fixes - **docs:** clarify that ip in ct ip\_config must be in CIDR notation ([#2238](https://github.com/bpg/terraform-provider-proxmox/issues/2238)) ([f3b835f](https://github.com/bpg/terraform-provider-proxmox/commit/f3b835ffa1ac7c5700b6b055d9cda3780afa7b3d)) - **lxc:** DNS / hostname update is not applied ([#2245](https://github.com/bpg/terraform-provider-proxmox/issues/2245)) ([9aa1eaf](https://github.com/bpg/terraform-provider-proxmox/commit/9aa1eafaa6d50c3d1398a23562087032f0eeee0f)) - **sdn:** add missing `dhcp` field to `simple` zone datasource ([#2243](https://github.com/bpg/terraform-provider-proxmox/issues/2243)) ([b4b8d09](https://github.com/bpg/terraform-provider-proxmox/commit/b4b8d091a6c29361825d3df98e565813f59f9ad1)) - **sdn:** handle attribute delete in all SDN resources ([#2248](https://github.com/bpg/terraform-provider-proxmox/issues/2248)) ([50accca](https://github.com/bpg/terraform-provider-proxmox/commit/50accca1161100de60db4505783be21dbff1435e)) - **sdn:** zone: make `nodes` attribute optional ([#2242](https://github.com/bpg/terraform-provider-proxmox/issues/2242)) ([798623b](https://github.com/bpg/terraform-provider-proxmox/commit/798623b63b85245df7be8d6f1bd01a6aa7a7b63a)) ##### Miscellaneous - **deps:** update image golang (1.25.2 → 1.25.3) ([#2246](https://github.com/bpg/terraform-provider-proxmox/issues/2246)) ([3d2092f](https://github.com/bpg/terraform-provider-proxmox/commit/3d2092fe8ec3d078cb0973c672ca87ba582364ed)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.7.3 → v7.8.0) ([#2241](https://github.com/bpg/terraform-provider-proxmox/issues/2241)) ([ecf7920](https://github.com/bpg/terraform-provider-proxmox/commit/ecf79205ac1011e68b193de686ac6eae040fbd91)) - **deps:** update module github.com/hashicorp/terraform-plugin-docs (v0.23.0 → v0.24.0) ([#2247](https://github.com/bpg/terraform-provider-proxmox/issues/2247)) ([6e23c90](https://github.com/bpg/terraform-provider-proxmox/commit/6e23c9056f66f62167410d29040173b90bc6d755)) ### [`v0.85.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0850-2025-10-12) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.84.1...v0.85.0) ##### Features - **sdn:** Add DHCP Config for SDN Simple Zone Resource ([#2210](https://github.com/bpg/terraform-provider-proxmox/issues/2210)) ([f5d3d92](https://github.com/bpg/terraform-provider-proxmox/commit/f5d3d92cced4b1861c82c82ceb6b2bfc10264bd0)) ##### Bug Fixes - **file:** add `import` content type to file datasource ([#2221](https://github.com/bpg/terraform-provider-proxmox/issues/2221)) ([f918bed](https://github.com/bpg/terraform-provider-proxmox/commit/f918bede079db0da790865f6fea4f2c1e9c87a14)) - **vm:** allow cpu units = 1 for cgroups v2 compatibility ([#2237](https://github.com/bpg/terraform-provider-proxmox/issues/2237)) ([3fc688b](https://github.com/bpg/terraform-provider-proxmox/commit/3fc688b7f6f36df62909352eaffe572aa6968e1c)) ##### Miscellaneous - **ci:** update actions/stale digest ([`3a9db7e`](https://github.com/bpg/terraform-provider-proxmox/commit/3a9db7e) → [`5f858e3`](https://github.com/bpg/terraform-provider-proxmox/commit/5f858e3)) ([#2222](https://github.com/bpg/terraform-provider-proxmox/issues/2222)) ([b38066b](https://github.com/bpg/terraform-provider-proxmox/commit/b38066b42d71cd6d549833912b21ecbda27dbacc)) - **ci:** Update peter-evans/create-issue-from-file action (v5.0.1 → v6.0.0) ([#2217](https://github.com/bpg/terraform-provider-proxmox/issues/2217)) ([29748a5](https://github.com/bpg/terraform-provider-proxmox/commit/29748a5afe49938349a8efd819a7e1ca5f178024)) - **deps:** update image golang (1.25.1 → 1.25.2) ([#2228](https://github.com/bpg/terraform-provider-proxmox/issues/2228)) ([9e77057](https://github.com/bpg/terraform-provider-proxmox/commit/9e7705705a8013f5d11016ff1dd2b078518e29da)) - **deps:** update image golang ([`8305f5f`](https://github.com/bpg/terraform-provider-proxmox/commit/8305f5f) → [`ab1f5c4`](https://github.com/bpg/terraform-provider-proxmox/commit/ab1f5c4)) ([#2215](https://github.com/bpg/terraform-provider-proxmox/issues/2215)) ([6a1f972](https://github.com/bpg/terraform-provider-proxmox/commit/6a1f9728f2cbd8736ae5f52292edd50a43ce94b3)) - **deps:** update module github.com/hashicorp/terraform-plugin-framework (v1.16.0 → v1.16.1) ([#2216](https://github.com/bpg/terraform-provider-proxmox/issues/2216)) ([515c6bb](https://github.com/bpg/terraform-provider-proxmox/commit/515c6bb398d4c749bb3c3b300be7b0a1a894ea7a)) - **deps:** update module github.com/hashicorp/terraform-plugin-framework-validators (v0.18.0 → v0.19.0) ([#2230](https://github.com/bpg/terraform-provider-proxmox/issues/2230)) ([761fb70](https://github.com/bpg/terraform-provider-proxmox/commit/761fb709e35a5ca0ae0a928335d6b558bc507a64)) - **deps:** update module github.com/skeema/knownhosts (v1.3.1 → v1.3.2) ([#2229](https://github.com/bpg/terraform-provider-proxmox/issues/2229)) ([b6022d4](https://github.com/bpg/terraform-provider-proxmox/commit/b6022d4d0ab540de628b0078952257586c2ea0fa)) - **deps:** update module golang.org/x/net (v0.44.0 → v0.45.0) ([#2231](https://github.com/bpg/terraform-provider-proxmox/issues/2231)) ([60fdfd6](https://github.com/bpg/terraform-provider-proxmox/commit/60fdfd67d4d4010bfd46ba0ba311777def8231c3)) - **deps:** update module golang.org/x/net (v0.45.0 → v0.46.0) ([#2236](https://github.com/bpg/terraform-provider-proxmox/issues/2236)) ([68bd667](https://github.com/bpg/terraform-provider-proxmox/commit/68bd667b0fa9394569167b4626b3091993d96c38)) ### [`v0.84.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0841-2025-09-29) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.84.0...v0.84.1) ##### Bug Fixes - **api:** handle PVE API's 403 response status ([#2207](https://github.com/bpg/terraform-provider-proxmox/issues/2207)) ([46e8c24](https://github.com/bpg/terraform-provider-proxmox/commit/46e8c24d5bce906e5673e41b7c0151d46180fbe3)) - **sdn:** subnet validation errors when using value interpolation ([#2204](https://github.com/bpg/terraform-provider-proxmox/issues/2204)) ([5f876c0](https://github.com/bpg/terraform-provider-proxmox/commit/5f876c0fbfc06f25cbe18f396a983cd948df60ba)) ##### Miscellaneous - **deps:** update golangci/golangci-lint (v2.4.0 → v2.5.0) ([#2193](https://github.com/bpg/terraform-provider-proxmox/issues/2193)) ([2ab3d94](https://github.com/bpg/terraform-provider-proxmox/commit/2ab3d943d69c0648d749cbc85a279498c3a900ce)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.7.1 → v7.7.3) ([#2203](https://github.com/bpg/terraform-provider-proxmox/issues/2203)) ([3692434](https://github.com/bpg/terraform-provider-proxmox/commit/36924349437a7a0fd19b0c73185fdf5176d4186e)) - **deps:** update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.38.0 → v2.38.1) ([#2197](https://github.com/bpg/terraform-provider-proxmox/issues/2197)) ([0387296](https://github.com/bpg/terraform-provider-proxmox/commit/0387296c0bc5aa90cb6fd332ed0890ef75d67db0)) ### [`v0.84.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0840-2025-09-22) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.83.2...v0.84.0) ##### Features - **file:** add file datasource ([#2176](https://github.com/bpg/terraform-provider-proxmox/issues/2176)) ([8244813](https://github.com/bpg/terraform-provider-proxmox/commit/8244813b7eae6bb6442fa69f786ab9422ffdadee)) - **sdn:** add support for Subnet resource and datasource ([#2191](https://github.com/bpg/terraform-provider-proxmox/issues/2191)) ([1df305d](https://github.com/bpg/terraform-provider-proxmox/commit/1df305dfb3867f0e0bc207f928745de96db3f7f1)) - **sdn:** add support for VNet resource and datasource ([#2185](https://github.com/bpg/terraform-provider-proxmox/issues/2185)) ([8938d86](https://github.com/bpg/terraform-provider-proxmox/commit/8938d8657157085934adb15680209a374b3bc7b2)) ##### Miscellaneous - **deps:** update github.com/hashicorp/terraform-plugin-\* ([#2187](https://github.com/bpg/terraform-provider-proxmox/issues/2187)) ([09b704a](https://github.com/bpg/terraform-provider-proxmox/commit/09b704ad8e082dde47247f2a9fb64f5af7791a15)) - **deps:** update image golang ([`bb979b2`](https://github.com/bpg/terraform-provider-proxmox/commit/bb979b2) → [`8305f5f`](https://github.com/bpg/terraform-provider-proxmox/commit/8305f5f)) ([#2186](https://github.com/bpg/terraform-provider-proxmox/issues/2186)) ([b70fa62](https://github.com/bpg/terraform-provider-proxmox/commit/b70fa6267037811b650a48baec7bc07ed3b2665d)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.6.0 → v7.7.0) ([#2189](https://github.com/bpg/terraform-provider-proxmox/issues/2189)) ([46dbc68](https://github.com/bpg/terraform-provider-proxmox/commit/46dbc68da70bd4e7600c3d124b39abd07dbbc07e)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.7.0 → v7.7.1) ([#2192](https://github.com/bpg/terraform-provider-proxmox/issues/2192)) ([11f4002](https://github.com/bpg/terraform-provider-proxmox/commit/11f400288b896f8a4570f169651e20dd2cef3e10)) - **deps:** update module github.com/hashicorp/terraform-plugin-sdk/v2 (v2.37.0 → v2.38.0) ([#2188](https://github.com/bpg/terraform-provider-proxmox/issues/2188)) ([2b2d619](https://github.com/bpg/terraform-provider-proxmox/commit/2b2d619356fa7a099807c54b0a6a45e78683b15e)) ### [`v0.83.2`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0832-2025-09-14) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.83.1...v0.83.2) ##### Bug Fixes - **firewall:** detect drift when rules are manually deleted ([#2178](https://github.com/bpg/terraform-provider-proxmox/issues/2178)) ([6b84d5a](https://github.com/bpg/terraform-provider-proxmox/commit/6b84d5aa5ecd3ffb71e10050c20f79bc5ce1ff89)) - **firewall:** prevent perpetual plan drift on rule attribute removal ([#2177](https://github.com/bpg/terraform-provider-proxmox/issues/2177)) ([0e72580](https://github.com/bpg/terraform-provider-proxmox/commit/0e725801ee26642dcb872de5b1be58d0a224408e)) - **vm:** disk deletion may reorder disks ([#2174](https://github.com/bpg/terraform-provider-proxmox/issues/2174)) ([e339fef](https://github.com/bpg/terraform-provider-proxmox/commit/e339fef2d042728eaa7594607a89929892513e96)) ##### Miscellaneous - **ci:** update actions/create-github-app-token action (v2.1.1 → v2.1.4) ([#2179](https://github.com/bpg/terraform-provider-proxmox/issues/2179)) ([70cfb58](https://github.com/bpg/terraform-provider-proxmox/commit/70cfb582922e2e31662e580b2f42b124e0d481e2)) - **deps:** update image golang ([`b773c94`](https://github.com/bpg/terraform-provider-proxmox/commit/b773c94) → [`bb979b2`](https://github.com/bpg/terraform-provider-proxmox/commit/bb979b2)) ([#2173](https://github.com/bpg/terraform-provider-proxmox/issues/2173)) ([7944277](https://github.com/bpg/terraform-provider-proxmox/commit/79442773910b4309570aea8e838ea7d3b154e5be)) ### [`v0.83.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0831-2025-09-10) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.83.0...v0.83.1) ##### Bug Fixes - **ci:** update link checker config ([#2151](https://github.com/bpg/terraform-provider-proxmox/issues/2151)) ([e017881](https://github.com/bpg/terraform-provider-proxmox/commit/e017881712ad81767590c4c60877167a28f35a42)) ##### Miscellaneous - **ci:** Update actions/setup-go action (v5 → v6) ([#2154](https://github.com/bpg/terraform-provider-proxmox/issues/2154)) ([16814d4](https://github.com/bpg/terraform-provider-proxmox/commit/16814d469b4601413a9ea3fb9446bb7670884015)) - **ci:** Update actions/stale action (v9 → v10) ([#2155](https://github.com/bpg/terraform-provider-proxmox/issues/2155)) ([87e6392](https://github.com/bpg/terraform-provider-proxmox/commit/87e639232d0228a58bd3060b543e9fc05108d2c3)) - **code:** minor code cleanups ([#2156](https://github.com/bpg/terraform-provider-proxmox/issues/2156))ssh ([9e22c3c](https://github.com/bpg/terraform-provider-proxmox/commit/9e22c3c427086f4780e2ddc226edc3e235c90586)) - **deps:** update image golang (1.25.0 → 1.25.1) ([#2153](https://github.com/bpg/terraform-provider-proxmox/issues/2153)) ([a58bf4f](https://github.com/bpg/terraform-provider-proxmox/commit/a58bf4f9475c33a16f8fcead640976a5fb149cb0)) - **deps:** update image golang ([`a5e935d`](https://github.com/bpg/terraform-provider-proxmox/commit/a5e935d) → [`d6bdb04`](https://github.com/bpg/terraform-provider-proxmox/commit/d6bdb04)) ([#2161](https://github.com/bpg/terraform-provider-proxmox/issues/2161)) ([58d833d](https://github.com/bpg/terraform-provider-proxmox/commit/58d833dfa8996985253bbd75ed50a10f7e9cc0db)) - **deps:** update image golang ([`d6bdb04`](https://github.com/bpg/terraform-provider-proxmox/commit/d6bdb04) → [`b773c94`](https://github.com/bpg/terraform-provider-proxmox/commit/b773c94)) ([#2169](https://github.com/bpg/terraform-provider-proxmox/issues/2169)) ([a979850](https://github.com/bpg/terraform-provider-proxmox/commit/a9798505c828618892f33d4376295c9f6e1850d0)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.5.1 → v7.6.0) ([#2162](https://github.com/bpg/terraform-provider-proxmox/issues/2162)) ([ffdc3a5](https://github.com/bpg/terraform-provider-proxmox/commit/ffdc3a55da085f45132b686dacf26642126ff0ae)) - **deps:** update module golang.org/x/crypto (v0.41.0 → v0.42.0) ([#2163](https://github.com/bpg/terraform-provider-proxmox/issues/2163)) ([4e73d56](https://github.com/bpg/terraform-provider-proxmox/commit/4e73d5610c854cd64e6f4d4cf81b7f534183d9be)) - **deps:** update module golang.org/x/net (v0.43.0 → v0.44.0) ([#2170](https://github.com/bpg/terraform-provider-proxmox/issues/2170)) ([ed366b5](https://github.com/bpg/terraform-provider-proxmox/commit/ed366b55dc8b32b2203ec87213bf76aba6d1860d)) - **docs:** improve `container` documentation ([#2160](https://github.com/bpg/terraform-provider-proxmox/issues/2160)) ([380fd7f](https://github.com/bpg/terraform-provider-proxmox/commit/380fd7fed1d5cfbb9a2c562294a9f2ac127a0a31)) - **docs:** improve `vm.initialization` documentation ([#2158](https://github.com/bpg/terraform-provider-proxmox/issues/2158)) ([29ef9d2](https://github.com/bpg/terraform-provider-proxmox/commit/29ef9d2527132b4e726e222edb958f022260a306)) - **docs:** include vm/lxc lock error details in the README known issues section ([#2166](https://github.com/bpg/terraform-provider-proxmox/issues/2166)) ([1810273](https://github.com/bpg/terraform-provider-proxmox/commit/1810273cebc8de6092b6347c4be0393ad2f9f29b)) - **docs:** update reference to `release-build` in contributing doc ([#2167](https://github.com/bpg/terraform-provider-proxmox/issues/2167)) ([739471a](https://github.com/bpg/terraform-provider-proxmox/commit/739471a9888b264587c42da1d370848b3d95639e)) - **docs:** update sdn\_applier example ([c275e03](https://github.com/bpg/terraform-provider-proxmox/commit/c275e031ffdd9b8fdd46c09d1563be12c713541b)) ### [`v0.83.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0830-2025-08-31) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.82.1...v0.83.0) ##### Features - **sdn:** add custom resource to apply `sdn_*` configurations ([#2127](https://github.com/bpg/terraform-provider-proxmox/issues/2127)) ([e13d7ef](https://github.com/bpg/terraform-provider-proxmox/commit/e13d7ef29985ccd0ba8f79dd0ad658ee6779a8a6)) ##### Bug Fixes - **docs:** correct minor typos / formatting ([#2144](https://github.com/bpg/terraform-provider-proxmox/issues/2144)) ([a2e4ff0](https://github.com/bpg/terraform-provider-proxmox/commit/a2e4ff039450214feb2c32d84e6b18878e1dd804)) ##### Miscellaneous - **ci:** Update actions/attest-build-provenance action (v2 → v3) ([#2142](https://github.com/bpg/terraform-provider-proxmox/issues/2142)) ([f62e69d](https://github.com/bpg/terraform-provider-proxmox/commit/f62e69d160055dc0cbd5a08f5041533c079bd96e)) - **ci:** update googleapis/release-please-action action (v4.2.0 → v4.3.0) ([#2136](https://github.com/bpg/terraform-provider-proxmox/issues/2136)) ([f634b2e](https://github.com/bpg/terraform-provider-proxmox/commit/f634b2eafb631b75c04c91b39d393de6b05e36b0)) - **ci:** update lycheeverse/lychee-action action (v2.5.0 → v2.6.0) ([#2137](https://github.com/bpg/terraform-provider-proxmox/issues/2137)) ([64c1ab3](https://github.com/bpg/terraform-provider-proxmox/commit/64c1ab3148a4d7a5835c5fd957a3009c35f73761)) - **ci:** update lycheeverse/lychee-action action (v2.6.0 → v2.6.1) ([#2138](https://github.com/bpg/terraform-provider-proxmox/issues/2138)) ([7f56290](https://github.com/bpg/terraform-provider-proxmox/commit/7f56290838c363d025719a15f6e25b6e1ec8d49e)) - **deps:** update image golang ([`4859242`](https://github.com/bpg/terraform-provider-proxmox/commit/4859242) → [`5502b0e`](https://github.com/bpg/terraform-provider-proxmox/commit/5502b0e)) ([#2134](https://github.com/bpg/terraform-provider-proxmox/issues/2134)) ([20f41e8](https://github.com/bpg/terraform-provider-proxmox/commit/20f41e86e03f183bcbf295ba56c41c692fcee998)) - **deps:** update image golang ([`91e2cd4`](https://github.com/bpg/terraform-provider-proxmox/commit/91e2cd4) → [`4859242`](https://github.com/bpg/terraform-provider-proxmox/commit/4859242)) ([#2128](https://github.com/bpg/terraform-provider-proxmox/issues/2128)) ([9ae882e](https://github.com/bpg/terraform-provider-proxmox/commit/9ae882e5d7cdb19b54e9be07ba92ef92cab0054c)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.3.0 → v7.4.0) ([#2129](https://github.com/bpg/terraform-provider-proxmox/issues/2129)) ([11b8167](https://github.com/bpg/terraform-provider-proxmox/commit/11b8167fc6488fbeb7b977f0267dcc862ce05e20)) - **deps:** update module github.com/brianvoe/gofakeit/v7 (v7.4.0 → v7.5.1) ([#2143](https://github.com/bpg/terraform-provider-proxmox/issues/2143)) ([2eae3ee](https://github.com/bpg/terraform-provider-proxmox/commit/2eae3eeeeb7c12e407aa21a33e930e8219310b6b)) - **deps:** update module github.com/stretchr/testify (v1.10.0 → v1.11.1) ([#2135](https://github.com/bpg/terraform-provider-proxmox/issues/2135)) ([6b00db6](https://github.com/bpg/terraform-provider-proxmox/commit/6b00db644613520e257c6af90b5f3930cf4a4b8a)) ### [`v0.82.1`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0821-2025-08-19) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.82.0...v0.82.1) ##### Bug Fixes - **vm:** prevent re-creation of previously imported disks on update ([#2122](https://github.com/bpg/terraform-provider-proxmox/issues/2122)) ([c6c1c18](https://github.com/bpg/terraform-provider-proxmox/commit/c6c1c18a2b7a2ad80006bf5e22afec7dbf98071b)) ##### Miscellaneous - **deps:** update image golang ([`9e56f0d`](https://github.com/bpg/terraform-provider-proxmox/commit/9e56f0d) → [`91e2cd4`](https://github.com/bpg/terraform-provider-proxmox/commit/91e2cd4)) ([#2123](https://github.com/bpg/terraform-provider-proxmox/issues/2123)) ([9d179dd](https://github.com/bpg/terraform-provider-proxmox/commit/9d179dde724604d3b2f297fd805c7c2cb8f723b4)) - **docs:** fix TOC format, cleanup cloud image guide ([#2121](https://github.com/bpg/terraform-provider-proxmox/issues/2121)) ([b321a01](https://github.com/bpg/terraform-provider-proxmox/commit/b321a01b4f142d55afef53eca20c1b183386bc84)) ### [`v0.82.0`](https://github.com/bpg/terraform-provider-proxmox/blob/HEAD/CHANGELOG.md#0820-2025-08-18) [Compare Source](https://github.com/bpg/terraform-provider-proxmox/compare/v0.81.0...v0.82.0) ##### Features - **docs:** update compatibility notes for PVE 9.x ([#2116](https://github.com/bpg/terraform-provider-proxmox/issues/2116)) ([08ea66a](https://github.com/bpg/terraform-provider-proxmox/commit/08ea66a4e0e1c92851c5811bacde075d169fb1cc)) - **lxc:** add `proxmox_virtual_environment_containers` data source ([#2090](https://github.com/bpg/terraform-provider-proxmox/issues/2090)) ([45f2805](https://github.com/bpg/terraform-provider-proxmox/commit/45f28051cd18bbb5838ef0de5eedc41a97ecee3b)) - **lxc:** Add missing configuration options for container rootfs ([#2067](https://github.com/bpg/terraform-provider-proxmox/issues/2067)) ([b2c5012](https://github.com/bpg/terraform-provider-proxmox/commit/b2c50120ea552d078e9634228f8b90b356a163b9)) ##### Bug Fixes - **lxc:** adjust max number of container's IP configs ([#2088](https://github.com/bpg/terraform-provider-proxmox/issues/2088)) ([602568e](https://github.com/bpg/terraform-provider-proxmox/commit/602568e6a64945514b7e3a3294ec8fb1f98b6be8)) - **provider:** parsing PVE version reported by API ([#2115](https://github.com/bpg/terraform-provider-proxmox/issues/2115)) ([f1501e2](https://github.com/bpg/terraform-provider-proxmox/commit/f1501e2655f4d9a246be8fe826a3d385448dce17)) - **vm:** regression: disk re-ordering on re-apply ([#2114](https://github.com/bpg/terraform-provider-proxmox/issues/2114)) ([634ad69](https://github.com/bpg/terraform-provider-proxmox/commit/634ad690fefa719df7be1c7f8962cd4a5bead79a)) ##### Miscellaneous - **ci:** Update actions/checkout action ([#2098](https://github.com/bpg/terraform-provider-proxmox/issues/2098)) ([3855cb2](https://github.com/bpg/terraform-provider-proxmox/commit/3855cb293fd32486eb39aee056c3c526d4f15ba8)) - **ci:** update actions/create-github-app-token action (v2.0.6 → v2.1.0) ([#2095](https://github.com/bpg/terraform-provider-proxmox/issues/2095)) ([6161969](https://github.com/bpg/terraform-provider-proxmox/commit/61619690cce176948e4795a98075c0854a42669b)) - **ci:** update actions/create-github-app-token action (v2.1.0 → v2.1.1) ([#2099](https://github.com/bpg/terraform-provider-proxmox/issues/2099)) ([7f5d771](https://github.com/bpg/terraform-provider-proxmox/commit/7f5d77143a2c3a607ee3f647ad2d9054b9e0d00d)) - **ci:** update goreleaser/goreleaser-action action (v6.3.0 → v6.4.0) ([#2111](https://github.com/bpg/terraform-provider-proxmox/issues/2111)) ([78ce7f0](https://github.com/bpg/terraform-provider-proxmox/commit/78ce7f0db4595ecf00c0420b3d46fe78cda1d204)) - **ci:** update jetbrains/qodana-action action (v2025.1.1 → v2025.2.1) ([#2106](https://github.com/bpg/terraform-provider-proxmox/issues/2106)) ([0dec643](https://github.com/bpg/terraform-provider-proxmox/commit/0dec643b3dc670c48f3f79752cb93519e3515a36)) - **ci:** update lycheeverse/lychee-action action (v2.4.1 → v2.5.0) ([#2096](https://github.com/bpg/terraform-provider-proxmox/issues/2096)) ([7c98464](https://github.com/bpg/terraform-provider-proxmox/commit/7c98464783a70e1ca801765eb5c16fed4ce0f329)) - **deps:** update golangci/golangci-lint (v2.3.0 → v2.3.1) ([#2074](https://github.com/bpg/terraform-provider-proxmox/issues/2074)) ([9947a86](https://github.com/bpg/terraform-provider-proxmox/commit/9947a86106c7215f68183956cf0f2cde209a73fa)) - **deps:** update golangci/golangci-lint (v2.3.1 → v2.4.0) ([#2110](https://github.com/bpg/terraform-provider-proxmox/issues/2110)) ([21bed82](https://github.com/bpg/terraform-provider-proxmox/commit/21bed824e4cc4fd53cc927273798e5c6b757f89d)) - **deps:** update image golang (1.24.5 → 1.24.6) ([#2085](https://github.com/bpg/terraform-provider-proxmox/issues/2085)) ([ac91fe8](https://github.com/bpg/terraform-provider-proxmox/commit/ac91fe8de01fd61ca1015350801ffdb5451d7aa7)) - **deps:** update image golang (1.24.6 → 1.25.0) ([#2107](https://github.com/bpg/terraform-provider-proxmox/issues/2107)) ([9e10206](https://github.com/bpg/terraform-provider-proxmox/commit/9e10206e19b9f3cdf5989bef6956a4a1242a7235)) - **deps:** update image golang ([`10a15b9`](https://github.com/bpg/terraform-provider-proxmox/commit/10a15b9) → [`9e56f0d`](https://github.com/bpg/terraform-provider-proxmox/commit/9e56f0d)) ([#2109](https://github.com/bpg/terraform-provider-proxmox/issues/2109)) ([420add8](https://github.com/bpg/terraform-provider-proxmox/commit/420add86698425afba60ac06b3481b1057da5aee)) - **deps:** update module github.com/hashicorp/terraform-plugin-testing (v1.13.2 → v1.13.3) ([#2113](https://github.com/bpg/terraform-provider-proxmox/issues/2113)) ([1863847](https://github.com/bpg/terraform-provider-proxmox/commit/1863847b5764c5da9ed70d3bd9a3ce087ab185b4)) - **deps:** update module golang.org/x/crypto (v0.40.0 → v0.41.0) ([#2086](https://github.com/bpg/terraform-provider-proxmox/issues/2086)) ([5018b31](https://github.com/bpg/terraform-provider-proxmox/commit/5018b31d2aa72c66771242c0d5463f10ad20f7d0)) - **deps:** update module golang.org/x/net (v0.42.0 → v0.43.0) ([#2087](https://github.com/bpg/terraform-provider-proxmox/issues/2087)) ([5151dcc](https://github.com/bpg/terraform-provider-proxmox/commit/5151dcc7b7832a95312efe5773401e3443d26a1a)) - **docs:** cleanup and update `clone-vm` example ([#2094](https://github.com/bpg/terraform-provider-proxmox/issues/2094)) ([c7cd61a](https://github.com/bpg/terraform-provider-proxmox/commit/c7cd61a2d3aea273df40e86532fa575c0dd95b98)) - **docs:** remove spurious sdn datasource .tf examples ([#2092](https://github.com/bpg/terraform-provider-proxmox/issues/2092)) ([91e0fbf](https://github.com/bpg/terraform-provider-proxmox/commit/91e0fbf676a93dca8659ca55460ba2318b09620e)) </details> <details> <summary>rancher/local-path-provisioner (rancher/local-path-provisioner)</summary> ### [`v0.0.37`](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37): Local Path Provisioner v0.0.37 [Compare Source](https://github.com/rancher/local-path-provisioner/compare/v0.0.36...v0.0.37) #### What's Changed - build(deps): bump golang.org/x/net from 0.38.0 to 0.55.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#584](https://github.com/rancher/local-path-provisioner/pull/584) - fix: use alpine as base image for package/Dockerfile to avoid shippin… by [@alexiiiiiiiiiiiiiii](https://github.com/alexiiiiiiiiiiiiiii) in [#585](https://github.com/rancher/local-path-provisioner/pull/585) - add storageclass nodeaffinity to helm values by [@clayrosenthal](https://github.com/clayrosenthal) in [#581](https://github.com/rancher/local-path-provisioner/pull/581) - fix: update golang.org/x/text to v0.39.0 (CVE-2026-56852) by [@derekbit](https://github.com/derekbit) with [@Copilot](https://github.com/Copilot) in [#587](https://github.com/rancher/local-path-provisioner/pull/587) - Add initial Renovate configuration by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#589](https://github.com/rancher/local-path-provisioner/pull/589) - chore(deps): update golang docker tag to v1.26.5 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#591](https://github.com/rancher/local-path-provisioner/pull/591) - chore(deps): update github actions by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#590](https://github.com/rancher/local-path-provisioner/pull/590) - chore(deps): update module github.com/sirupsen/logrus to v1.9.4 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#593](https://github.com/rancher/local-path-provisioner/pull/593) - chore(deps): update docker/dockerfile docker tag to v1.25.0 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#594](https://github.com/rancher/local-path-provisioner/pull/594) - chore(deps): update module github.com/stretchr/testify to v1.11.1 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#595](https://github.com/rancher/local-path-provisioner/pull/595) - chore(deps): update github/codeql-action digest to [`4187e74`](https://github.com/rancher/local-path-provisioner/commit/4187e74) by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#592](https://github.com/rancher/local-path-provisioner/pull/592) - chore(deps): update centos docker tag to v8 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#596](https://github.com/rancher/local-path-provisioner/pull/596) - chore(deps): update github actions (major) by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#597](https://github.com/rancher/local-path-provisioner/pull/597) - chore(deps): update almalinux docker tag to v10 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#601](https://github.com/rancher/local-path-provisioner/pull/601) - chore(deps): update github actions by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#600](https://github.com/rancher/local-path-provisioner/pull/600) - fix: bump golang.org/x/net to v0.56.0 (CVE-2026-46600) by [@derekbit](https://github.com/derekbit) with [@Copilot](https://github.com/Copilot) in [#588](https://github.com/rancher/local-path-provisioner/pull/588) - Add initial /health probe by [@jcpunk](https://github.com/jcpunk) in [#583](https://github.com/rancher/local-path-provisioner/pull/583) - fix: fix validation errors by [@derekbit](https://github.com/derekbit) in [#602](https://github.com/rancher/local-path-provisioner/pull/602) - chore(deps): update github/codeql-action digest to [`d1ba80a`](https://github.com/rancher/local-path-provisioner/commit/d1ba80a) by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#603](https://github.com/rancher/local-path-provisioner/pull/603) - fix: upgrade kind to v0.32.0 for containerd config v4 support by [@derekbit](https://github.com/derekbit) in [#605](https://github.com/rancher/local-path-provisioner/pull/605) - fix: select PV by bound PVC in TestPodWithCustomNodeAffinityKey by [@derekbit](https://github.com/derekbit) in [#606](https://github.com/rancher/local-path-provisioner/pull/606) - chore: upgrade github.com/urfave/cli to v3 by [@derekbit](https://github.com/derekbit) in [#607](https://github.com/rancher/local-path-provisioner/pull/607) - fix: remove kind's built-in local-path-provisioner in e2e setup to avoid provisioner race by [@derekbit](https://github.com/derekbit) in [#608](https://github.com/rancher/local-path-provisioner/pull/608) - fix: use multi-stage scratch build for released image to drop shell and Go toolchain by [@derekbit](https://github.com/derekbit) in [#609](https://github.com/rancher/local-path-provisioner/pull/609) - Support exposing user, group and perm patterns by [@treydock](https://github.com/treydock) in [#560](https://github.com/rancher/local-path-provisioner/pull/560) - test: add e2e coverage for user/group/perm patterns by [@derekbit](https://github.com/derekbit) in [#611](https://github.com/rancher/local-path-provisioner/pull/611) - chore(deps): update actions/stale action to v11 by [@renovate-rancher](https://github.com/renovate-rancher)\[bot] in [#604](https://github.com/rancher/local-path-provisioner/pull/604) - chore: release v0.0.37 by [@derekbit](https://github.com/derekbit) in [#612](https://github.com/rancher/local-path-provisioner/pull/612) #### New Contributors - [@alexiiiiiiiiiiiiiii](https://github.com/alexiiiiiiiiiiiiiii) made their first contribution in [#585](https://github.com/rancher/local-path-provisioner/pull/585) - [@clayrosenthal](https://github.com/clayrosenthal) made their first contribution in [#581](https://github.com/rancher/local-path-provisioner/pull/581) - [@treydock](https://github.com/treydock) made their first contribution in [#560](https://github.com/rancher/local-path-provisioner/pull/560) **Full Changelog**: <https://github.com/rancher/local-path-provisioner/compare/v0.0.36...v0.0.37> </details> <details> <summary>ahamlinman/terraform-provider-zonefile (zonefile)</summary> ### [`v0.2.0`](https://github.com/ahamlinman/terraform-provider-zonefile/blob/HEAD/CHANGELOG.md#v020-2026-06-22) [Compare Source](https://github.com/ahamlinman/terraform-provider-zonefile/compare/v0.1.2...v0.2.0) This release migrates the provider's Go module path and TF registry address to match my current GitHub username. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovatebot added 1 commit

2026-05-25 16:46:49 +02:00

Update all non-major dependencies 9657da8bf1

renovatebot force-pushed renovate/all-minor-patch from 9657da8bf1 to de343eaa1d

2026-05-27 15:16:19 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from de343eaa1d to 98043386cd

2026-05-27 15:33:32 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 98043386cd to 7cfb995b1c

2026-05-27 17:16:19 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 7cfb995b1c to e80d8d5f5c

2026-05-27 23:31:41 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from e80d8d5f5c to 3559408054

2026-05-28 01:31:20 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 3559408054 to 42e5d79b11

renovate/artifacts Artifact file update failure

2026-06-01 13:16:32 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 42e5d79b11

renovate/artifacts Artifact file update failure

to 0650aeeb91

2026-06-01 19:16:26 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 0650aeeb91 to 59905a7ee2

2026-06-06 15:46:31 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 59905a7ee2 to 08a0ca9c55

2026-06-10 16:01:21 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 08a0ca9c55 to 12f31a199a

2026-06-11 19:16:29 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 12f31a199a to 4cffd3b8d3

2026-06-15 16:03:39 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 4cffd3b8d3 to 73d1f11e86

renovate/artifacts Artifact file update failure

2026-06-18 01:02:28 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 73d1f11e86

renovate/artifacts Artifact file update failure

to fd9195f222

2026-06-18 08:32:04 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from fd9195f222 to 25505f9549

renovate/artifacts Artifact file update failure

2026-06-18 18:17:31 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 25505f9549

renovate/artifacts Artifact file update failure

to a79b6bf51d

2026-06-19 00:46:23 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from a79b6bf51d to f417e46459

2026-06-23 06:47:19 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from f417e46459 to e5873fdcc2

2026-06-23 15:17:30 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from e5873fdcc2 to 5c87ea6901

2026-06-25 17:32:14 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 5c87ea6901 to af7c1e9a07

2026-07-01 04:47:16 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from af7c1e9a07 to b34d171742

2026-07-02 18:32:33 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from b34d171742 to 64fb3fb236

2026-07-03 21:46:56 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 64fb3fb236 to 003240b49e

2026-07-09 00:46:32 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 003240b49e to 1e9c4e199e

2026-07-09 20:17:07 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 1e9c4e199e to cf7be77999

2026-07-09 20:46:47 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from cf7be77999 to e814099f0c

2026-07-10 14:01:48 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from e814099f0c to bb2beab637

2026-07-15 17:01:45 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from bb2beab637 to 4bacc367c6

2026-07-15 17:17:38 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 4bacc367c6 to 387e28d0f2

2026-07-29 16:32:35 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 387e28d0f2 to c57900ac62

2026-07-29 18:03:07 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 8cb35b439d to 3bb0a6ae6c

2026-08-03 21:47:23 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 3bb0a6ae6c to 93a7b6cf16

containers / generate-build-matrix (push) Successful in 15s

Details

containers / build-container (nix-builder) (push) Successful in 2m51s

Details

containers / build-container (postfix) (push) Successful in 35s

Details

2026-08-05 05:46:44 +02:00

Compare

renovatebot force-pushed renovate/all-minor-patch from 93a7b6cf16

containers / generate-build-matrix (push) Successful in 15s

Details

containers / build-container (nix-builder) (push) Successful in 2m51s

Details

containers / build-container (postfix) (push) Successful in 35s

Details

to 17412d44bb

2026-08-07 23:02:07 +02:00

Compare

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/all-minor-patch:renovate/all-minor-patch

git switch renovate/all-minor-patch

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/all-minor-patch

git switch renovate/all-minor-patch

git rebase main

git switch main

git merge --ff-only renovate/all-minor-patch

git switch renovate/all-minor-patch

git rebase main

git switch main

git merge --no-ff renovate/all-minor-patch

git switch main

git merge --squash renovate/all-minor-patch

git switch main

git merge --ff-only renovate/all-minor-patch

git switch main

git merge renovate/all-minor-patch

git push origin main

Update all non-major dependencies #42

Release Notes

Changes by Kind

Bug or Regression

Other (Cleanup or Flake)

Major Themes

Default tokenrequest RBAC removed from Helm chart

Restrict Challenge and Order RBAC in cert-manager-edit ClusterRole

Metrics port name and path Helm values removed

ACME and Certificate Management

Gateway API and cainjector

Deployment and Observability

Notable Bug Fixes

Community

Changes since v1.20.0

Feature

Bug or Regression

Other (Cleanup or Flake)

Changes since v1.21.0-alpha.1

Feature

Bug or Regression

Other (Cleanup or Flake)

Changes since v1.21.0-alpha.0

Feature

Bug or Regression

Other (Cleanup or Flake)

Changes by Kind since v1.20.0

Feature

Bug or Regression

Other (Cleanup or Flake)

Changes by Kind

Bug or Regression

Other (Cleanup or Flake)

Highlights

Upload wakelock (web)

Undo archive (web)

Filter assets by server filepath (workflows)

Filter assets by EXIF metadata (workflows)

Quick navigate to maintenance page (web)

Better slideshow button visibility (web)

OIDC role claim sync improvements (OAuth)

Invalidate sessions on password reset (admin-cli)

Date range for map (mobile)

What's Changed

🚨 Breaking Changes

🚀 Features

🌟 Enhancements

🐛 Bug fixes

📚 Documentation

🌐 Translations

New Contributors

v3.0.3

What's Changed

🚀 Features

🐛 Bug fixes

📚 Documentation

🌐 Translations

New Contributors

v3.0.2

What's Changed

🌟 Enhancements

🐛 Bug fixes

📚 Documentation

🌐 Translations

New Contributors

v10.34.5: pnpm 10.34.5

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.4: pnpm 10.34.4

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.3: pnpm 10.34.3

⚠️ Security fix — environment variables in a project .npmrc (action may be required)

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.2: pnpm 10.34.2

⚠️ Security fix — environment variables in a project .npmrc (action may be required)

Default `tokenrequest` RBAC removed from Helm chart

Restrict Challenge and Order RBAC in `cert-manager-edit` ClusterRole

Changes by Kind since `v1.20.0`

`v10.34.5`: pnpm 10.34.5

`v10.34.4`: pnpm 10.34.4

`v10.34.3`: pnpm 10.34.3

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

`v10.34.2`: pnpm 10.34.2

⚠️ Security fix — environment variables in a project `.npmrc` (action may be required)

`v10.34.1`: pnpm 10.34.1

`v10.34.0`: pnpm 10.34

`v10.33.4`: pnpm 10.33.4

`v10.33.3`: pnpm 10.33.3

`v10.33.2`: pnpm 10.33.2

`v10.33.1`: pnpm 10.33.1

`v10.33.0`: pnpm 10.33

`v10.32.1`: pnpm 10.32.1

`v10.32.0`: pnpm 10.32

`v10.31.0`: pnpm 10.31

`v10.30.3`: pnpm 10.30.3

`v10.30.2`: pnpm 10.30.2

`v10.30.1`: pnpm 10.30.1

`v10.30.0`: pnpm 10.30