vatesfr/xen-orchestra
1
0
Fork 0
mirror of https://github.com/vatesfr/xen-orchestra.git synced 2026-10-11 22:50:01 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
xen-orchestra/CHANGELOG.md
T
Elise-F 5999d53e0b feat: release 6.9.1 (#10533)
2026-10-05 17:18:51 +02:00

107 KiB
Raw Permalink Blame History

ChangeLog

6.9.1 (2026-10-05)

Channel: latest

Bug fixes

  • [Servers] Fix servers stuck in Connecting state when using an HTTPS proxy that support HTTP/2 (Forum#12502) (PR #10507)
  • [Backups] Fix synchronized backups task log showing VM count+1 (PR #10518)
  • [Backup/replication] fix to ensure distributed replications are deleted according to retention( PR [#10491] (https://github.com/vatesfr/xen-orchestra/pull/10491))
  • [Replication] Fix Cannot read properties of undefined (reading 'get') error on continuous replication to multiple SRs (PR #10519)
  • [V2V] Fix vectura is not runnable on XOA and other systems based on Debian 11 (glibc 2.31): the vectura binary required glibc 2.34
  • [VM/System] Fix video RAM displayed in bytes instead of MiB (PR #10486)
  • [XO5/Hosts] Disable restart toolstack button for the hosts that belongs to a HA pools in the home page (PR #10497)
  • [VM/Snapshot] In the side panel, correctly filter VDIs associated with the VM snapshot (PR #10510)
  • [XO6] Fix sometimes incorrect IDs in URLs (PR #10511)

Released packages

  • xen-api 5.0.2
  • @xen-orchestra/backups 0.76.1
  • @xen-orchestra/web-core 0.63.1
  • @xen-orchestra/proxy 0.33.1
  • vectura 0.1.2
  • @xen-orchestra/vmware-explorer 1.0.2
  • @xen-orchestra/qa-test 1.2.3
  • @xen-orchestra/web 0.63.1
  • xo-server 5.211.1
  • xo-web 5.206.1

6.9.0 (2026-09-30)

Security

  • [V2V] Prevent privilege escalation via Prototype Pollution (PR #10489)

Enhancements

  • [Backups] change the prefix name of vms during health checks from 'Importing...' to 'Health Check' to avoid confusion (PR #10361)

  • [Backup/Restore] Faster listing of the backups: a backup repository is now listed once, then kept up to date by replaying its journal instead of being listed again. Especially visible on S3 repositories with Object Lock, where nothing could be cached before (PR #10257)

  • [Backup/Restore] Choose what to do with each disk when restoring an incremental backup: restore it to an SR, live mount it read-only on a host so it is usable immediately without being copied, or not restore it at all (PR #10345)

  • [Backup/Restore] Backup repositories attached to a proxy now also benefit from the faster, journal-replayed backup listing (PR #10437)

  • [Backup/Restore] A live mounted disk is released on its own once it is deleted, or the VM holding it is: its SR is forgotten and the backup is no longer served (PR #10432)

  • [Backup/Restore] When ufw is enabled, as on XOA and proxies, live mount opens its iSCSI port in it, for the host the disk is attached to and while it is mounted (iscsi.manageFirewall = false to turn it off) (PR #10468)

  • [V2V] When a VM has Changed Block Tracking enabled on the source host, a migration now asks the host which blocks it has to read — the blocks a disk uses for a full transfer, the blocks written since the previous pass for a delta — instead of scanning the disk through the VDDK. Faster to start on large disks, and one less moving part. VMs without CBT are migrated exactly as before (PR #10384)

  • [V2V] Migrations no longer need the VDDK library, nbdkit and nbdinfo. The disks are read through vectura, a single binary shipped with XO and installed in one click from the import screen. The Broadcom download, the tar.gz upload and the two compile-from-source buttons are gone. ESXi 6.x hosts are no longer supported

  • [RPU] A rolling pool update is now refused while a previous one is still in progress or was left incomplete, and asks for confirmation when the master is already up to date but other hosts are not (PR #10394)

  • [RPU] An incomplete rolling pool update can now be closed from the pool's Patches tab, or with pool.finalizeRollingUpdate and the REST route POST /rest/v0/pools/{id}/actions/finalize_rolling_update. The closing is refused while the update left something it had changed unrestored (HA, WLB, load balancer, backup schedules, disabled hosts, displaced or halted VMs); forcing it lists the abandoned items in the task and changes nothing in the pool (PR #10418)

  • [RPU] Keep track of an interrupted rolling pool update across xo-server restarts: the pool's Patches tab now shows which hosts were updated, the last error, and the VMs that were shut down for the update and not started again (PR #10331)

  • [RPU] Keeping track of an interrupted rolling pool update, refusing a new one until it is closed, and closing it from the pool's Patches tab only apply to XCP-ng and XenServer 8.4+ pools. Older XenServer and Citrix Hypervisor pools are updated as before (PR #10447)

  • [Web-Core/TabItem] Update the component to remove uppercase for better readability (PR #10338)

  • [Docs] Improve doc, rename titles, and refactor menu (PR #10212)

  • [i18n] Add Turkish and update Czech, Dutch, Slovak and Swedish translations (PR #10316)

  • [i18n] Update Chinese (Simplified Han script), Czech, Dutch, Finnish, Italian, Norwegian, Persian, Portuguese, Russian, Slovak, Spanish and Turkish translations (PR #10396)

  • [VIF] Add VIF name in header on VIF detail page (PR #10252)

  • [XO6/Host] Sort the networks table by network name (PR #10367)

  • [XO6/Host] Add possibility to scan PIFs directly from the host (PR #10191)

  • [XO6/Host] Add possibility to shut down and start an host (PR #10088)

  • [XO6/Host] Add possibility to forget a host (PR #10089)

  • [XO6/Host] Add icon for disabled host (PR #10188)

  • [XO6/SR] Add dedicated Storage Repository page hosts sidepanel (PR #10140)

  • [XO6] Allow changing which PIF a host uses for its management interface, without deleting and recreating the network config (PR #10110)

  • [XO6/Vm] Add the VM name to VM related actions that open a modal (PR #10310)

  • [XO6/StateHero] Update StateHero illustrations SVG to match current design system (PR #10380)

  • [XO6/BRs] Add backup repository list page (PR #10247)

  • [REST API] VDI can now be exported in qcow2 format, and the VHD export uses NBD when available. Both formats work whatever the format the disk is stored in. Every export format, raw included, now provides the size of the download (PR #10350)

  • [REST API] Add an endpoint to reclaim space per vm or backup repository: POST /rest/V0/backup-repositories/:id/actions/reclaim-space (PR #10262)

  • [REST API] Add hosts/:id/actions/scan_pifs endpoint (PR #10187)

  • [REST API/Backup] Add POST backup-archives/:id/actions/mount_live_disk and POST backup-archives/:id/live_disks/:liveDiskId/actions/unmount endpoints (administrators only): attach a disk of a backup to a host as a read-only SR, to read its content without restoring it. This XO's address reachable from the hosts is auto-detected, or can be set explicitly with iscsi.advertisedAddress

  • [REST API] SSE now supports Non XAPI objects (user, group, acl-privilege, acl-role, proxy, server, backup-repository, backup-job, schedule) (PR #10278)

  • [REST API/SDN Controller, Audit] Traffic rule and audit record routes are now documented in the Swagger/OpenAPI spec (PR #9895)

  • [IPMI-plugin] Add GET plugins/ipmi-sensors/hosts/{id}/ipmi to get IPMI sensors (PR #10003)

  • [Proxy] Check proxy licenses at XOA level instead of blocking backups on it (PR #10280)

  • [Rolling pool update/reboot] A pool can now skip the phase which brings the VMs back to the host they were running on, which halves the migrations of the run (PR #10295)

  • [LDAP] Release plugin for LDAP multidomain management (PR #10015)

  • [XO5/Backups] Open the backup job edition form in the same tab when editing a backup job from the VM page (PR #10342)

  • [XO5/XO Config Cloud Backup] Require an acknowledgment to enable and warn about backup deletion when disabling (PR #10457)

Bug fixes

  • [Backups/Encryption] New error thrown when encryption key is removed from an encrypted remote url (PR #10339)

  • [Backup-archive] No longer create a cache.json.gz file on immutable/S3 remote during cleanup, which could not be deleted afterwards and stayed billed forever (PR #10243)

  • [Backups] Fix orphaned VM on target after failed transfer (PR #10369)

  • [Backup] Fix uncaught exception AssertionError: assert(!this.paused) in the logs, when a host closes a transfer while XO is writing to a slower destination (PR #10282)

  • [backup/restore] Fix backups of a repository randomly disappearing from the list after visiting a VM (PR #10277)

  • [Backup] Fix a job combining Rolling Snapshot with Disaster Recovery to an SR of the source VM's pool destroying its own snapshots: the job reported a success but kept fewer snapshots than the configured snapshot retention, usually none (PR #10395)

  • [Backups] Fix slow replication startup and fallback to full on qcow2 (PR #10333)

  • [Backup] Fix replication never cleaning up a VM left behind by an interrupted transfer, which could keep accumulating on the target SR (PR #10436)

  • [Backups] Prevent continuous replication failed transfer to accumulate replicas (PR #10404)

  • [Backups] Fix backup logs transfer size including health check restores and every backup target, which made it much bigger than in XO5 Forum#12486 (PR #10448)

  • [REST API/SDN Controller] Fix deleting a non-existent traffic rule wrongly returning success instead of a 404 (PR #9895)

  • [REST API] Rolling pool update and rolling pool reboot are now refused while a backup job runs on the pool, like their JSON-RPC counterparts, unless bypassBackupCheck is set in the request body (PR #10313)

  • [REST API] Keep collection events ordered per object (PR #10446)

  • [REST API] Wait for the XAPI objects before making a server connected (PR #10446)

  • [REST API] Do not record an server error when a connection attempt is aborted (PR #10446)

  • [Servers] Fix endless connection attempts to a pool which is already connected through another server entry (PR #10355)

  • [Servers] fix a mishandling in the grace period before marking a pool disconnected, this will keep the ui in sync AND not redownload all the xapi object for a transient issue (PR #10355)

  • [XO server] Fix current_operations format on host and pool objects (PR #10283)

  • [xo-server] If an HTTP proxy was configured, internal routes (/openmetrics, /v5) were wrongly routed through it when xo-server listened on a wildcard address. localhost targets are now always reached directly, bypassing the HTTP proxy, whether the configured listen address is a wildcard (0.0.0.0, ::) or a specific one (PR #10335)

  • [xo-server] Fix a memory leak when a client stops reading a proxied response, e.g. a Prometheus scrape of /openmetrics reaching its timeout: the request to the proxied service was never closed and its whole response stayed in memory, which could end up in the appliance being OOM-killed (PR #10388)

  • [xo-server] Set the VM topology to 1 core per socket when a VM update attempts to apply a CPU static max configuration that is incompatible with the VM topology (PR #10398)

  • [OpenMetrics] Share metrics collection between requests to avoid filling up XOA memory (PR 10401)

  • [Netbox] Fix IP addresses synced with an incorrect, less specific prefix (e.g. /8 instead of /24) when a shorter container prefix also matched #10240 (PR #10297)

  • [Jobs] Running a sequence whose configured user was deleted now fails with a clear error instead of an obscure one, and saving a sequence now updates it to run as the saving user (PR #10423)

  • [Rolling pool update/reboot] VMs are brought back to the host they were running on more reliably, and a VM that cannot be moved back no longer fails the whole operation (PR #10295)

  • [Web-core] Fix "console offline" illustration sparks color (PR #10309)

  • [Web-core] Fix 404 illustration color (PR #10325)

  • [Web-core] Fix "no data" illustration stars color (PR #10327)

  • [V2V] Consolidating or removing the snapshots of a VM no longer fails with task execution failed after one minute: an operation is now given the time it needs (PR #10363)

  • [V2V] Fix a failure to read the snapshots of a VM silently transferring the whole disk instead of a delta (PR #10363)

  • [V2V] Fix a VM whose controller has no disk on its first slot being imported with a duplicated disk, or in full instead of a delta (PR #10363)

  • [V2V] Fix a second import, or the final pass of a warm migration, failing on a disk export server which had already been stopped (PR #10363)

  • [V2V] Fix xo-server stopping when nbdkit is not installed, or when the connection to the source host is lost during a migration (PR #10363)

  • [V2V] Listing the VMs of a host no longer fails entirely when one of them is incomplete, e.g. while being created (PR #10363)

  • [V2V] The credentials are no longer sent again on every read of a disk, and a session expiring during a long import is renewed (PR #10363)

  • [V2V] The session opened on the source host is now closed when a listing, a migration or a disk export ends, instead of piling up until it expires — a host only accepts a limited number of them (PR #10363)

  • [V2V] Report what the source host complained about, instead of task execution failed or an assertion error, when an operation fails (PR #10363)

  • [Plugin/perf-alert] Fix test plugin button (PR #10407)

  • [Plugin/perf-alert] Fix SR dead link (PR #10407)

  • [Host] Disable restart toolstack for HA enabled Pools (PR #10344)

  • [Audit] Fix actions made from XO 5 (/v5) being logged with 127.0.0.1 or ::1 as user IP address instead of the real IP address of the client (PR #10461)

  • [Network] Fix reactivity of PIF metrics (e.g. carrier) (PR #10438)

  • XO 5:

  • [Netdata] Fix You must enable Javascript error due to CSP blocking Netdata's inline scripts (PR #10275)

  • [tab-disks] VDI migration now shows all pool SRs for admins, even on VMs bound to a Resource Set Forum#107707 (PR #10422)

  • [MCP] Fix the MCP server crashing at startup on Node 26 with fetch failed, and make search_documentation honour HTTP_PROXY/HTTPS_PROXY/NO_PROXY like the other requests (PR #10413)

  • [OpenMetrics] A host whose IPMI controller does not answer no longer delays the /openmetrics/metrics response until Prometheus gives up with context deadline exceeded: power and XOSTOR metrics are served from the last collected values and refreshed in the background (PR #10409)

  • [VM/Console] Fix the page header and tab navigation disappearing permanently in the console tab (PR #10007)

  • [Backup/Restore] Fix listing backups sometimes mixing the results of two different VM listings (PR #10257)

  • [Backup/Restore] Better handling of a backup repository the proxy fails to list, instead of silently returning nothing (PR #10257)

  • [Backup] Fixed disk space not being freed during delta backup deletion (PR [#10273] (https://github.com/vatesfr/xen-orchestra/pull/10273))

  • [XO5/Hosts] Disable restart toolstack button for the hosts that belongs to a HA pools (PR #10340)

Released packages

  • @xen-orchestra/async-map 0.1.5
  • @vates/iscsi 0.2.0
  • @vates/nbd-client 3.6.0
  • @vates/node-vsphere-soap 2.2.0
  • @xen-orchestra/acl 1.7.0
  • @xen-orchestra/backup-archive 1.1.3
  • @xen-orchestra/qcow2 1.4.0
  • @xen-orchestra/cr-seed-cli 1.0.3
  • @xen-orchestra/mcp 1.4.3
  • @xen-orchestra/proxy-cli 0.3.4
  • xapi-explore-sr 0.4.8
  • xo-server-audit 0.15.3
  • xo-server-auth-ldap 0.10.12
  • xo-server-netbox 1.13.3
  • xo-server-openmetrics 1.9.3
  • xo-server-sdn-controller 1.5.1
  • vhd-lib 4.16.2
  • xo-server-perf-alert 1.1.2
  • xo-remote-parser 2.0.0
  • @xen-orchestra/fs 4.9.5
  • xen-api 5.0.1
  • @vates/types 2.3.0
  • @xen-orchestra/xapi 9.0.1
  • @xen-orchestra/backups 0.76.0
  • @xen-orchestra/backups-cli 1.1.16
  • @xen-orchestra/disk-cli 2.2.3
  • @xen-orchestra/immutable-backups 3.0.7
  • @xen-orchestra/web-core 0.63.0
  • @xen-orchestra/mixins 0.22.0
  • @xen-orchestra/proxy 0.33.0
  • @xen-orchestra/vmware-explorer 1.0.1
  • @xen-orchestra/qa-test 1.2.2
  • @xen-orchestra/rest-api 0.40.2
  • @xen-orchestra/web 0.63.0
  • xo-server 5.211.0
  • xo-web 5.206.0

6.8.2 (2026-09-04)

Channel: stable

Bug fixes

  • [Backups] Fix error fetch failed on backup with proxies (PR #10346)

Released packages

  • @xen-orchestra/proxy 0.31.10
  • xo-server 5.208.3

6.8.1 (2026-09-02)

Enhancements

  • [XO6/Traffic rules] Add possibility of editing a traffic rule (PR #10056)

Bug fixes

  • [Backups] Fix slow replication startup and fallback to full on qcow2 (PR #10319)

Released packages

  • @xen-orchestra/xapi 8.10.5
  • @xen-orchestra/backups 0.74.2
  • @xen-orchestra/proxy 0.31.9
  • xo-server 5.208.2

6.8.0 (2026-08-31)

Enhancements

  • [XO6/Pool] Add forget action on page Site (PR #10130)
  • [XO6/Host] Add possibility to shut down and start an host (PR #10088)
  • [XO6/Host] Add possibility to scan PIFs directly from the host (PR #10191)
  • [XO6/Host] Add possibility to forget a host (PR #10089)
  • [XO6/Host] Add possibility to disable a host an evacuate its VMs (PR #10090)
  • [XO6/Host] Add possibility to reboot a host (PR #10141)
  • [XO6/Host] Add possibility to force reboot a host (PR #10175)
  • [XO6/Host] Add possibility to smart reboot a host (PR #10177)
  • [XO6/Host] Add possibility to restart a host toolstack (PR #10178)
  • [XO6/Host] Add possibility to detach an host (PR #10179)
  • [XO6/VM] Add guest tools status on the VM Dashboard, VM System tab and VM Side panel (PR #10077)
  • [XO6/SR] Add dedicated Storage Repository page with general information, space usage, PBD details, custom fields (PR #10100)
  • [XO6/Backups] Add header title on backup job detail page (PR #10303)
  • [REST API] Add hosts/:id/actions/scan_pifs endpoint (PR #10187)
  • [Docs] Improve doc, rename titles, and refactor menu (PR #10212)
  • [Pool/Traffic rules] Add an error message and disable the ability to create a network-type traffic rule depending on the method used (PR #10202)
  • [IPMI-plugin] Add GET plugins/ipmi-sensors/hosts/{id}/ipmi to get IPMI sensors (PR #10003)
  • [VIF] Add VIF name in header on VIF detail page (PR #10252)
  • [XO5/Backups] Add Synchronize snapshots checkbox to backup jobs to get consistent restore points (PR #10136)
  • [XO5/New VM] Ability to add the VM to a resource set and to share it during creation (PR #10259)
  • [i18n] Add Arabic and update Czech, Dutch, Finnish, Portuguese (Brasil), Slovak and Swedish translations (PR #10181)

Bug fixes

  • [Backup/File restore, Backup/Health] An unreachable backup repository no longer slows down every listing: it is skipped after a delay and retried with an increasing backoff (PR #10205)
  • [REST API] Fix /users/:id/authentication_tokens sometimes did not return the token used to make the request (PR #10233)
  • [XO server] Fix a random behavior regarding coresPerSocket update (PR #10201)
  • [Warm migration] Fix Vm target of warm migration not found error at the end of a migration (PR #10210)
  • [XO6] Fix inconsistent spacing in side panel cards (PR #10279)
  • [VIF] Preserve other_config, rate limit, MTU and device when changing a VIF's MAC address (PR #10284)
  • [xo-server] Disconnect user stalling task result and using too much memory (PR #10237)
  • [sdn-controller] Fix update_traffic_rule keeping the previous port: newRule is a partial update and a field sent as null is now removed from the rule (PR #10307)
  • [Backup/NBD] Better behaviour with a stalled NBD client, and respect global export timeout (PR #10306)
  • [OpenMetrics] The Prometheus secret no longer changes on every xo-server restart: it is now generated once and saved in the plugin configuration (PR #10290)
  • XO 5:
    • [VM/Console] Fix the page header and tab navigation disappearing permanently in the console tab (PR #10007)
    • [Tasks] Show a task when a user is disconnected because its task flow is stalled (PR #10237)

Released packages

  • @xen-orchestra/async-map 0.1.4
  • xo-common 0.11.0
  • xen-api 4.9.0
  • @xen-orchestra/backups-cli 1.1.14
  • @xen-orchestra/disk-cli 2.2.1
  • @xen-orchestra/immutable-backups 3.0.5
  • @xen-orchestra/mixins 0.20.2
  • @xen-orchestra/proxy-cli 0.3.3
  • @xen-orchestra/qa-test 1.2.0
  • @xen-orchestra/upload-ova 0.1.9
  • xo-acl-resolver 0.5.4
  • xo-cli 0.32.4
  • xo-server-audit 0.15.2
  • xo-server-netbox 1.13.2
  • @vates/nbd-client 3.5.1
  • @xen-orchestra/acl 1.6.1
  • @xen-orchestra/backup-archive 1.1.2
  • @xen-orchestra/xapi 8.10.4
  • @xen-orchestra/backups 0.74.1
  • @xen-orchestra/web-core 0.60.0
  • @xen-orchestra/mcp 1.4.2
  • @xen-orchestra/proxy 0.31.8
  • @xen-orchestra/rest-api 0.39.0
  • xo-server-ipmi-sensors 2.1.1
  • xo-server-sdn-controller 1.5.0
  • xo-server-openmetrics 1.9.2
  • xo-web 5.203.0
  • @vates/types 2.0.1
  • @xen-orchestra/web 0.60.1
  • xo-server 5.208.1

6.7.1 (2026-08-04)

Bug fixes

  • [Backup/File restore] Downloading files as tgz through an XO Proxy works again: the archive was replaced by an invalid response, failing with invalid identifier: undefined instead of number or string (PR #10208)
  • [Immutable backups] Backups are protected again on file servers whose system language is not English: immutability was silently not applied at all on those (PR #10182)
  • [Immutable backups] Release disks that stayed immutable forever after their metadata was deleted by the retention, or after a merge renamed them, which prevented any further merge or deletion of that disk's backups (PR #10182)
  • [Plugins/load balancer] No longer try to migrate VMs to disabled host (PR #10209)
  • [V2V] Improve performance on big VM (>3 To) imports by improving Nbd disk handling (PR #10157)
  • [Import/VMware] Fix migration of a VM having 10 snapshots or more, or a snapshot with 10 disks or more: the extra snapshots and disks were silently ignored (PR #10194)
  • [Import/VMware] Fix migration of a running VM with "Stop the source VM" enabled and no pre-existing snapshot: the data written since the snapshot taken by XO was not transferred, and the second transfer reported Nothing to import in this chain (PR #10194)

Released packages

  • @vates/nbd-client 3.5.0
  • @xen-orchestra/backups 0.73.10
  • @xen-orchestra/immutable-backups 3.0.4
  • @xen-orchestra/proxy 0.31.6
  • @xen-orchestra/vmware-explorer 0.15.0
  • @xen-orchestra/qa-test 1.1.1
  • xo-server 5.207.2
  • xo-server-load-balancer 0.13.1

6.7.0 (2026-07-30)

Security

  • [XO server] Permissions were ignored for some pool functions (#10093)
  • [Users/Create] Removed default user's password from the logs during account creation (PR #10094)
  • [Security] Serve a default Content-Security-Policy to mitigate cross-site scripting and related attacks. It can be extended or disabled through the http.helmet configuration (PR #10101)

Enhancements

  • [REST API] Possibility of sending autoEnable in the body of the /hosts/:id/actions/disable endpoint (PR #10040)

  • [REST API] PATCH /rest/v0/vdis/{id} to update a VDI's name, description and size (PR #9945)

  • [REST API] Possibility to set the HA restart priority (high_availability) when creating a VM (PR #10070)

  • [REST API] Expose /rest/v0/acl-roles/:id/users (PR #10085)

  • [REST API] Expose /rest/v0/acl-roles/:id/groups (PR #10085)

  • [REST API] Expose /rest/v0/groups/:id/acl-roles (PR #10085)

  • [REST API] Add POST /srs REST route to create a storage repository (PR #9990)

  • [REST API] Possibility of sending shutdownPinnedVms in the body of the /pools/:id/actions/rolling_update and rolling_reboot endpoints (PR #10125)

  • RBAC check for REST API endpoints:

    • /pools/:id/actions/create_bonded_network (PR #9891)
    • /pools/:id/actions/create_internal_network (PR #9891)
    • /pools/:id/actions/management-reconfigure (PR #9891)

  • [XO/Pool] XO now reconnects to a surviving pool member when the master becomes unreachable (e.g. HA promoted a new master after the old one died), instead of staying stuck on the dead master, including after an XO restart (PR #10016)

  • [RPU] Trace rolling pool updates/reboots to disk to allow diagnosis even after xo-server restarts (PR #10078)

  • [RPU/RPR] Re-check that each host can still be evacuated right before evacuating it, to fail early with an explicit error (PR #10097)

  • [RPU/RPR] New shutdownPinnedVms option: VMs that cannot be migrated because they use a host-bound device (PCI passthrough, vGPU, SR-IOV VIF) are cleanly shut down before their host reboots and started again on it afterwards, instead of aborting the whole run. When such VMs block the run, XO now lists them and asks for confirmation instead of failing with a raw CANNOT_EVACUATE_HOST error (PR #10125)

  • [RPU] Re-enable the load balancer after a configurable safe delay (30 minutes by default) when a rolling pool update ends (PR #10111)

  • [vm stats] Reduce the memory consumption of the rrd stats (PR #10039)

  • [XO5/Hub] Recipes are now available to all plans, not just Premium (PR #10117)

  • [XO5/Hub] Kubernetes cluster recipe no longer requires the XOA plugin to work (PR #10127)

  • [i18n] Update Czech, Dutch, German, Korean, Portuguese and Slovak translations (PR #10033)

  • [XO6] Fix some design inconsistency between pages (PR #10109)

  • [XO6] Input fields now support prefix/suffix sections, and display validation messages ordered by severity (PR #10009)

  • [XO6] Add copy all button for IP list and bond device (PR #10081)

  • [Treeview] Fix hosts alignment in Treeview when hosts have different numbers of VMs (PR #10153)

  • [Users] Add Users Table (PR #10029)

  • [Site] Add "New VM" and "Connect pool" actions to the site infrastructure tree (PR #10047)

  • [Site] Add "Connect pool" action to the site infrastructure tree (PR #10047)

  • [Pool] Add new VM and disconnect actions to the pool infrastructure tree (PR #10046)

  • [Pool] Add connect/disconnect action on page Site (PR #10075)

  • [Host] Add possibilty to enable or disable an host (PR #10074)

  • [VM] Add possibility to duplicate a VM (PR #9580)

  • [VM] Group VM power actions in a new "Change state" submenu and isolate the Delete action (PR #10036)

  • [VM] Add possibility to export a VM (PR #9989)

  • [VM] Add "New VM" button on Host view (PR #10048)

  • [New VM] Add the possibility to set the HA restart priority when creating a VM (PR #10072)

  • [VIF] Add possibility to create VIF from network tab in VM page (PR #9677)

  • [Tasks] Resolve objects in tasks names Forum#100894 (PR #9830)

  • [Traffic rules] Show only traffic rules of VMs. Don't include vm-snapshots or vm-templates. In the VM selector, disable VMs that don't have any VIF (PR #9977)

  • [OpenMetrics] Add an estimated per-VM power consumption metric (xcp_vm_power_consumption_watts), splitting each host's IPMI power across its running VMs proportionally to CPU load (PR #10031)

  • [OpenMetrics] Add content_type to SR capacity metrics and the full sr_uuid to host disk metrics for easier Grafana correlation (PR #10149)

  • [XO server] expose more metrics when doing a memory dump (PR #10041)

  • [XO server] Add aclRoleIds property to the group objects (PR #10085)

  • [XO server] Add groupIds, userIds and privilegeIds properties to the acl-role objects (PR #10085)

  • [Backups] Show reason when delta backup falls back to a full (PR #10148)

Bug fixes

  • [XO6] Fix negative "other" value in backup repository dashboard (PR #10044)
  • [XO6] Fix the VM's VDI tab, which always displays an empty list on initial load (PR #10156)
  • [XO6] Fix the VM's VDI tab, which sometimes displays an error (PR #10156)
  • [XO6] Reduce the number of HTTP requests when navigating between pages (PR #10156)
  • [Host] Wrap the Network name in the PIF side panel (PR #10155)
  • [Host/dashboard] Switch CPU and RAM panels order to match Pool dashboard layout (PR #10059)
  • [RPU/RPR] Temporarily disable VMs auto power on during the run: unexpected VM starts on rebooted hosts could break the remaining host evacuations (HOST_NOT_ENOUGH_FREE_MEMORY) (PR #10104)
  • [RPU] Fix "Updating LINSTOR packages" subtask progress going over 100% (PR #10122)
  • [RPU] Fix The updater plugin is busy error making the update fail right after the "Updating LINSTOR packages" step (PR #10115)
  • [Plugins/Perf-alert] Update URL generation to support V6 routing (PR #10054)
  • [Backup/Remotes] Listing backup repositories is no longer slowed down by an unreachable one: a broken repository is now served from cache and retried in the background instead of timing out on every refresh (PR #10025)
  • [Backups] Fix EEXIST issue when recreating backup in VhdDirectory after crash (PR #10139)
  • [Backups] Fix failed status on successful retry Forum#12366 (PR #10129)
  • [Backups] Fix missing transfer size (PR #10106)
  • [Backups] write the complete disk metadata at once to improve compatibility with immutable backup repository (PR #10104)
  • [Backup] Fix unexpected number of entries in backup cache warning not resolving automatically (PR #10132)
  • [Backups] Fix qcow2 transfer without NBD (PR #10164)
  • [Backups] Force a full backup if any suspect is detected on qcow2 without nbd (PR #10164)
  • [Backups] Force a full replication if any suspect is detected on qcow2 without nbd (PR #10164)
  • [Backups] Fix aggregated backup failing instead of falling back to a full backup (PR #10164)
  • [Backups] Don't hide errors during transfers (PR #10183)
  • [Host] Successful evacuation signature fallbacks on older XAPI versions are no longer logged as warnings (PR #10131)
  • [XO5/About/Hub] Fix "Failed to fetch latest master commit" and the microk8s version list: the default Content-Security-Policy now allows the browser to reach the GitHub API (PR #10162)
  • [Qcow2 import] show a valid progress bar for qcow2 disk import from form , command line or V2V (PR #10133)
  • [Smart reboot] Fix suspendBlocked error when no issue to suspend resident VMs (PR #10180)
  • [Remotes/S3] Fix slow deletions on S3 providers rejecting our batch deletion request with a MalformedXML error (e.g. Ceph RadosGW) (PR #10189)

Released packages

  • vhd-lib 4.16.1
  • xen-api 4.8.0
  • @xen-orchestra/acl 1.5.0
  • @xen-orchestra/disk-cli 2.2.0
  • xapi-explore-sr 0.4.7
  • xo-server-perf-alert 1.1.1
  • @xen-orchestra/fs 4.9.3
  • @xen-orchestra/disk-transform 1.3.3
  • @xen-orchestra/backup-archive 1.1.1
  • @xen-orchestra/backups 0.73.9
  • @xen-orchestra/web-core 0.58.0
  • @xen-orchestra/rest-api 0.37.0
  • xo-server-openmetrics 1.9.0
  • xo-web 5.201.0
  • @vates/types 1.30.1
  • @xen-orchestra/xapi 8.10.2
  • @xen-orchestra/proxy 0.31.5
  • @xen-orchestra/web 0.57.1
  • xo-server 5.207.1

6.6.2 (2026-07-09)

Bug fixes

  • [Backups] Fix alignment issue in full mirror with disk > 50GB from non encrypted to encrypted remote (PR #10061)
  • [Backups] Add length to throttled stream during transfer size (PR #10079)
  • [Backups] Remove warning "Issue while checking XVA" when Backup Repository is encrypted (PR #10079)

Released packages

  • @xen-orchestra/fs 4.9.2
  • @xen-orchestra/backup-archive 1.0.4
  • @xen-orchestra/backups 0.73.7
  • @xen-orchestra/proxy 0.31.2
  • xo-server 5.205.2

6.6.1 (2026-07-08)

Enhancements

  • [vm stats] Reduce the memory consumption of the rrd stats (PR #10039)

Bug fixes

  • [VDI] Fix progress bar appearing half-filled when used space is at 100% Forum#100200 (PR #10027)
  • [Backups] Improve resume of backup merge failure for VHD files (PR #10053)

Released packages

  • @xen-orchestra/backup-archive 1.0.3
  • @xen-orchestra/backups 0.73.6
  • @xen-orchestra/proxy 0.31.1
  • @xen-orchestra/web 0.55.2
  • xo-server 5.205.1

6.6.0 (2026-06-30)

Enhancements

  • [load-balancer] VM migrations triggered by the load balancer can now be monitored with tasks (PR #9909)

  • [IPMI-Plugin] Add default outlet regex to the dell preset (PR #9884)

  • [REST API] Expose POST /backup-repositories and PATCH /backup-repositories/:id REST routes (PR #9852)

  • [REST API] Expose POST /backup-repositories/:id/actions/forget REST route (PR [#9846] (https://github.com/vatesfr/xen-orchestra/pull/9846))

  • [REST API] add hosts/:id/actions/join_pool REST route (PR #9876)

  • [REST API] Ask for user credentials for unauthenticated users (PR #9938)

  • [REST API] PATCH /rest/v0/vifs/{id} to update VIF properties (allowed IPs, locking mode, rate limit, TX checksumming) (PR #9935)

  • [REST API] Expose GET /backup-repositories/:id/health and POST /backup-repositories/:id/actions/benchmark routes (PR #9847)

  • [REST API] Added start, clean_shutdown, clean_reboot, smart_reboot, restart_toolstack, emergency_shutdown, detach and forget REST action route for hosts (PR #9887)

  • [REST API/RBAC] Add a built-in Network administrator role template: manage networks and VIFs, read and update PIFs (PR #9952)

  • [REST API/RBAC] Add a built-in Storage administrator ACL role template to administer SRs, VDIs, VBDs, PBDs and backup repositories (PR #9963)

  • [SDN Controller] Replace xapi.objects.all with specified object types to avoid filtering through all objects each time (PR #9886)

  • [XO6] live update XO tasks (PR #9901)

  • [XO6/Backup] add progress for backups tasks(PR #9901)

  • [XO6/Traffic Rules] add colors for tags in policy column (PR #9979)

  • [XO6/Traffic rules] add possibility to delete a traffic rule (PR #9956)

  • [XO6/VM] add available actions on VMs tab (PR #10030)

  • [XO6/VDI] add possibility to migrate VDI on SR (PR #9973)

  • [XO6/VDI] Add a dedicated page to view a VDI's general information, configuration and space usage with detach/delete actions (PR #9949)

  • [XO6/VDI] Update actions name to be more consistent (PR #9968)

  • [XO6/VDI] Add the possibility to export VDI from detail screen of a VM (PR #9983)

  • [XO6] Add an Administration tab in the sidebar with a user management menu (PR #9947)

  • [XO6] After deleting a VM or VIF, users are now redirected to the parent list instead of seeing a 404 page (PR #9984)

  • [VM/Network] Add VIF column to table (PR #9959)

  • [VM/System] Updated VM Resource management card to display vCPU at startup and Maximum vCPUs instead of minimum/maximum CPU limit (PR #9950)

  • [Pool/System] Add Reboot VM on internal shutdown in pool's system tab (PR #9962)

  • [Netbox] Support Netbox v4.6.x #9818 (PR #9939)

  • [Netbox] Add option to ignore RFC 1918 private IPs during synchronization. Thanks @sboyd-m! (PR #6306)

  • [Icons] Updated connect/disconnect icons to use a plug icon (PR #9942)

  • [Modal] Updated modal windows with a border and unified backgound color for better readability (PR #9825)

  • [SR] Storage repositories can now be deleted from the Pool/Host Storage tab (PR #9853)

  • [SR] Storage repositories can now be disconnected from the Pool/Host Storage tab (PR #9856)

  • [SR] Storage repositories can now be connected from the Pool/Host Storage tab (PR #9877)

  • [RBAC] Add Administrator template role (PR #9885)

  • [Dashboard] Fix StateHero component's behavior on mobile to force vertical variant on mobile (PR #9363)

  • [Core] Remove all icons from table headers (PR #9943)

  • [i18n] Update Chinese (Simplified Han script), Czech, Danish, Dutch, German, Korean, Norwegian, Slovak, Spanish and Swedish translations (PRs #9914 and #9998)

  • [OpenMetrics] Include XO tags as a tags label on host, VM and SR metrics #9628 (PR #9971)

  • [Web stack] Updated side panels (PR #9836)

  • [Plugin/LDAP] Add failover URIs (PR #9961)

  • [V2V] Add esxi.importDisk API endpoint to import a single ESXi disk into an SR as a standalone VDI ( [PR#10024] (https://github.com/vatesfr/xen-orchestra/pull/10024))

  • [V2V] Create a CDROM on destination if source has one (PR #10014)

  • [XO5/V2V] Show if the transfer will be a full or a delta one when doing 2 steps V2V transfer (PR #10014)

  • [XO5/XOA] Ability to take snapshot before installing upgrades (PR #9920)

  • [SidePanels] Add and use new VtsCardObjectTitle component to display object title and ID in side panels (PR #9755)

  • [sdn-controller] Add POST /rest/v0/plugins/sdn-controller/networks/:id/actions/update_traffic_rule and POST /rest/v0/plugins/sdn-controller/vifs/:id/actions/update_traffic_rule (PR #9936)

  • [Dependabot] Update packages and sync package.json with yarn.lock (PR #9969)

    • update shell-quote to 1.8.4:
      • xo-web aka XO 5 (only in dev dependencies for watchify)
      • @xen-orchestra/lite (only in dev dependencies for npm-run-all)
    • vue-router fixed to 5.0.6 (@babel/generator@^8.0.0-rc.4 in 5.0.7)
    • update packages to sync with yarn.lock (e.g. client-s3 package)

  • RBAC check for REST API endpoints:

    • POST /vbds (PR #9904)
    • DELETE /vbds/:id (PR #9904)
    • POST vbds/:id/actions/connect (PR #9904)
    • POST vbds/:id/actions/disconnect (PR #9904)
    • POST /vifs (PR #9889)
    • DELETE /vifs/:id (PR #9889)
    • POST /vifs/:id/actions/connect (PR #9889)
    • POST /vifs/:id/actions/disconnect (PR #9889)
    • POST /srs/:id/actions/reclaim_space (PR #9896)
    • POST /srs/:id/actions/scan (PR #9896)
    • POST /srs/:id/actions/forget (PR #9896)
    • POST /pbds/:id/actions/plug (PR #9888)
    • POST /pbds/:id/actions/unplug (PR #9888)
    • GET /vdi-snapshots/{id}.{format} (PR #9906)
    • GET /vdi-snapshots/{id} (PR #9906)
    • DELETE /vdi-snapshots/{id} (PR #9906)
    • PUT /vdi-snapshots/{id}/tags/{tag} (PR #9906)
    • DELETE /vdi-snapshots/{id}/tags/{tag} (PR #9906)/vdi-snapshots/{id}.{format}` (PR #9906)
    • POST /vdis (PR #9908)
    • /vdis/:id/actions/migrate (PR #9908)
    • /vms/:id/actions/clone (PR #9910)
    • /vms/:id/actions/migrate (PR #9910)

Bug fixes

  • [Qcow2] Fix initialization Map range error for big (>1 TB) Qcow2 disks (PR #9940)
  • [Backups] Avoid warning during clean phase with already deleted aliases (PR #9996)
  • [Backups] Remove now useless warnign if folders are orphaned from old jobs (PR #9958)
  • [Backups] Fixed "Cannot read properties of undefined" issues (PR #9944)
  • [Backups] Fix failed VM not appearing in the logs (PR #10021)
  • [Backup/Restore] Fix file-level restore of VMs whose disks use LVM (e.g. the default Ubuntu install layout): logical volumes are now listed and can be restored, including when restoring several copies of the same VM at once — previously failed with unknown filesystem type 'LVM2_member' (PR #9776)
  • [Backup/Restore] Fix file-level restore hanging when downloading large folders, and high memory use when downloading a folder as a zip (PR #9776)
  • [Backups/replication] Fix error MEMORY_CONSTRAINT_VIOLATION_ORDER during replication (PR #10034)
  • [V2V] Fix stream issue for large disks used with smaller blocks (PR #9948)
  • [V2V] Fix migration when template memory_static_min is it's less than actual vm memory (PR #10014)
  • xo-server-sdn-controller: apply/clean network rules on VIF update (PR #9933)
  • [REST API] Fix possibly unhandled rejection invalid crendentials (PR #9938)
  • [REST API] GET /vms/:id.:format, GET /vm-templates/:id.:format, GET /vm-snapshots/:id.:format now correctly support explicit compress query param (zstd | gzip). Still support true | false as deprecated value (PR #9960)
  • [REST API/VM/dashboard] Fix detection of the last VM replication (PR #9991)
  • [REST API/dashboard] Job sequences are now correctly taken into account when calculating VM protection (PR #9997)
  • [X05/Jobs] fix array values being incorrectly handled (used for instance on job.runSequence) (PR #9928)
  • [Site/Dashboard] Rename no job to no active job in the VMs protection card (PR #10013)
  • [XO6/Tree/Web-core] Infrastructure tree is now streamed and rendered as a single virtualized list, fix some performance issues on medium and big infrastructures (PR #9986)
  • [Encryption] Improve missing xen-tools handling and logs (PR #9987)
  • [xo-server] Fix memory leak on failed http query (XS update for example) (PR #10026)
  • [XO-Server] Force stop when in dev mode (PR #9994)
  • [XO-Server] Log a xo-server waiting for a soft stop in background (PR #9994)
  • [Backup-repository] Properly unmount and cut connection on stop/disconnect/forget (PR #9994)
  • [xo-proxy] Fix invalid parameters error message in listVmBackups (XS update for example) (PR #10035)
  • [Web-core] Fix the required asterisk disappeared as soon as the dropdown was opened (PR #10032)

Released packages

  • @xen-orchestra/fs 4.9.1
  • @vates/generator-toolbox 1.1.3
  • @xen-orchestra/disk-transform 1.3.1
  • @vates/fuse-vhd 2.1.3
  • xo-common 0.10.0
  • xen-api 4.7.8
  • @xen-orchestra/backup-archive 1.0.2
  • @xen-orchestra/qcow2 1.3.1
  • @xen-orchestra/xapi 8.9.0
  • @xen-orchestra/disk-cli 2.1.2
  • @xen-orchestra/mcp 1.4.1
  • @xen-orchestra/mixins 0.20.1
  • @xen-orchestra/openflow 0.1.4
  • @xen-orchestra/qa-test 1.1.0
  • @xen-orchestra/upload-ova 0.1.8
  • xo-acl-resolver 0.5.3
  • xo-server-audit 0.15.1
  • xo-server-ipmi-sensors 2.0.1
  • xo-server-load-balancer 0.13.0
  • xo-server-openmetrics 1.7.0
  • @xen-orchestra/web-core 0.56.0
  • @xen-orchestra/vmware-explorer 0.14.0
  • xo-server-netbox 1.13.1
  • xo-web 5.199.0
  • @vates/types 1.28.0
  • @xen-orchestra/acl 1.4.0
  • @xen-orchestra/backups 0.73.5
  • @xen-orchestra/proxy 0.31.0
  • @xen-orchestra/rest-api 0.35.0
  • @xen-orchestra/web 0.55.1
  • xo-server 5.205.0
  • xo-server-sdn-controller 1.4.0

6.5.1 (2026-06-01)

Bug fixes

  • [Backup] fix transfer size only counting the last disk transferred (PR #9900)
  • [Backup] fix backup cleanup removing too many files when listing fails (PR #9925)

Released packages

  • @xen-orchestra/backup-archive 1.0.1
  • @xen-orchestra/backups 0.73.2
  • @xen-orchestra/proxy 0.30.3
  • @xen-orchestra/vmware-explorer 0.13.1
  • @xen-orchestra/xva 1.0.3
  • xo-server 5.202.2

6.5.0 (2026-05-28)

Security

  • [XO 5] Update sanitize-html dependency (Dependabot alert 484) (PR #9851)
  • [MCP] Global kill-switch: set [mcp] enabled = false in xo-server config to immediately reject every MCP client connection (PR #9860)

Enhancements

  • [xo-server] support qcow2 format in disk.importContent and disk.import jsonRPC api (PR #9817)

  • [web-core] Update UiTag and parse tag for detecting tags with = (PR #9811)

  • [Encryption] Implement encryption and decryption feature for redis (PR #9735)

  • [xo-server-ipmi-sensors] Migrated the old ipmi feature to a new plugin and added user defined sensors (PR #9724)

  • [MCP] Read HTTP_PROXY/HTTPS_PROXY/NO_PROXY so an internal XOA stays reachable when the AI assistant goes through a corporate proxy (PR #9820)

  • [MCP] Restrict which REST endpoints the AI assistant can reach: read-only endpoints are exposed by default, write actions require XO_MCP_ENABLE_ACTIONS=1 with a confirmation step, and binary/stream endpoints stay hidden (PR #9875)

  • [REST API] Expose DELETE /rest/v0/srs/:id (PR #9464)

  • [REST API] Add vms/:id/actions/revert_snapshot REST route (PR #9788)

  • [REST API] Add PATCH /vms/{id} to partially update a VM (PR #9835)

  • [Swagger] Rename the acls tag to rbacs (PR #9874)

  • [OpenMetrics] Add XOSTOR metrics (cluster status, replica health, SMART, alarms, pending updates) and an sr_type label on SR-tagged metrics so Grafana can filter by storage type (PR #9849)

  • [VM/Snapshot] Add possibility to revert a snapshot on a VM (PR #9862)

  • [VM] Add possibility to attach a VDI on tab VDI (PR #9772)

  • [VM] Add possibility to create a VDI on tab VDI (PR #9848)

  • [Pool/Security] Implement possibility to add new traffic rule from pool (PR #9809)

  • [VIF] Implement possibility to add new traffic rule from VIF (PR #9837)

  • [VIF] Add a new "General" tab to the VIF page (PR #9831)

  • [i18n] Update Chinese (Simplified Han script), Czech, Dutch, German, Korean, Slovak, Spanish and Swedish translations (PR #9780)

  • Backups:

    • [Backups] Refactor clean phase for incremental and full backups (#9765)
    • [Backups] bidirectional replication, reuse snapshot when possible (PR #9806)
    • [Backups/fs] Add UserAgent in s3 client (PR #9815)

  • RBAC check for REST API endpoints:

    • /hosts/:id/actions/disable (PR #9840)
    • /hosts/:id/actions/enable (PR #9840)
    • /hosts/:id/actions/management_reconfigure (PR #9840)
    • Added VMS_ADMINISTRATOR role template (PR #9845)

  • XO 5:

    • [Export config] Hide passphrase by default (PR #9824)
    • [xo-web] support qcow2 format in disk > import (PR #9817)

  • [XO config] Rename exported XO config file from config.json to XO-config_<date>.json (PR #9859)

Bug fixes

  • [REST API] Fixed ignored parameters in request body due to a tsoa bug (see https://github.com/lukeautry/tsoa/pull/1858) (PR #9793)
  • [REST API] POST /vdis no longer necessarily requires other_config (PR #9883)
  • [Tasks] Fixed issue with task without result and backup runs on task size (PR #9841)
  • [Backup] Fix OUT_OF_RANGE error when resuming failed merge (PR #9782)
  • [xo-server] Fix network being put first in boot order when HVM template has VDIs (PR #9867)
  • [xo-server] Fix TLS memory leak (PR #9842)
  • XO 5:
    • [Job] Error while using vm.set with cpuMask in job view (PR #9823)
    • [Dashboard/Health] Ignore the replicated VM when checking the number of snapshots (PR #9868)

Released packages

  • @xen-orchestra/fs 4.9.0
  • @xen-orchestra/disk-transform 1.3.0
  • @xen-orchestra/backup-archive 1.0.0
  • @xen-orchestra/xapi 8.8.0
  • @xen-orchestra/backups 0.73.1
  • @xen-orchestra/backups-cli 1.1.13
  • @xen-orchestra/disk-cli 2.1.1
  • @xen-orchestra/immutable-backups 3.0.3
  • @xen-orchestra/proxy 0.30.2
  • xo-server-ipmi-sensors 2.0.0
  • @xen-orchestra/mcp 1.4.0
  • @xen-orchestra/qa-test 1.0.1
  • xo-server-openmetrics 1.6.0
  • xo-web 5.197.1
  • @vates/http-server-plus 2.0.2
  • @vates/types 1.26.0
  • @xen-orchestra/acl 1.2.0
  • @xen-orchestra/web-core 0.54.0
  • @xen-orchestra/rest-api 0.33.0
  • @xen-orchestra/web 0.53.0
  • xo-server 5.202.1

6.4.1 (2026-05-05)

Enhancements

Bug fixes

  • [immutable backups] Fix error while locking vhd files (PR #9767)
  • [REST API] Fix REST API not available for clients with plan < Enterprise (PR #9798)

Released packages

  • @xen-orchestra/immutable-backups 3.0.1
  • @xen-orchestra/web-core 0.52.0
  • @xen-orchestra/rest-api 0.30.1
  • @xen-orchestra/web 0.50.0
  • xo-server 5.200.1
  • xo-server-sdn-controller 1.3.2

6.4.0 (2026-04-29)

Security

  • [@vates/node-vsphere-soap] Update axios, follow-redirects (transitive) (PR #9640)
  • [@xen-orchestra/backups] Update tar (PR #9640)
  • [@xen-orchestra/fs] Update fast-xml-parser (transitive) (PR #9640)
  • [@xen-orchestra/lite] Update lodash-es, vite, rollup (transitive), postcss (transitive) (PR #9640)
  • [@xen-orchestra/mcp] Update hono (transitive), @hono/node-server (transitive), express-rate-limit (transitive) (PR #9640)
  • [@xen-orchestra/mixins] Update node-forge (transitive) (PR #9640)
  • [@xen-orchestra/proxy] Update koa (PR #9640)
  • [@xen-orchestra/rest-api] Update @hapi/content (transitive), path-to-regexp (transitive) (PR #9640)
  • [@xen-orchestra/vmware-explorer] Update undici (PR #9640)
  • [@xen-orchestra/web] Update lodash-es, vite (PR #9640)
  • [@xen-orchestra/web-core] Update lodash-es (PR #9640)
  • [Packages] Update lodash, picomatch (transitive), minimatch (transitive), ajv (transitive), bn.js (transitive) (PR #9640)
  • [xen-api] Update undici, basic-ftp (transitive) (PR #9640)
  • [xo-server] Update fast-xml-parser, pug (PR #9640)
  • [xo-server-auth-saml] Update @xmldom/xmldom (transitive) (PR #9640)
  • [xo-web] Update immutable, pug (transitive), postcss (transitive) (PR #9640)

Enhancements

  • [Backups] Backups no longer use their own task system, but instead use the same system as XO Task. This will help improve loading times in the future (PR #9734)
  • [Backups] Add merged size in cleanVm task log (PR #9679)
  • [OpenMetrics] Add per-VDI disk size metrics: xcp_vdi_virtual_size_bytes and xcp_vdi_physical_usage_bytes (PR #9680)
  • [OpenMetrics] Add 9 missing host RRD metrics: hostload, memory_reclaimed, memory_reclaimed_max, running_vcpus, pif_aggr_rx, pif_aggr_tx, iops_total, io_throughput_total, latency per SR (PR #9696)
  • [OpenMetrics] Add VM status (xcp_vm_status) and VM uptime (xcp_vm_uptime_seconds) metrics #9684
  • [OpenMetrics] Add per-VDI disk size metrics: xcp_vdi_virtual_size_bytes and xcp_vdi_physical_usage_bytes #9680
  • [i18n] Update Chinese (Simplified Han script), Czech, Danish, Dutch, Finnish, German, Italian, Korean, Norwegian, Persian, Polish, Portuguese, Portuguese (Brasil), Russian, Slovak, Spanish and Swedish translations (PRs #9649 and #9729)
  • [Netbox] Use platform hierarchy to assign versioned OS names (e.g. "Debian 12" instead of "Debian") when the major version is known (requires Netbox >= 4.4) #7773 (PR #9644)
  • [REST API] Fix the href property in collection responses when the request URL has a trailing slash. (PR #9741)
  • [REST API] Expose POST /vifs/:id/actions/connect and POST /vifs/:id/actions/disconnect (PR #9643)
  • [REST API] ACL V2 integration (PR #9774)
  • [REST API] Add POST rest/v0/plugins/sdn-controller/networks/:id/actions/add_traffic_rule and POST rest/v0/plugins/sdn-controller/networks/:id/actions/delete_traffic_rule endpoints (#9418)
  • [REST API] Add POST rest/v0/plugins/sdn-controller/vifs/:id/actions/add_traffic_rule and POST rest/v0/plugins/sdn-controller/vifs/:id/actions/delete_traffic_rule endpoints (#9759)
  • [VM] Add possibility to remove a VIF on network tab (PR #9601)
  • [VM] Add possibility to remove a VDI on VDI tab (PR #9689)
  • [VM] Add possibility to remove a VBD on VDI tab (PR #9698)
  • [VM] Add possibility to remove a snapshot on snapshot tab (PR #9749)
  • [VM] Add possibility to connect or disconnect a VIF on network tab (PR #9756)
  • [VM] Add possibility to connect or disconnect a VBD on VDI tab (PR #9726)
  • [VM/new] Removed new VM form alert (PR #9757)
  • [VDI] Add chainPhysicalUsage to have a proper usage linked to the complete chain (PR #9708)
  • [Pool] Add new Network creation forms (normal, Bonded and Internal) (PR #9629)
  • [Pool/Hosts] Management IP is now always shown first and the IP column is renamed to "Management IP" (PR #9747)
  • [Pool/Security] Implement security tab to display traffic rules from VIF and Network (PR #9770)
  • [MCP] Add ?markdown=true output format to REST API and simplify MCP tools with declarative registry (PR #9624)
  • [MCP] Add ?markdown=true output format to REST API and simplify MCP tools with declarative registry (PR #9624)
  • [MCP] Generate tools dynamically from the XO OpenAPI spec at startup: one {domain}_query tool per resource domain instead of a fixed tool per endpoint. Stats endpoints are excluded. Write operations can be opted in with XO_MCP_ENABLE_ACTIONS=1, with one-shot confirmation tokens for destructive calls. (PR #9641)
  • [Pool/Network] Add Network deletion (PR #9714)
  • [DNS] add Let's Encrypt DNS-01 challenge support (PR #9592)
  • XO 5:
    • [Settings/Servers] Add info tip to remind users to only add pool masters (PR #9742)

Bug fixes

  • [Header] Fix Unable to connect to XO server falshing every 30 secondes (PR #9681)
  • [Backups] Fix regression on cleanVM speed (PR #9692)
  • [Backups] Fix cleanVm incorrect backup size in metadata (PR [#9637] (https://github.com/vatesfr/xen-orchestra/pull/9637))
  • [Backups] Fix diskless snapshot retention (PR #9758)
  • [xo-server] Fix memory leak with secure session (PR #9725)
  • [xo-server] Fix VM-template still visible after deletion (PR #9760)
  • [REST API] Fix memory leak on SSE (PR #9707)
  • [REST API] Fix other_config being ignored when creating a new VDI with POST /rest/v0/vdis (PR #9695)
  • [VM/Host Console] Fix periodic VNC reconnection causing keyboard focus loss (PR #9727)
  • XO 5:
    • [VM/Copy]: Fix compression not used when copying a VM to another pool (PR #9699)
    • [Icons] Fix display of RHEL 10 icons in vm list (PR #9766)
    • [xo-server-sdn-controller] Better traffic-rules synchronization related to VM lifecycle (PR #9518)

Released packages

  • @vates/async-each 1.0.3
  • @xen-orchestra/async-map 0.1.3
  • @xen-orchestra/log 0.7.2
  • xo-remote-parser 0.10.1
  • @xen-orchestra/fs 4.8.0
  • @vates/generator-toolbox 1.1.2
  • @xen-orchestra/disk-transform 1.2.3
  • vhd-lib 4.16.0
  • @vates/http-server-plus 2.0.0
  • xo-collection 0.6.1
  • xo-common 0.9.1
  • xen-api 4.7.7
  • @vates/nbd-client 3.4.0
  • @vates/node-vsphere-soap 2.1.3
  • @vates/task 0.7.0
  • @xen-orchestra/qcow2 1.3.0
  • @xen-orchestra/template 0.1.1
  • @xen-orchestra/xapi 8.7.2
  • @xen-orchestra/backups-cli 1.1.11
  • @xen-orchestra/cron 1.0.7
  • @xen-orchestra/disk-cli 2.0.0
  • @xen-orchestra/immutable-backups 3.0.0
  • complex-matcher 1.1.1
  • @xen-orchestra/mcp 1.2.0
  • @xen-orchestra/mixin 0.2.1
  • xo-lib 0.11.2
  • xo-vmdk-to-vhd 2.5.10
  • @xen-orchestra/upload-ova 0.1.7
  • @xen-orchestra/vmware-explorer 0.13.0
  • vhd-cli 1.1.2
  • xapi-explore-sr 0.4.6
  • xo-cli 0.32.3
  • xo-server-backup-reports 1.7.1
  • xo-server-load-balancer 0.12.1
  • xo-server-netbox 1.12.0
  • xo-server-openmetrics 1.5.0
  • xo-server-usage-report 0.11.1
  • xo-web 5.196.0
  • @vates/types 1.24.0
  • @xen-orchestra/acl 1.0.0
  • @xen-orchestra/backups 0.72.1
  • @xen-orchestra/web-core 0.51.0
  • @xen-orchestra/mixins 0.20.0
  • @xen-orchestra/proxy 0.30.1
  • @xen-orchestra/rest-api 0.30.0
  • xo-server 5.200.0
  • @xen-orchestra/web 0.49.0
  • xo-server-sdn-controller 1.3.1

6.3.3 (2026-04-14)

Bug fixes

  • [Header]: Fix Unable to connect to XO server falshing every 30 secondes (PR #9681)
  • [Backups]: Fix regression on cleanVM speed (PR #9692)
  • [Backups]: Fix merge resume when child is disk chain (PR #9668)
  • [Incremental Replication]: Fix "Storage_error ([S(Illegal_transition);S(Activated);S(RO)];[S(Activated);S(RW)])" Forum#12059 (PR #9702)
  • [Replication]: Distributed replication toggle not enabled when targetting 2 SRs (PR #9715)

Released packages

  • @xen-orchestra/xapi 8.7.1
  • @xen-orchestra/backups 0.71.3
  • @xen-orchestra/immutable-backups 2.0.2
  • @xen-orchestra/proxy 0.29.57
  • xo-server 5.198.5

6.3.2 (2026-04-03)

Bug fixes

  • [Mirror Backup] Fix Cannot read properties of undefined (reading 'id') Forum#12043 (PR #9667)
  • [Incremental Replication] Fix VTPM_MAX_AMOUNT_REACHED Forum#12047 (PR #9671)

Released packages

  • @xen-orchestra/backups 0.71.2
  • @xen-orchestra/proxy 0.29.56
  • xo-server 5.198.4

6.3.1 (2026-04-01)

Bug fixes

  • [Dashboard] Fix infinite loader on dashboards (PR #9660)
  • [REST API] Fix no such VDI ... error when trying to fetch /vms/:id/vdis and /vms/:id/dashboard (PR #9662)
  • [Replication] fix the fall back to full when going 6.2.->6.3 (PR #9660)

Released packages

  • @xen-orchestra/backups 0.71.1
  • @xen-orchestra/web-core 0.48.2
  • @xen-orchestra/proxy 0.29.55
  • @xen-orchestra/rest-api 0.28.2
  • @xen-orchestra/web 0.46.2
  • xo-server 5.198.3

6.3.0 (2026-03-31)

Highlights

  • [i18n] Add Portuguese and Slovak and update Chinese (Simplified Han script), Czech, Dutch, German, Italian, Norwegian, Persian, Portuguese (Brasil), Russian, Spanish, Swedish and Ukrainian translations (PR #9554)
  • [REST API] Expose POST /rest/v0/pools/:id/actions/create_bonded_network and POST /rest/v0/pools/:id/actions/create_internal_network (PR #9611)
  • [REST API] Added nbd param in network creation endpoints (PR #9611)
  • [Backup] New xo-disk-cli command-line tool to inspect and export disks from backup repositories (info, list, transform commands) (PR #9551)
  • [VM] Add backup replication card on dashboard (PR #9545)
  • [Treeview/Layout] Add Loader and "please wait" page on the first connection xo-server (PR #9568)
  • [VM/Snapshot] Add VM snapshot tab page (PR #9521)
  • [SR] New "Preferred image format" field on SR creation forms (NFS, SMB, HBA, iSCSI, LVM, EXT) to control the disk format used by the SR (PR #9596)
  • [OpenMetrics] Add missing VBD throughput, VBD average latency, and DCMI power consumption metrics (PR #9563)
  • Fixed a performance issue causing browsers to freeze/crash (PR #9627)
  • [MCP] Add list_srs and get_sr_details tools to query storage repositories (PR #9599)
  • [MCP] Add list_networks and get_network_details tools to query network resources (PR #9595)

Enhancements

  • [V2V] Make import cancellable (PR #9552)
  • [MCP] Support token authentication via XO_TOKEN environment variable as an alternative to username/password (PR #9577)
  • [MCP] Add list_vdis tool to list virtual disks (PR #9559)
  • [Replication] Reuse the same VM as an incremental replication target (PR #9524)
  • [S3] add configuration for max/minPartSize and maxPartNumber in the API (PR #9561)
  • [REST API] Expose /rest/v0/vms/:id/actions/clone (PR #9453)
  • [REST API] Expose POST /rest/v0/srs/:id/actions/forget (PR #9505)
  • [REST API] Add POST /hosts/{id}/actions/disable and POST /hosts/{id}/actions/enable endpoints (PR #9532)
  • [Backup] Fix incremental replication always doing a full when source and target are in the same pool (PR #9612)
  • [MCP] Refactor into modular file structure for better extensibility (PR #9621)
  • [QA Test] Add end-to-end QA test suite @xen-orchestra/qa-test for VM, backup and export testing (PR #9626)
  • [Treeview/Pool/Host] Add button to download bugtools (PR #9419)
  • [Incremental Replication] show the schedule used and data volume read on each snapshot (PR #9635)

Bug fixes

  • [Backup] Reduce backup memory consumption (PR #9557)
  • [VM/New] VCPU was ignored Forum#11954 (PR #9591)
  • [Backups/Runs] Fix transfer size calculation (PR #9496)
  • [S3] Check provider compatibility before using batch deletion (PR #9598)
  • [REST API] Exclude ISO SRs from the /dashboard endpoint in the resourcesOverview.srSize and storageRepositories.size.* properties (PR #9608)
  • [VM] Fixed duplicated ip addresses in the network tab Forum#101359 (PR #9547)
  • [VM/New] Fix template that was resetting (PR #9603)
  • [Restore] correctly compute the restored size of incremental backups (PR #9632)
  • [XO5/XO6/Stats] Return null instead of 0 when no stats available (PR #9634)
  • [i18n] Fix English grammar issues on Site Dashboard, contribution by @DustyArmstrong (PR #9647)
  • [Incremental Replication] fix the disk target and cleanup to ensure replications and backups can be chained (PR #9635)
  • [REST-API/VM/Dashboard] Fix cannot read properties of undefined, (reading vms) Forum#12031 (PR #9650)
  • [Backups] Fix double close when merging disks (PR #9636)

Released packages

  • @vates/async-each 1.0.2
  • @xen-orchestra/fs 4.7.0
  • @vates/generator-toolbox 1.1.1
  • @xen-orchestra/disk-transform 1.2.2
  • vhd-lib 4.15.0
  • @vates/nbd-client 3.3.0
  • @vates/types 1.22.0
  • @xen-orchestra/qcow2 1.2.0
  • @xen-orchestra/mcp 1.1.0
  • @xen-orchestra/vmware-explorer 0.12.0
  • xo-server-openmetrics 1.4.0
  • xo-web 5.195.0
  • @xen-orchestra/xapi 8.7.0
  • @xen-orchestra/backups 0.71.0
  • @xen-orchestra/backups-cli 1.1.10
  • @xen-orchestra/disk-cli 1.0.1
  • @xen-orchestra/immutable-backups 2.0.1
  • @xen-orchestra/proxy 0.29.54
  • @xen-orchestra/rest-api 0.28.1
  • xo-server 5.198.2
  • xo-server-netbox 1.11.1
  • @xen-orchestra/web-core 0.48.1
  • @xen-orchestra/web 0.46.1

6.2.3 (2026-04-20)

Bug fixes

  • [Backups]: Fix regression on cleanVM speed (PR #9692)

Released packages

  • @xen-orchestra/backups 0.69.5
  • @xen-orchestra/proxy 0.29.52
  • xo-server 5.197.6

6.2.2 (2026-03-09)

Enhancements

  • [VM/New] Added secureBoot support (PR #9423)
  • [i18n] Update Czech and Danish translations (PR #9531)
  • [openmetrics] add XO process metrics (PR #9535)
  • [VM] Add backup runs and backup archives cards on dashboard (PR #9303)
  • [Backups] Fix out of range error on merge (PR #9567)

Bug fixes

  • [Dashboard] Fix reactivity of dashboard (PR #9378)

  • [OpenMetrics] Fix latency metrics (xcp_host_disk_read_latency_seconds, xcp_host_disk_write_latency_seconds, xcp_vm_disk_read_latency_seconds, xcp_vm_disk_write_latency_seconds) reporting milliseconds instead of seconds (PR #9550)

  • [Backup] snapshots of VM with a CDROM mounted are not removed (PR #9570)

  • [OpenMetrics] Fix plugin failing to auto-start after xo-server restart due to XOA WebSocket connection race condition (PR #9402)

  • XO 5:

    • [Self Service] Fix RAM usage not being properly updated in some cases. Please use "Recompute all limits" in the Self Service dashboard to fix any incorrect quota values introduced by this bug. (PR #9566)
    • If a hostname was defined in a configuration file, /v5 were not accessible #9500 (PR #9572)

Released packages

  • @xen-orchestra/web-core 0.46.0
  • @xen-orchestra/web 0.44.0
  • xo-server-openmetrics 1.3.0
  • @xen-orchestra/backups 0.69.4
  • @xen-orchestra/proxy 0.29.51
  • xo-server 5.197.5

6.2.1 (2026-02-27)

Bug fixes

  • [backups] Fix race condition on merge (PR #9542)

Released packages

  • @xen-orchestra/backups 0.69.2
  • @xen-orchestra/proxy 0.29.49
  • xo-server 5.197.3

6.2.0 (2026-02-26)

Highlights

  • [OpenMetrics] Add is_control_domain label to VM metrics to differentiate dom0 VMs from regular VMs (PR #9474)

  • [OpenMetrics] Add xcp_host_status metric exposing host status (running/maintenance/halted/unknown) for all hosts, including non-running ones (PR #9457)

  • [OpenMetrics] Add host uptime metric (xcp_host_uptime_seconds) (PR #9449)

  • [Plugins/load balancer] Add configurable VM migration cooldown to prevent oscillation (default 30min) (PR #9388)

  • [MCP] Initial release of @xen-orchestra/mcp: MCP server enabling AI assistants to query XO infrastructure (pools, hosts, VMs, dashboard, documentation) (PR #9519)

  • [Backup] Implement Distributed storage for Backups, Mirror Backups and Replications (PR #9433)

  • [V2V] Automatically take a snapshot if a running VM doesn't have any (PR #9471)

  • REST API:

    • [REST API] Added POST /pbds/{id}/actions/plug and /pbds/{id}/actions/unplug rest routes (PR #9477)
    • [REST API] Expose POST /vdis to create a VDI (PR #9492)
    • [REST API] Expose POST /rest/v0/vms/:id/actions/migrate to migrate a VM (PR #9414)

  • XO 5:

    • [Network] Ability to switch management PIF (PRs #9369 #9510)
    • [Licenses] Display bundle name next to license name (PR #9512)
    • [V2V] Remember connection settings in the browser (PR #9490)

  • XO 6:

    • [i18n] Add Chinese (Simplified Han script) and update Czech, German, Italian, Korean and Dutch translations (PR #9462)
    • [VM/New] Add the ability to pass a cloud-init config (PR #9427)
    • [VM/New] Added SSH key field (PR #9413)
    • [Search Engine] Implement first version of the Query Builder on Pools, Hosts, VMs, networks and Storage tables (PR #9488)
    • [Header] Add a banner when the connection to the xo server fails (PR #9375)

Enhancements

  • [Warm Migration] the api call now return the new VM uuid (PR #9465)

  • [Warm Migration] stopped VM can be warm migrated (PR #9465)

  • [Netbox] Support version 4.5.x (PR #9445)

  • [Storage] Add possibility to create VDI in qcow2 format if size > 2TB - 8KB (PR #9493)

  • [Backups] Improve VHD dist handling an rework disk merge (delta backups) (PR #9300)

  • [Host] Add persistent option to host.disable to persist across host reboots (PR #9503)

  • REST API:

    • [REST API] Added POST /srs/{id}/actions/reclaim_space rest route (PR #9486)
    • [REST API] Add objectType to tasks for resolved object references (PR #9429)
    • [REST API] Added POST /srs/{id}/actions/scan rest routes (PR #9514)

  • XO 5:

    • [Patches] Warn about updating XOSTOR before installing patches (PR #9517)

Bug fixes

  • [HUB Recipe] A bug in the Pyrgos recipe requires to remove the DHCP option of the recipe form (PR #9454)
  • [OpenMetrics] Fix ECONNREFUSED on IPv6-only systems by binding to localhost instead of 127.0.0.1 (PR #9489)
  • [REST API] Exclude removable and ISO storage from top 5 SRs usage (PR #9495)
  • [xo-server-sdn-controller] traffic rules robustness (PR #9442)
  • [Backups] Fix error during backup and health check (PR #9508)
  • [Backups] remove the cleanVm: incorrect backup size in metadata error (PR #9527)

Released packages

  • @xen-orchestra/fs 4.6.7
  • @xen-orchestra/backups-cli 1.1.8
  • @xen-orchestra/immutable-backups 1.0.30
  • @xen-orchestra/vmware-explorer 0.11.0
  • xo-server-load-balancer 0.12.0
  • xo-server-netbox 1.11.0
  • xo-server-openmetrics 1.2.0
  • xo-server-sdn-controller 1.2.1
  • @xen-orchestra/backups 0.69.1
  • complex-matcher 1.1.0
  • @xen-orchestra/proxy 0.29.48
  • xo-web 5.194.0
  • @vates/types 1.21.0
  • @xen-orchestra/rest-api 0.27.0
  • xo-server 5.197.2
  • @xen-orchestra/web-core 0.45.0
  • @xen-orchestra/mcp 1.0.1
  • @xen-orchestra/web 0.43.0

6.1.2 (2026-02-10)

Bug fixes

  • [xo-server] Force delete a running VM now bypass hard_shutdown blocked operations (PR #9473)
  • [Backup] Ensure VM created by healthcheck are removed by backup process (PR #9473)

Released packages

  • @xen-orchestra/xapi 8.6.6
  • @xen-orchestra/backups 0.68.2
  • @xen-orchestra/proxy 0.29.46
  • xo-server 5.196.3

6.1.1 (2026-02-05)

Enhancements

  • [Settings] Add various themes (PR #9387)
  • [VM] Add delete and snapshot buttons to manage VM (PR #9410)
  • [Site] Update dashboard with new info from endpoint (PR #8964)
  • [i18n] Update Czech, Danish, German, Spanish, Persian, Finnish, Italian, Japanese, Korean, Norwegian, Polish, Dutch, Portuguese (Brasil), Russian, Swedish and Ukrainian translations (PR #9440)
  • [REST API] Added POST /vifs and DELETE /vifs/:id rest routes (PR #9393)

Bug fixes

  • [REST API] Close SSE connections when clients are too slow, to avoid increased memory consumption (PR #9439)
  • [REST API] message objects are no longer sent via the SSE when subscribing to thealarm collection (PR #9439)
  • [REST API] Do no longer create an XO user authentication task, when using an authentication token (PR #9439)
  • [Backup] ensure no snapshot are left unattended after a job (PR #9434)
  • [Backup] Fix replication leaving replica after partial incremental replication (PR #9435)
  • [REST API] Fix ISO not mounted when creating a VM from /pools/:id/actions/create_vm (PR #9461)
  • [REST API] Fix href path for backup-archives (PR #9460)
  • [REST API/Pool/Dashboard] Only consider running VMs for the cpuProvisioning.assigned value Forum#11604 (PR #9456)
  • [CopyButton] Fix copy to clipboard not working in non-HTTPS environments (PR #9426)
  • [Backup/immutability] Fix typo in sample config file (PR #9444)
  • [Host] Fix host dashboard CPU provisioning calculation Forum#101359 (PR #9459)

Released packages

  • @vates/types 1.19.0
  • @xen-orchestra/backups 0.68.1
  • @xen-orchestra/immutable-backups 1.0.29
  • @xen-orchestra/web-core 0.42.0
  • @xen-orchestra/rest-api 0.24.1
  • @xen-orchestra/web 0.40.0
  • @xen-orchestra/fs 4.6.6
  • @xen-orchestra/proxy 0.29.45
  • xo-server 5.196.2

6.1.0 (2026-01-29)

Highlights

  • [i18n] Add Finnish, Polish and update Czech, Danish, German, Spanish, Persian, Italian, Japanese, Korean, Norwegian, Dutch, Portuguese (Brasil), Russian, Swedish and Ukrainian translations (PR #9330)
  • [VM] Add all actions to manage VM life cycle (PR #9403)
  • [Backup] show the backup archive that will be kept for Long Term Retention (PR #9364)
  • [OpenMetrics] Expose SR capacity metrics: xcp_sr_virtual_size_bytes, xcp_sr_physical_size_bytes, xcp_sr_physical_usage_bytes (PR #9360)
  • [Backup] Fix read xxx bytes, maximum size allowed is yyy for full backup on S3 (PR #9396)
  • [Backup] Fix disk export stuck at 99% (PR #9407)
  • [VM/New] Added VTPM support (PR #9389)
  • [REST API] Add endpoints to reconfigure management interface for hosts and pools (PR #9369)
  • [REST API] Add POST /vbds endpoint to create a VBD (attach a VDI to a VM) (PR #9391)
  • [REST API] Add createVtpm parameter to VM creation endpoint (PR #9412)
  • [REST API] Add secureBoot parameter to VM creation endpoint (PR #9417)
  • [REST API] Add DELETE /vbds/{id} endpoint to remove a VBD (PR #9394)
  • [REST API] Add POST /vbds/:id/actions/connect and POST /vbds/:id/actions/disconnect endpoints to hotplug/unplug VBDs from running VMs (PR #9399)
  • [REST API] Add POST /vdis/:id/actions/migrate endpoint to migrate a VDI to another SR (PR #9408)
  • [TreeView] Scroll to current item in list view (PR #9268)
  • [SIDEPANEL] Remove text ellipsis on sides panel (PR #9328)
  • [Icons] Update icons to use new styles (PR #8989 and PR #9424)

Security

  • [Backups] Update node-tar dependency to handle CVE-2026-23745 (PR #9406)

Enhancements

  • [REST API] Update /dashboard endpoint to also return disconnected servers, disabled hosts, the status of all VMs, and compute jobs from the last seven days (PR #9207)
  • [vhd-cli] Prevent using invalid options (PR #9386)
  • [VM] Add "Change state" button on VM view (PR #9317)
  • [V2V] Add endpoint to export one disk from Vmware to VHD or QCOW2 VDI_IO_ERROR (PR #9411)

Bug fixes

  • [REST API] Fix /vms/:id/dashboard cannot read properties of undefined (reading 'id') (PR #9380)
  • [REST API] vms/:id/dashboard return now an empty object for the replication key instead of undefined (in case of no replication) (PR #9380)
  • [REST API] vms/:id/dashboard rename not-in-job into not-in-active-job for the vmProtection key to avoid confusion (PR #9380)
  • [REST API] Don't return VDI-snapshot for /vms/:id/vdis endpoints (PR #9381)
  • [Plugins/Backup-reports] Prevent succesful backups from occasionally being reported as interrupted Forum#11721 (PR #9400)
  • [REST API] /dashboard return now {isEmpty: true} instead of undefined in case there is no data to compute (PR #9395)
  • [OpenMetrics] Add missing sr_name label to VM disk metrics (PR #9353)
  • [REST API] Fix /vms/:id/actions/start ignored request body (to start a virtual machine on a specific host) (PR #9416)
  • [Backup] Fix reverted VM making the next backup run fails with VM must be a snapshot error (PR #9397)
  • [Sidebar] Removal borders top and right of sidebar in mobile (PR #9366)
  • [V2V] Fix VDI_IO_ERROR when importing some unaligned disks into a qcow2 storage (PR #9411)
  • [New/SR] Fix Require "-o" along with xe-mount-iso-sr error during NFS ISO SR creation (PR #9425)

Released packages

  • vhd-lib 4.14.7
  • @xen-orchestra/qcow2 1.1.2
  • @xen-orchestra/backups 0.68.0
  • @xen-orchestra/backups-cli 1.1.7
  • @xen-orchestra/immutable-backups 1.0.28
  • xo-server-openmetrics 1.1.0
  • xo-web 5.192.0
  • @vates/nbd-client 3.2.3
  • @vates/types 1.18.0
  • @xen-orchestra/xapi 8.6.5
  • @xen-orchestra/web-core 0.41.0
  • @xen-orchestra/proxy 0.29.43
  • @xen-orchestra/rest-api 0.24.0
  • @xen-orchestra/web 0.39.0
  • vhd-cli 1.1.1
  • xo-server 5.196.0

6.0.3 (2026-01-06)

Bug fixes

  • [V2V] Better handling of block alignment (PR #9293)
  • [Hub] Fix m.downloadAndInstallResource is not a function error Forum#11735 (PR #9362)

Released packages

  • vhd-lib 4.14.6
  • @xen-orchestra/disk-transform 1.2.1
  • @xen-orchestra/qcow2 1.1.1
  • @xen-orchestra/xapi 8.6.3
  • @xen-orchestra/backups 0.67.2
  • @xen-orchestra/web-core 0.40.0
  • @xen-orchestra/proxy 0.29.41
  • @xen-orchestra/web 0.37.2
  • xo-server 5.194.6
  • xo-web 5.191.3

6.0.2 (2025-12-23)

Bug fixes

  • XO5:

    • [XOA/Updates] Fix xoa-updater service appears to be down (PR #9349)
    • [Netdata] Fix netdata URL (PR #9354)

  • [OpenMetrics] Fix compliance with OpenMetrics 1.0 specification: use correct Content-Type header and timestamps in seconds (PR #9351)

  • [OpenMetrics] Fix authentication bypass for /openmetrics routes to allow Prometheus scraping with Bearer token (PR #9351)

  • [Select component] Fix randomly empty select component at initialization (PR #9282)

  • [TaskItem] Fix tree on task item component due to a different behavior on firefox (PR #9352)

Released packages

  • @xen-orchestra/web-core 0.39.1
  • @xen-orchestra/web 0.37.1
  • xo-server 5.194.5
  • xo-server-openmetrics 1.0.2

6.0.1 (2025-12-19)

Security

  • [Openmetrics] Hardcode port and bind address for security and compatibility with the system firewall (PR #9337)

Bug fixes

  • [OTP] Fix rendering of OTP signin page (PR #9340)
  • XO 5:
    • Fix infinite loading when redirectToHttps=true (PR #9339)

Released packages

  • xo-server 5.194.4
  • xo-server-openmetrics 1.0.1

6.0.0 (2025-12-18)

Highlights

  • [i18n] Update Czech, German, Persian, Italian, Japanese, Korean, Norwegian, Dutch, Russian, Swedish and Ukrainian translations (PR #9305)
  • [i18n] Update Czech, Danish, Spanish, French, Italian, Dutch, Portuguese (Brazil), and Russian translations (PR #9243)
  • [Navigation] Navigation state is now persisted in localStorage and items are now collapsible while filtering. (PR #9277)
  • [Reactivity] Tasks are now reactive (PR #9271)
  • [XO] XO6 is now the default page (PR #9212)
  • [Site/Tasks] Implement tasks view and side panel information (PR #9063)
  • [Pool/Tasks] Implement tasks view and side panel information (PR #9312)
  • [Host/Tasks] Implement tasks view and side panel information (PR #9311)
  • [VMs/Tasks] Implement tasks view and side panel information (PR #9313)

Enhancements

  • XO 6:

    • [Navigation] Add links to XO 5 for actions and pages not yet implemented in XO 6 (PR #9214)

  • [Backups/s3] Update filesystem handling to use DeleteObjectsCommand in order to improve performance (PR #9281)

  • [REST API] Add link to the openAPI JSON directly in the swagger description (PR #9285)

  • [REST-API/SSE] Possibility to subscribe to XO task (PR #9269)

  • [XO5] Remove XOSAN (PR #9248)

  • [Plugins/Backup-reports] Add optional context in email subject and Pool ID in summary #8544 (PR #8973)

  • [Plugins/Openmetrics] Expose XCP-NG metrics in OpenMetrics format for Prometheus/Grafana (PR #9323)

Bug fixes

  • [Backups] Allow offline backups for more types of backups Forum#11578 (PR #9228)

  • [xo-server] better handling of xapi snapshots when converting to xo object (PR #9231)

  • [REST API/VM Dashboard] Return vmProtection: 'protected' | 'unprotected' | 'not-in-job' instead of vmProtected: boolean (PR #9288)

  • [Backup]clean up .vhd.checksum files (PR #9291)

  • [Backup] Prevent "No new data to upload for this VM" info on mirror backups when it was false Forum#11623 (PR #9286)

  • [REST API] Fix various cannot convert undefined or null to object (PR #9304)

  • [REST API/VM Dashboard] Fix cannot read property of undefined (PR #9304)

  • [Backups] Don't fail backup with memory on "INVALID_UUID" error (PR #9308)

  • [Plugins/Perf-alert] Unload configuration when the plugin is disabled (PR #9306)

  • [REST-API] Fix duplicate entries using ndjson (PR #9320)

  • [Host] Report 0 RAM usage for halted hosts instead of incorrect values (PR #9272)

  • [Plugins/OIDC] Fix group import on string (PR #9280)

  • [Vm Import] Fix error intermediate value not iterable (PR #9327)

  • [XO5/Restore] Replace deprecated endpoint call (PR #9316)

  • XO 6:

    • [VDIs] Fix broken fallback link to XO 5 VDIs page (PR #9267)
    • Redirect non admin user to XO5 (PR #9219)
    • [VM/New] Fix wording in "Memory" section (PR #9309)
    • [Nav/AccountMenu] License URL wasn’t redirecting properly to XO 5 (PR #9321)

Released packages

  • @xen-orchestra/fs 4.6.5
  • @xen-orchestra/backups 0.67.1
  • @vates/types 1.16.0
  • @xen-orchestra/mixins 0.18.0
  • xen-api 4.7.6
  • @xen-orchestra/xapi 8.6.2
  • @xen-orchestra/web-core 0.39.0
  • @xen-orchestra/proxy 0.29.40
  • @xen-orchestra/rest-api 0.22.1
  • @xen-orchestra/web 0.37.0
  • xo-server 5.194.3
  • xo-server-audit 0.15.0
  • xo-server-auth-oidc 0.4.2
  • xo-server-backup-reports 1.7.0
  • xo-server-openmetrics 1.0.0
  • xo-server-perf-alert 1.1.0
  • xo-web 5.191.2

Previous changelogs

Reference in New Issue View Git Blame Copy Permalink