This release is a canary release intended to be used for testing.

Hyper-V and MSSQL as source providers

Hyper-V virtual machines and MSSQL databases were previously added to a backup by replacing the %HYPERV% and %MSSQL% source paths with the real paths of the VM and database files. The backup then held those raw paths, and at restore time the user had to work out which files belong to which machine or database.

The two modules are now source providers that present the same files under a virtual folder per machine or database, with the machine or database name stored as metadata. The restore view can then group the files and show the names instead of GUIDs, and the UI source picker lists the same tree.

Building on this, a restore can now target the original location, where the destination is read from the metadata. A check before the restore starts reports files that are in use, such as a running virtual machine or an attached database. With the new --register-restored-items option, a restored Hyper-V machine is registered with Hyper-V after the restore. Both options are only available on Windows.

Advanced options when restoring

A restore started from the UI can now be given advanced options that are not part of the backup configuration, so settings can be adjusted for a single restore without changing the backup.

Links and junctions are restored correctly

Several problems with restoring symbolic links and directory junctions were fixed, thanks @JamBalaya56562:

• A directory junction is now recorded as a junction and restored as one on Windows, instead of as a directory symbolic link. Backups made before this release have no kind recorded and restore as before.
• Restoring a symbolic link no longer removes a folder with files in it, or a file without --overwrite, that has taken the place of the link since the backup. The link is skipped with a warning instead.
• A link to a folder is now made only after the files below it are restored, which removes a race that caused "Could not find a part of the path" warnings and lost timestamps.
• Folders that a partial restore has to make for the files it restores are no longer reported as warnings.
• Restoring multiple paths with no common root on Windows no longer fails with "index out of bounds", and restoring from a UNC path to a local path works again.

Windows snapshot cleanup

A snapshot that failed after its snapshot set was started left the set in progress. Every later snapshot then failed with VSS_E_SNAPSHOT_SET_IN_PROGRESS (0x80042316) until the process ended, and other VSS applications saw the same error. The snapshot manager is now disposed when setup fails, and a started set is aborted, thanks @stanleys12 and @JamBalaya56562.

Stopping a backup on a stuck source

Continuing the work from the previous canary, "Stop now" now also returns when a source file open, size read or metadata read is stuck, such as on a network share that stopped answering, thanks @JamBalaya56562.

GnuPG on large volumes

GPG only finishes a volume after reading all of it, which took more than the fixed five seconds on large volumes and busy disks, so the backup failed with "program won't flush output" and could crash the process afterwards. The encryption now waits for GPG to finish without a time limit and reports a failed copy to the caller, thanks @JamBalaya56562.

Storage provider fixes

• Azure Blob Storage uploads are now sent in blocks instead of a single request, so a volume that took longer than the network timeout to send no longer fails. The block size defaults to 10 MiB and can be lowered with --azure-upload-block-size for slow connections, thanks @JamBalaya56562.
• Google Cloud Storage uploads now include a CRC32 checksum, so a transfer error is less likely to leave a defective file in the bucket.
• Resumable uploads to Google services no longer fail when the server answers with a 308 status.
• Uploads to a Storj bucket with Object Lock no longer fail because of the default expiry time, thanks @JamBalaya56562.
• Parallel downloads from Jottacloud no longer end with "Stream position mismatch after download", thanks @JamBalaya56562.
• A new --enable-smb311 option connects to SMB servers that require SMB 3.1.1. It is off by default as the library marks it experimental, thanks @JamBalaya56562.
• HashiCorp Vault secrets that arrive as JSON elements are now read, which fixes "The following keys were not found", thanks @JamBalaya56562.

Microsoft 365 enumeration

Enumerating mailboxes no longer requests the message body, which made listings large and slow. Emails are enumerated through the delta endpoint, which has stable pagination and avoids the repeated enumeration that caused long delays and duplicate-item warnings. Locked sites are skipped, OneNote and ToDo access is only warned about once, inherited permissions are no longer requested for items without explicit permissions, transient network errors are retried, and heavy throttling is handled with longer waits. A new --office365-exclude-system-libraries option excludes system libraries in sites and groups.

Remote access on NAS devices

On Synology and QNAP, Duplicati authentication is tied to the system login, so the relayed requests used by the console were rejected because Duplicati itself is not a NAS user. A local forwarding key, generated at startup, now lets Duplicati authenticate its own requests.

Backups from remote sources

Backups that read from a remote source such as SMB or S3 now return rooted paths in the listing, store metadata in the virtual root so the UI knows the data cannot be restored directly to the source, and work with USN change journals active.

Sync operation logs and database update

Sync operations now write their results into the sync database, so the outcome of each run is shown in the job log, as it is for backups. The log entries are purged by the --log-retention option.

This requires an update of the sync database schema to version 1, which adds the log table. The update is applied automatically on first use, and after it the sync database can no longer be opened by earlier versions of Duplicati. If you need to downgrade, the bundled database tool (duplicati-database-tool) can downgrade the sync database back to version 0. Downgrading removes the stored sync logs, but otherwise causes no data loss. Backup databases are not affected.

Detailed list of changes

• Changed Hyper-V and MSSQL to be source providers with a virtual folder per machine or database, thanks @JamBalaya56562
• Added support for restoring Hyper-V and MSSQL items to their original location
• Added the --register-restored-items option to register a restored Hyper-V machine
• Added support for advanced options when starting a restore
• Added parent metadata to search results so intermediate paths can be shown with friendly names
• Fixed the listing of remote sources returning relative paths
• Added metadata to the virtual root of remote source backups
• Added support for remote sources when USN is active
• Fixed restoring a directory junction as a symbolic link, thanks @JamBalaya56562
• Fixed restoring a symbolic link removing the data that had taken its place, thanks @JamBalaya56562
• Fixed links to folders being made before the files below them were restored, thanks @JamBalaya56562
• Fixed warnings for the folders a partial restore has to make, thanks @JamBalaya56562
• Fixed restoring multiple paths with no common root failing with "index out of bounds" on Windows
• Fixed restoring from a UNC path to a local path
• Fixed a failed Windows snapshot leaving the snapshot set open, thanks @stanleys12
• Fixed a Windows snapshot set that fails to set up not being aborted, thanks @JamBalaya56562
• Fixed the snapshot manager dispose obscuring the actual failure message
• Fixed an aborted backup waiting forever for a stuck source file open, thanks @JamBalaya56562
• Fixed an aborted backup waiting forever for a stuck size or metadata read, thanks @JamBalaya56562
• Fixed GnuPG encryption failing with "program won't flush output" on large volumes, thanks @JamBalaya56562
• Fixed Azure Blob Storage uploads failing on volumes that take longer than the network timeout, thanks @JamBalaya56562
• Added the --azure-upload-block-size option
• Added CRC32 checksums to Google Cloud Storage uploads
• Fixed resumable uploads to Google services failing on a 308 response
• Fixed uploads to Storj buckets with Object Lock, thanks @JamBalaya56562
• Fixed parallel downloads from Jottacloud failing with "Stream position mismatch after download", thanks @JamBalaya56562
• Added the --enable-smb311 option and updated SMBLibrary to 1.5.8.1, thanks @JamBalaya56562
• Fixed HashiCorp Vault secrets not being read when the values are JSON elements, thanks @JamBalaya56562
• Improved Microsoft 365 enumeration and reduced the warning noise
• Added the --office365-exclude-system-libraries option
• Fixed remote access on Synology and QNAP when connected to the console
• Fixed an invalid retention policy being accepted when a backup is saved, thanks @JamBalaya56562
• Fixed a backup including the -wal and -shm files of its own database, thanks @JamBalaya56562
• Fixed the progress showing 0 files of -1 bytes with --disable-file-scanner, thanks @JamBalaya56562
• Fixed the old UI showing a negative number of files to go and 0% for empty files, thanks @JamBalaya56562
• Fixed a finished task being reported as completed before its result was stored, thanks @JamBalaya56562
• Fixed a potential path traversal when restoring control files from an untrusted source, thanks @HaTaeHoon
• Fixed pause and resume events being handled out of order, which could leave the queue paused, thanks @JamBalaya56562
• Fixed the tray icon keeping an old server state after a reconnect, thanks @JamBalaya56562
• Fixed the preload settings debug output not being shown in the tray icon, and let 0 turn it off, thanks @JamBalaya565...

About this release

This release patches version 2.4.0.0 with fixes for a number of issues that were discovered after the release.
The main focus of this release is stability, with many fixes to restore, abort handling and the new sync mode, along with security hardening of the server and remote control.

Usability fixes

The search feature would allow you to select files, but would send incorrect paths to the restore flow.
On Windows, this would result in no files selected in the search view being restored.

Security and Privacy

The login setup has been hardened against weak passwords, the remote control requests have been locked down and require per-message keys.
The remote control connection now works on NAS devices that use integrated authentication (Synology DSM).
Path redaction in logs and reports has been improved, and secrets in lists now have an additional layer of protection.

A new reduced reporting mode (--reduced-reporting) limits reports leaving the machine to log message ids, counters and dates, without message text, error messages or file names. The HTTP status report has a matching --http-report-status-reduced-reporting option. The setting can also be enforced from the console for users requiring it.

Restore and Abort Fixes

A restore now carries on with the next file when a single file fails, instead of stopping the whole restore. Several issues that could cause a restore to hang have been fixed, including releasing blocks for skipped files, releasing all restore processes when a volume cannot be produced, and releasing the restore stages on every exit path. A missing destination folder is now reported before the restore starts.

Aborting a backup or other operation no longer waits for a stuck source file read, a stuck backend call, or a block processor that has stopped. Aborting a repair while it reads the local database no longer discards the database.

Sync Mode Fixes

The sync mode introduced in 2.4.0.0 has received a number of fixes: folder sync on some destinations, zero-byte uploads to Google Drive and Google Cloud, case-insensitive remotes, duplicate remote listings, sync metadata and last-run handling, and lower memory use by not storing remote operations in memory. The synchronization tool now passes the correct arguments to its backends, ignores folder entries in listings, renames through the backend, and counts failed deletes and renames in its return code.

Stability and Performance

The wasted space calculation used for compacting has been improved, deleting filesets uses less memory, and SQLite memory usage has been further reduced.
Database connections are now closed when opening or setting up a local database fails, and the server now takes the database lock in a few paths that previously skipped it.
Resuming after sleep no longer waits for the suspend handling to finish, and Windows is allowed to sleep again when an operation ends.
Tasks and HTTP status reports now report errors from operations that finished without throwing.

Backend and Provider Fixes

• Google Drive: keep every copy of a duplicated name, and report no quota for shared drives instead of the user's own quota.
• Google Workspace: handle inactive accounts, emit a root folder, and fix the restore scope.
• MS365: fix restore of large emails.
• Drime: fix incomplete listings beyond the pagination limit.
• S3: add RelAix to the list of providers.
• SMB: improved error detection.
• Duplicati backend: show error messages from the console.
• An unknown destination quota is no longer treated as a full destination, and the manual quota is kept when the backend quota is disabled.

Windows Installer and Shell Integration

The MSI now remembers the install location on upgrade, and the path browse button has been fixed.
The Windows shell overlay has been fixed. It requires the folder status service, which is disabled by default and can only be enabled from the commandline with --webservice-enable-folder-status-service=true.

Other Changes

The command line tools have a number of fixes to listing and searching, such as listing the latest version when none is given, searching sub-folders, looking up file versions by full path, and handling folders given without a trailing separator. Purge and set-locks now stop when the given version or time matches no fileset, and a queued command keeps the versions it named when it was sent.
The old UI has fixes for editing local folder and S3 destinations, restore version grouping and selecting a restore root.
This release also adds an option to prevent the server from creating a new database (--webservice-dont-autocreate-database), support for runner identity and license usage collection, and fixes for packaging libc_wrapper.so and for running when the account has no home folder.

Detailed list of changes:

• Don't warn on report module errors
• Fix remote access on NAS
• Remember install location for MSI
• Stop waiting for a stuck source file read when the backup is aborted
• Answer a block's sender when the block processor stops
• List the roots of a multi-drive backup without waiting
• Let the queue runner be disposed before it is terminated
• Release the blocks of a file the restore skips
• Report a missing destination folder before a restore starts
• Say which file is missing when the Windows modules cannot load
• Close the connection when the setup of a backup or delete database fails
• Try the next port when the system refuses the one the server binds
• Resume after a sleep even if the suspend is still being handled
• Fixed the path browse button in the MSI
• Keep the local database when a repair is aborted while reading it
• Report the errors of an operation that finished without throwing in the HTTP status report
• Let Windows sleep again when an operation ends
• Say that search looks at every version when none is given
• Return the oldest live log entries after the one a client has seen
• Group restore versions by calendar month in the old UI
• Show the saved local folder when the old UI edits a backup
• Let the old UI select a restore root before it is expanded
• Keep the saved S3 client when the old UI opens a destination
• Save a custom S3 storage class from the old UI
• Expose stored config type in API
• Avoid storing sync ops in memory
• Fix upload zero-byte file to Google Cloud/Drive
• Update Sync metadata handling
• Report the errors of a task that finished without throwing
• Carry on with the next file when one file fails to restore
• Keep a queued command's --version on the versions it named when it was sent
• Release the restore stage before a stopped one on every exit path
• Keep a file source in the root listing when another source extends its name
• Add support for reduced reporting
• Change SMB error detection
• Add RelAix to list of S3 providers
• Close the connection when a local database fails to open
• List a folder's contents when the folder is given without a trailing separator
• Add support for per-message keys
• Search the sub-folders of a folder given to the search command
• List the latest fileset when no time or version is given to list-folder-contents
• Release every restore process when a volume cannot be produced
• Prevent wrong missing key warning
• Stop waiting for a backend call when the operation is aborted
• Return no fileset for an exact time that matches none
• Report a queued task as waiting in the task queue listing
• Improve waste space calculation
• Look up file versions by their full path
• Run a remote sync destination inline when its mode has no interval or count
• Improve path redaction
• Support console error messages
• Fix a zero-progress report
• Add support for collecting license usage
• Fix issue with folder sync
• Stop purge and set-locks when the given version or time matches no fileset
• Harden remote control requests
• Add login throttle
• Fix incomplete Drime listings beyond the pagination limit
• Report a finished task's outcome while it is still the current task
• List a sync inventory folder as an indexed, case-sensitive range
• Fix Google Workspace restore scope
• Make Google Workspace emit a root folder
• Fix Windows Shell Overlay
• Remove unused browsertest
• Handle Google Workspace inactive accounts
• Honour case-insensitive-remote in the sync command
• Additional memory optimization for SQLite
• Reduce delete memory pressure
• Add support for runner identity
• Dispose the primary sync database when a sync run ends
• Count failed deletes and renames in the synchronization tool's return code
• Let the synchronization tool rename through the backend and compare through temporary files
• Ignore the folder entries a remote listing reports
• Pass the right arguments to the synchronization backends
• Spell the sync-remote-state values the way the option accepts them
• Fix packaging libc_wrapper.so
• Say which side has duplicate remote files instead of crashing
• Root the data folder when the account has no home folder
• Take the database lock in the server paths that skipped it
• Update MS365 permission doc
• Improve libc_wrapper import name
• Layered defense for secrets in lists
• Do not read an unknown destination quota as a full destination
• Add option to disable db autocreate
• Fix MS365 large email restore
• Keep the manual quota when the backend quota is disabled
• Report no quota for a Google shared drive, instead of the user's own
• Keep every copy of a duplicated Google Drive name, and list it once

Updates to ngclient

Updated ngclient from 0.0.234 to 0.0.238:

• Changed the order for navigation on new backups: source before destination
• Added support for purging files from the UI
• Added support for checking permissions with MS365 and Google Workspace
• Added a counter dialog for Google Workspace data
• Added support for disabling chunking on S3 providers that do not support it
• Added support for reduced reporting
• Added RelAix to the known public hosts
• Ad...

This release is a canary release intended to be used for testing.

Reduced reporting mode

A new reduced reporting mode limits everything that is sent outside the machine to log message ids, counters, dates and stack traces. No message text, error message or file name is transmitted, and the bug report feature is disabled. The mode is enabled with --reduced-reporting, overrides the regular path redaction, also applies to the data handed to run-scripts, and cannot be undone by a backup configuration. Local log data is still available in full.

Recreate with defective filelists

A failed transfer can leave a partially written filelist on the remote storage. The backup would then fail because of the unknown file, and recreating the database failed because the partial file could not be read. The database recreate now probes the filelists and continues without the defective ones. The next backup will then ask for a repair, which removes the offending files.

Restore fixes

A number of problems in the restore flow were fixed, thanks @JamBalaya56562:

• A file that cannot be created or written no longer stops the restore of the files after it.
• A restore that finishes with errors is now reported as failed in the UI and in the HTTP status report, instead of showing as successful.
• Skipped files, including files where a copy already exists, no longer cause BlockCountError and VolumeCountError messages.
• A missing destination folder is reported before the restore starts instead of after the full retry delay.
• More cases where a failing restore stage could leave the restore waiting forever are now released.
• The restore tree no longer hides a source whose path extends the name of another source file, and a backup with multiple drives no longer takes 30 seconds per drive to list.

Stopping a backup no longer hangs (or at least less often)

Using "Stop now" could leave the backup waiting forever if a source file read was stuck, such as on a network share that stopped answering, or if a block processor was stopped while holding a block. Both cases now return as cancelled, thanks @JamBalaya56562.

Windows sleep, resume and port fixes

Three Windows related problems were fixed, thanks @JamBalaya56562:

• With --allow-sleep disabled, Windows was kept awake after the operation had finished. The sleep prevention is now withdrawn when the operation ends.
• If the machine was suspended before the pause was fully handled, the server could stay paused after waking up.
• The server now tries the next port when Windows refuses the port, such as when port 8200 is in a range reserved for Hyper-V, WSL or Docker.

MSI installer remembers the install location

A custom install location chosen in the MSI installer is now remembered for later upgrades. Older packages did not record the location, so this takes effect from the next upgrade. The location can also be set with msiexec /i package.msi INSTALLLOCATION=C:\OtherLocation, which works for silent installs. The browse button for picking the path was also fixed.

Queued commands keep their version

A command sent from the command line page in the UI waits in the task queue. If a backup ran before the command, the --version numbers had shifted, so a delete could remove the wrong version. The versions are now resolved when the command is sent, and the command is not run if a named version no longer exists, thanks @JamBalaya56562.

Synchronization improvements

Sync jobs now keep their own metadata and only update it when the operation succeeds, instead of writing the last backup values even on failures. The remote operation log is no longer kept in memory during a sync, and uploading a zero-byte file to Google Cloud Storage or Google Drive no longer fails with a 400 error.

Detailed list of changes

• Fixed generated remote filenames using the casing supplied by the user for the compression and encryption module
• Added support for remembering the install location in the MSI installer and pinned the order of the install actions
• Fixed an aborted backup waiting forever for a stuck source file read, thanks @JamBalaya56562
• Fixed an aborted backup waiting forever when a block processor stopped while holding a block, thanks @JamBalaya56562
• Fixed the largest-prefix listing taking 30 seconds per drive and returning an extra empty root for multi-drive backups, thanks @JamBalaya56562
• Fixed an ObjectDisposedException logged during server shutdown, thanks @JamBalaya56562
• Fixed skipped files in a restore being reported as BlockCountError and VolumeCountError, thanks @JamBalaya56562
• Fixed a missing destination folder only being reported after all retries when restoring, thanks @JamBalaya56562
• Fixed the repeated and unclear warning when the Windows modules cannot be loaded, thanks @JamBalaya56562
• Fixed the database connection staying open when the setup of a backup or delete database fails, thanks @JamBalaya56562
• Fixed the server stopping instead of trying the next port when the system refuses the port, thanks @JamBalaya56562
• Fixed the server staying paused after a sleep if the suspend was still being handled, thanks @JamBalaya56562
• Fixed the path browse button in the MSI installer
• Fixed an aborted repair setting aside a healthy local database and recreating it, thanks @JamBalaya56562
• Fixed the HTTP status report showing an operation that finished with errors as successful, and redacted paths in the reported error, thanks @JamBalaya56562
• Fixed Windows being kept awake after an operation has ended, thanks @JamBalaya56562
• Fixed the help text for search to say that all versions are searched when none is given, thanks @JamBalaya56562
• Fixed the live log skipping entries when more than a page arrived between two polls, thanks @JamBalaya56562
• Fixed the old UI grouping restore versions under the wrong month, thanks @JamBalaya56562
• Added handling of defective filelists when recreating the database
• Changed the remote filename parsing so the encryption module name cannot contain a .
• Fixed the old UI not showing the saved local folder when editing a backup, thanks @JamBalaya56562
• Fixed the old UI not being able to select a restore root before it was expanded, thanks @JamBalaya56562
• Fixed the old UI replacing the saved S3 client with aws when opening a destination, thanks @JamBalaya56562
• Fixed the old UI not saving a custom S3 storage class, thanks @JamBalaya56562
• Added the stored configuration type (backup or sync) to the API
• Reduced memory usage for sync operations by not collecting remote operation log data
• Fixed uploading zero-byte files to Google Cloud Storage and Google Drive
• Changed sync operations to use their own metadata and only update it on success
• Fixed a task that finished with errors being reported as successful, thanks @JamBalaya56562
• Fixed a restore stopping when a single file fails to restore, thanks @JamBalaya56562
• Fixed a queued command acting on the wrong version when a backup ran before it, thanks @JamBalaya56562
• Fixed more cases where a failing restore stage could leave the restore waiting forever, thanks @JamBalaya56562
• Fixed a source being dropped from the root listing when its path extends the name of another source file, thanks @JamBalaya56562
• Added the reduced reporting mode and the --reduced-reporting option
• Changed the SMB write error detection and logging to show the actual failure
• Added RelAix to the list of S3 providers, thanks @mygrexit
• Fixed empty and whitespace-only arguments being lost when wrapping a command line, thanks @JamBalaya56562
• Fixed the database connection staying open when a local database fails to open, thanks @JamBalaya56562
• Updated translations from Transifex, thanks to all Translators!

Updates to ngclient

• Fixed the context menu being hidden for console managed backups
• Added support for showing sync jobs when restoring configurations from remote
• Improved the display of sync operations
• Added RelAix to the known public hosts
• Added support for reduced reporting
• Fixed errors in a completed restore database repair not being handled, thanks @JamBalaya56562
• Fixed the schedule date picker not preserving the local date, thanks @JamBalaya56562
• Fixed stopped WebSockets and long polls reconnecting, thanks @JamBalaya56562
• Updated localization

This release is a canary release intended to be used for testing.

New restore-test command

A new restore-test command restores a sample of files from a backup into a temporary folder and verifies them. The sample size, download budget, runtime and version can be controlled with the --restore-test-* options. For backups, the option --perform-restore-test-after runs the restore test automatically after a given amount of time.

Choosing a VSS provider

Windows snapshots can now use a specific VSS provider with --vss-provider-id=<guid>. The snapshot setup also detects a provider that does not expose mapped paths and cannot be used. If no provider is selected, it falls back to the Microsoft Software Shadow Copy provider.

Lower memory usage when deleting versions

Deleting, compacting, purging and repairing forced SQLite to build a large in-memory table holding all fileset entries being removed. The filesets are now removed one at a time, which bounds memory use to a single version. On a synthetic database with 100 versions and 300k files this was 16-20% faster with an 80% reduction in memory. The wasted space calculation was also rewritten and is roughly 9x faster on large databases.

Synchronization tool fixes

A number of problems in the remote synchronization tool were fixed, thanks @JamBalaya56562:

• The backend managers received the wrong arguments, so a missing source folder was created and the empty listing deleted every file in the destination.
• Folder entries reported by the destination are now ignored instead of failing the run.
• Renames now use the backend's own rename and content verification compares through temporary files, reducing peak memory from gigabytes to under 100 MB for large volumes.
• Failed deletes and renames are now counted in the return code instead of reporting success.
• A destination with mode interval or counting but no interval or count was only synchronized once. It now runs inline with a warning.
• The --case-insensitive-remote option is now honoured, so a case-only rename no longer loses the file on case-insensitive destinations.
• The primary sync database is now closed when the run ends, and the --sync-remote-state warning names values the option accepts.

Additionally, the tool no longer fails to copy folders on backends that report paths with a trailing separator.

Restore and backup no longer hang on failures

A restore that hit a volume it could not download, decrypt or decompress could wait forever instead of failing. All restore stages are now released when a volume cannot be produced. Similarly, stopping a backup while a backend call was stuck in a transfer that did not observe cancellation left the operation waiting; the backend manager now abandons the call and the operation returns as cancelled, thanks @JamBalaya56562.

Path redaction in reports

Additional checks prevent file paths from being included in logs and reports sent outside the system. The option --allow-paths-in-log-messages disables the redaction for environments where paths can be reported safely.

Selecting which operations send reports

The mail, HTTP, XMPP and Telegram reporting modules have a new option, such as --send-mail-operations, that selects which operations emit a report. The default is to report backups only, as before.

Command-line listing fixes

Several listing commands did not behave as documented, thanks @JamBalaya56562:

• list-folder-contents now accepts a folder without a trailing separator and picks the latest version when no time or version is given.
• search now searches sub-folders of the given folder.
• list-file-versions and the V2 list-versions endpoint now return results and report correct timestamps.
• purge and set-locks now stop when the given version or time matches no fileset instead of acting on every fileset.

Detailed list of changes

• Fixed list-folder-contents returning nothing for a folder given without a trailing separator, thanks @JamBalaya56562
• Added --vss-provider-id to choose a VSS provider, with a fallback to the Microsoft Software Shadow Copy provider when the selected one cannot be used
• Added per-message ephemeral encryption keys and payload compression for console connections
• Fixed search not searching the sub-folders of the given folder, thanks @JamBalaya56562
• Fixed list-folder-contents failing with "Multiple filesets found" when no time or version is given, thanks @JamBalaya56562
• Fixed a restore hanging forever when a volume cannot be downloaded, decrypted or decompressed, thanks @JamBalaya56562
• Fixed a wrong missing key warning when using the default secret provider
• Fixed an aborted operation waiting forever for a backend call that does not observe cancellation, thanks @JamBalaya56562
• Fixed an exact time lookup returning every fileset when none matched, thanks @JamBalaya56562
• Fixed a queued task being listed as running in the task queue, thanks @JamBalaya56562
• Rewrote the wasted space calculation to be faster and use less memory
• Fixed list-file-versions and the V2 list-versions endpoint returning no results and wrong timestamps, thanks @JamBalaya56562
• Fixed a remote sync destination with mode interval or counting but no interval or count only synchronizing once, thanks @JamBalaya56562
• Added path redaction checks for logs and reports and the --allow-paths-in-log-messages option
• Added support for console status and error messages in Duplicati Backend so failure messages are less generic
• Fixed most operations reporting 0% progress
• Added a pluggable slot for license usage collection
• Fixed the sync tool failing to copy folders on backends that report a trailing separator
• Fixed purge and set-locks acting on every fileset when the given version or time matched none, thanks @JamBalaya56562
• Hardened remote control callback requests and disabled redirects
• Added login throttling to protect against brute-force attempts
• Fixed Drime trash pagination validation and folder counts with trashed entries, thanks @tristanXme
• Fixed a finished task reporting no outcome while it was still the current task, thanks @JamBalaya56562
• Fixed the sync inventory folder listing being case-insensitive and unindexed, thanks @JamBalaya56562
• Added --send-mail-operations, --send-http-operations, --send-xmpp-operations and --send-telegram-operations to choose which operations send reports
• Added the restore-test command and the --perform-restore-test-after backup option
• Fixed Google Workspace restore browsing being rejected due to a read-only scope request
• Changed Google Workspace to emit a root folder like MS365
• Fixed the SMB live test starting before Samba accepted connections, thanks @JamBalaya56562
• Fixed the Windows shell icon overlay returning empty results and adjusted icon sizes
• Fixed Google Workspace warnings and a lost license seat warning for suspended and archived users
• Fixed the sync command ignoring --case-insensitive-remote, thanks @JamBalaya56562
• Added a check that the VSS provider has mapped a usable path
• Reduced memory usage when removing filesets in delete, cleanup, repair and purge
• Reduced memory usage when deleting filesets during backup
• Fixed the primary sync database never being disposed, thanks @JamBalaya56562
• Fixed the sync tool returning success when deletes or renames failed, thanks @JamBalaya56562
• Fixed the sync tool downloading volumes into memory for renames and verification, thanks @JamBalaya56562
• Fixed the sync tool copying, deleting and verifying folder entries reported by the destination, thanks @JamBalaya56562
• Fixed the sync tool passing the wrong arguments to its backends, causing an empty source to delete the destination, thanks @JamBalaya56562
• Fixed the --sync-remote-state warning suggesting values the option rejects, thanks @JamBalaya56562

Updates to ngclient

• Added a counter dialog for Google Workspace data
• Added support for disabling chunking on S3 providers that do not support it
• Fixed the restore file picker not handling a failed database repair, thanks @JamBalaya56562
• Fixed a cancelled destination test not stopping the request, thanks @JamBalaya56562
• Added WebModules storage, HTTP and destination test component tests, thanks @JamBalaya56562

This release is a canary release intended to be used for testing.

Fixed Linux data folder for services without a home folder

When running as a Linux service under an account with no home folder, the data folder was stored as the relative path var/lib/Duplicati instead of /var/lib/Duplicati. Relative paths are now resolved correctly, thanks @JamBalaya56562.

Fixed sync failing on backends that cannot report quota

A backend that cannot report free space returns a negative value. The synchronization tool compared this against the required size and incorrectly concluded the destination was full, stopping the sync. The quota check now only runs when the destination actually reported a free space, thanks @JamBalaya56562.

Fixed sync crash on duplicate remote file names

A remote listing that reported the same name twice made the synchronization tool fail with an unhelpful ArgumentException. It now reports which side has the duplicates and what to do about it, matching the message the backup path already produced, thanks @JamBalaya56562.

Fixed source lost inside an excluded folder

A source folder nested inside another source, with a folder on the path between them excluded, was silently dropped from the backup. The nested source was converted to an include filter, but the containing source's enumeration never descended into the excluded folder, so the filter was never reached. Such sources are now kept as sources instead of being converted to filters, thanks @JamBalaya56562.

Faster consistency checks

The database consistency check queries were rewritten to avoid SQLite building automatic indexes. Depending on database size and shape, the checks are now 25-40% faster, thanks @JamBalaya56562.

New option to prevent automatic database creation

The new --webservice-dont-autocreate-database option prevents the server from creating an empty database on startup. Useful when the database already exists and you want the server to fail rather than start with an empty configuration due to a misconfigured data folder.

Fixed MS365 large email restore

Restoring large emails to an MS365 tenant previously failed because the restore path attempted to set read-only or non-nullable properties on the email creation request. Only writable properties are now sent, and null values are omitted.

Fixed full-disk backup on Linux and macOS

The native wrapper libraries (libc_wrapper.so, libSystem_wrapper.dylib) were placed in a runtimes subfolder by the build but the P/Invoke loader only looked in the application folder, causing full-disk backup to fail on packaged installs. A resolver now probes both locations.

ServerUtil command-line parsing fixes

Fixed several issues from the switch to the stable System.CommandLine package, including the --hosturl option not accepting URLs from the command line.

Detailed list of changes

• Updated ngclient to version 0.0.236
• Fixed the Linux data folder being relative when the service account has no home folder, causing database paths to resolve incorrectly, thanks @JamBalaya56562
• Fixed --quota-disable incorrectly disabling the manual --quota-size quota check, thanks @JamBalaya56562
• Fixed the sync tool treating a backend that cannot report quota as having no free space, thanks @JamBalaya56562
• Fixed Google Drive shared drive backups being checked against the user's personal quota, thanks @JamBalaya56562
• Fixed Google Drive not tracking all copies of a file with a duplicate name, causing incomplete deletes and stale reads, thanks @JamBalaya56562
• Fixed the sync tool crashing with an unhelpful error on duplicate remote file names, thanks @JamBalaya56562
• Fixed a source folder being silently dropped when nested inside another source with an excluded folder between them, thanks @JamBalaya56562
• Fixed Windows command-line argument escaping for arguments ending with backslashes, thanks @JamBalaya56562
• Fixed four server code paths accessing the database without the serialization lock, causing intermittent errors, thanks @JamBalaya56562
• Rewrote consistency check queries to avoid SQLite automatic indexes, improving performance, thanks @JamBalaya56562
• Added --webservice-dont-autocreate-database option to prevent starting with an empty database
• Masked sensitive information in the backup list API endpoint
• Fixed MS365 large email restore failing due to read-only properties being sent
• Fixed native wrapper library loading for full-disk backup on Linux and macOS packaged installs
• Added path argument and --output-json support to SourceTool list command
• Fixed ServerUtil --hosturl option not accepting URLs from the command line
• Fixed a disk with no partitions causing the Windows disk enumeration to fail, thanks @JamBalaya56562
• Fixed the ijwhost.dll native library being resolved as a managed reference, causing build warnings, thanks @JamBalaya56562
• Added fileset diagnostics to disruption tests to aid debugging, thanks @JamBalaya56562
• Added test for PAR2 file deletion
• Added clean database startup tests
• Added consistency check query equivalence tests, thanks @JamBalaya56562
• Added data folder locator tests, thanks @JamBalaya56562
• Added Google Drive duplicate name tests, thanks @JamBalaya56562
• Added Google Drive shared drive quota tests, thanks @JamBalaya56562
• Added nested source exclusion tests, thanks @JamBalaya56562
• Added no-free-space backend quota tests, thanks @JamBalaya56562
• Added command-line wrapping tests, thanks @JamBalaya56562
• Added VSS disk volume lookup tests, thanks @JamBalaya56562
• Improved libc_wrapper import name for clearer error messages
• Updated MS365 permission documentation strings
• Updated Office365 included user and group type descriptions

Updates to ngclient

• Added a small loader on the start page to assist with slow loading
• Fixed the destination test dialog not preserving context when retrying, thanks @JamBalaya56562
• Fixed V1 destination tests not completing after error handling, thanks @JamBalaya56562

This release is a canary release intended to be used for testing.

New Native VSS snapshot provider

This release introduces a new native VSS snapshot provider on Windows that replaces the previous providers. Hyper-V and MSSQL enumeration work with the native provider which is now default.

The new native VSS snapshot provider does not require VCRedist to be installed and works on x86, x64, and Arm64 systems.
The existing AlphaVSS and Vanara-based VSS snapshot providers can still be selected (but not on Arm64).
They will be removed in a future version as AlphaVSS is no longer maintained and the new native library has fewer dependencies than Vanara.

New WMI VSS snapshot provider

The previously supported WMIC provider has been removed as Windows updates will remove the executable it relies on.
Instead a new WMI snapshot provider is added which works similar to WMIC.

The WMI (and WMIC) provider gives a more light-weight VSS functionality, where it does not flush the writers (MSSQL, HyperV, etc) but just ensures a crash-consistent disk snapshot.

If you rely on systems that integrate with VSS, use the Native provider, if you just want to back up locked files, use the WMI provider.

Full-disk backup and VSS snapshots

With this release VSS is now also used for full-disk backups. This is fully transparent and works such that an active snapshot is detected and the full-disk reader will use the snapshot to access the disk contents.

Recovering from an interrupted first backup

Interrupting a first backup previously left the destination in an unrecoverable state: blocks and index files were uploaded, but no filelist was written, so neither backup nor repair could proceed. The recreate logic can now reconstruct a database from the index files alone, so an interrupted first backup can be resumed instead of requiring the destination to be discarded, thanks @JamBalaya56562.

Repair no longer removes metadata

The repair handler previously attempted to fix defective metadata with various reassignment strategies that could silently remove metadata. It now reports the problem and asks the user to run list-broken-files and purge-broken-files, which rewire the metadata while keeping the file content. Detection of zero-length and otherwise defective blocksets has also been improved.

Azure Blob Storage path support

The Azure Blob Storage backend previously ignored the path part of the destination URL and always stored data in the root of the container. The path is now treated as a prefix, so backups can be placed in a subfolder of a container. If you previously used a path in an Azure Blob Storage destination URL, the data was stored in the root; after upgrading, new backups will use the path as a prefix and will not see the previously uploaded files.

Prevent empty machine ID

A startup sequence issue could cause a clean install to report and connect to the console without a machine ID, which could cause various unwanted behaviors.

Linux sleep prevention

Duplicati can now prevent the system from sleeping during backup operations on Linux, similar to the existing support on Windows and macOS.

AppImage .zsync support

This release now has the .zsync file and relevant metadata such that future updates can be done efficiently and automatically by AppImage managers that support it.

--synchronous-upload deprecated

The --synchronous-upload option no longer has any effect and is now marked as deprecated. Existing configurations that set it will continue to load, but a warning is now logged. Use --asynchronous-upload-limit instead.

Default exclude volume information

The System Volume Information folder is now automatically excluded from backups as it cannot be reliably read and cannot be used in a restore process.

Performance and stability updates

Several performance fixes are applied to the local database queries, affecting most operations, mostly by @JamBalaya56562.
Many edge cases around unexpected server responses and url encoding issues have also been adressed, thanks @JamBalaya56562.

Detailed list of changes

• Updated all localizations, thanks to all translators
• Added a native VSS snapshot provider, replacing the WMI-based approach
• Fixed Hyper-V and MSSQL enumeration with the native VSS provider
• Added --vss-writer-flush-timeout to control how long to wait for VSS writers
• Used VSS for full-disk backups and automatically excluded System Volume Information
• Hid unsupported VSS options on Arm64
• Added support for recreating a database from an interrupted first backup, thanks @JamBalaya56562
• Changed repair to report defective metadata instead of silently reassigning it
• Improved detection and notification of zero-length and defective blocksets
• Sped up purge-broken-files by reusing the invalid-blocks query
• Added an API endpoint for purging files across backup versions
• Added permission checks for MS365 and Google Workspace so users can verify granted permissions
• Fixed MS365 group classifications and added validation of source and destination provider options
• Added support for a path prefix in Azure Blob Storage destinations
• Fixed --prefix combined with path separators in sync operations
• Fixed a clean install potentially starting with an empty machine ID
• Added sleep prevention support on Linux
• Fixed the destination self-test incorrectly failing on OpenStack when a probe file was already gone, thanks @JamBalaya56562
• Fixed Google Cloud Storage not detecting a delete of a missing file
• Fixed Google Cloud Storage URL encoding that broke authentication
• Fixed OneDrive browsing failing on the drive root and not returning folders
• Fixed OneDrive folder names with percent signs or hashes not being reachable, thanks @JamBalaya56562
• Fixed Dropbox folder names with percent signs being decoded twice, thanks @JamBalaya56562
• Fixed SharePoint destination paths containing + being misread, thanks @JamBalaya56562
• Fixed WebDAV destination paths containing + being misread, thanks @JamBalaya56562
• Fixed hostless backend URLs such as dropbox://?authid=... failing to enumerate from the root
• Fixed a Windows source given as a bare drive letter (e.g., C:) resolving to the process working directory instead of the drive root, thanks @JamBalaya56562
• Preserved the fileset timestamp when replacing a missing dlist file during repair, thanks @JamBalaya56562
• Recorded the fileset timestamp in the dlist file so a database recreate keeps it, thanks @JamBalaya56562
• Fixed URL query string values not always being preserved when modifying URLs
• Indexed the verification tables on the compared columns, significantly speeding up remote volume verification, thanks @JamBalaya56562
• Removed a redundant DISTINCT that blocked index lookups in fileset queries, thanks @JamBalaya56562
• Stopped deduplicating twice in the fileset consistency check, thanks @JamBalaya56562
• Made BackendTester re-read the remote folder before abandoning a test run, and accept an already-deleted file during cleanup, thanks @JamBalaya56562
• Cleared the Filen file cache when a write did not come back, preventing stale lookups, thanks @JamBalaya56562
• Re-read the Filejump file list when a delete got no answer, thanks @JamBalaya56562
• Re-read the Drime file list when a delete got no answer, thanks @JamBalaya56562
• Deprecated --synchronous-upload which no longer has any effect, thanks @JamBalaya56562
• Added .zsync files for .appimage releases, enabling delta updates
• Updated System.CommandLine from pre-release to the stable 2.0 release
• Regenerated the libsecret DBus bindings with the latest tooling

Updates to ngclient

• Changed the order for navigation on new backups: source before destination
• Added support for purging files from the UI
• Added support for checking permissions with MS365 and Google Workspace
• Fixed Windows search results having a leading \ prefix, causing empty restores
• Fixed WebDAV destination path normalization, thanks @JamBalaya56562
• Fixed folder filters losing their type while editing, thanks @JamBalaya56562
• Fixed folder exclusions not propagating through the file tree, thanks @JamBalaya56562
• Fixed file attribute exclusions not being preserved when editing, thanks @JamBalaya56562
• Fixed local schedule dates being reset when editing, thanks @JamBalaya56562
• Fixed custom form validator behavior, thanks @JamBalaya56562
• Fixed commandline result polling, thanks @JamBalaya56562
• Hardened HTTP interceptor request handling, thanks @JamBalaya56562
• Fixed the file browser height on the restore page
• Fixed flicker in the Duplicati Storage backup picker
• Fixed connection state being set incorrectly with socket relay
• Migrated to hey-api's modern Angular client, thanks @sp90
• Fixed termination display
• Updated all translations, thanks to all translators

This release is a stable release that supersedes the 2.3.0.4 stable release. It contains all changes from the 2.3.1.0 and 2.3.1.1 beta releases.

Breaking change: Locked-down data folder permissions

This release hardens security around the data folder and is a breaking change for some setups.

For most users, this should not be a problem as the folders should already have the correct permissions.

Duplicati now requires that the data folder has the exact expected permissions, or it will refuse to use it. Previously, Duplicati would silently lock down the folder if it was not already locked.

To opt out of the permission check, you need to either pass --allow-insecure-datafolder, set the environment variable DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true, or place a file named insecure-permissions.txt in the installation folder.

Note that the previous method of placing insecure-permissions.txt in the data folder is no longer supported.

This change also applies to preload.json, such that it will only be loaded if the folder is trusted, or one of the opt-out methods are activated. Additionally, the previous trusted paths /usr/local/share/Duplicati/preload.json and C:\ProgramData\Duplicati\preload.json are no longer supported as they cannot be guaranteed to be locked down.

A preload.json inside the data folder is still supported, provided the folder passes the permission check.

The ConfigureTool has a new secure-datafolder command that can be used to force the correct permissions on the data folder.

For most users this should not cause any problems, as Duplicati has been locking down the folder already, but if you rely on lax folder permissions the setup needs to change. Some Docker setups may not be able to set the permissions and will need to apply DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true in the image to run without the protections.

Sync copy mode

This release adds an often requested feature that enables simple copying of files from source to destination.
Where the regular backups are deduplicated, compressed, encrypted and versioned, the new sync mode will instead simply copy from source to destination.

The copy is currently a one-way sync, where the source is replicated on the destination. Files can be deleted on the destination during sync (use --sync-then-delete), but destination folders will not be deleted.

The option --sync-remote-state is by default set to UseRemoteState which will list the destination and figure out what to upload. The setting UseLocalState uses a local database, similar to how backups work, to keep track of known remote files, and reduce the amount of remote listings done. Finally, the BlindlyUpload setting will just copy everything as-is to the remote.

The sync jobs support remote sources, snapshots, and multiple destinations. If snapshots are enabled, the copy is done from the snapshot, ensuring reliable reads.

Configuration of such a sync job is done the same way as with backup, but using a toggle option in the first step of the UI. Note that backup and sync jobs are not compatible as they use very different storage logic, so it is not possible to change the job mode after creating a job.

CLI mode also supports sync.

Improved Windows installer

This change brings a major update to the Windows installers, which now integrates the ability to run as a service, as well as generate and use TLS (https). The service feature has been present for a while in the WindowsService.exe tool and the TLS certificates were added as part of the Duplicati.CommandLine.ConfigureTool.exe. With this update these things are now integrated into the installer, and exposed as simple checkboxes to toggle the features. Installing the service from a regular user account, will also auto-generate a secure password and configure the TrayIcon to connect to the service (only for the current user).

If you have installed the service manually, do not activate the new checkbox as it only works if there is no pre-existing service. The installer-driven service does not support commandline arguments directly, but instead prefers preload.json files to configure it. The MSI supports the property INSTALL_PRELOAD=true which will cause it to pick up a preload.json file from the same folder the MSI is located in.

The Windows service is now also configured as delay-start service to avoid startup issues on boot.

Live reporting module

This release adds a new live-reporting module that sends the current progress of backups to a user-specified URL. The intention is that this can be used for dashboards that want to show the current progress for backups. By default, the module is not configured and has no impact.

The module supports multiple activity targets and includes metadata in the activity report, as well as a console-provided activity URL.

PAR2 parity / error-correction for remote volumes

This release adds a pluggable parity module that produces error-correction data for remote data volumes, so they can be repaired after bit-rot or corruption on the backend, thanks @JamBalaya56562.

To enable this, ensure that par2 is installed on the machine and set --parity-module=par2. Setting this will cause additional .par2 files to be uploaded.

Store configuration with backup

This release revives the store-task-config option and makes it enabled by default for encrypted backups. The backup configuration is stored with the backup data, making it easier to restore a configuration later.

For unencrypted backups, no secrets are stored by default. The behavior can be customized with options to store none, self, or all configurations, with or without secrets. The UI has been updated to allow restoring from the destination config. If multiple configurations are found, the user can select one or more backup configurations to restore.

MS365 subsites and shared mailboxes

This release improves the Microsoft 365 backup support with two additions.
Support for backing up SharePoint subsites has been added, making it possible to include sub-sites beneath a site collection in a backup.

The handling of shared mailboxes has also been improved, with better detection and enumeration of shared mailboxes within a tenant.

The license counting has been simplified. A Duplicati license is now required if an MS365 license is assigned, without needing per-user lookups. The same logic applies to both users and sites, and personal sites of users without a license are not counted. Filtering based on classification is still supported.

Full disk backup support (Windows, Linux, MacOS)

This release extends the full disk backup feature to support Linux and MacOS, in addition to Windows.

The Linux support allows backup and restore of entire disks on Linux, including partition tables. The MacOS support adds basic backup and restore of entire disks, including partition tables.

Partition-level backup and restore is now supported, making it possible to select individual partitions as backup sources, or restore a single partition from a full disk backup to a different partition.

Like the Office 365 / Google Workspace backup features, this is a proprietary module (source available).

Full disk backup requires administrative privileges to access the disk directly.
Full disk restore requires administrative privileges and requires that the disk is unmounted and not write-protected.

Desktop notifications on all platforms

Desktop notifications are now supported on all platforms. Windows toast notifications have been implemented with click-to-open support, and native notification support has been added for macOS and Linux (via DBus), thanks @JamBalaya56562 for the Windows implementation.

Restore reliability improvements

Several issues with the restore process have been fixed. Restores now properly respond to stop/abort requests, file reads and writes can be interrupted, and a critical bug with wrong seek offsets for partial blocks has been fixed, which could cause restores to fail, thanks @JamBalaya56562.

An index has been added on the restore file table join columns for better restore performance, thanks @JamBalaya56562.

Misconfigured filter detection

A new warning system detects when filters are configured to unconditionally exclude everything. A post-backup check also warns if no files were examined during backup, which helps catch misconfigurations that would otherwise silently produce empty backups.

New backends

Added support for Drime Cloud as a new storage backend.

Added a new backend for the Spanish provider Movistar, thanks @redmars27. The backend is marked as "untested" as it can only be used (and tested) by Movistar customers.

Deprecated backends

The previous "SharePoint" and "OneDrive for Business" backends have been marked as deprecated, as Microsoft shut down the API they were calling. The migration step is to use the "SharePoint v2" backend (renamed to just "SharePoint" in this version) which uses the Microsoft Graph API.

Duplicati Storage

This release includes Duplicati Storage which is integrated with the Duplicati console. Once a machine is connected to the console it can use the account's storage allocations with zero configuration required.

SharpAESCrypt v3

Updated the SharpAESCrypt encryption library to support "AES Crypt Stream Format v3", which has a number of improvements over the v2 format.
For this release, the default written format remains v2, but we encourage you to set the environment variable DUPLICATI__AES_VERSION=3 to test the new format.
Note: if you set this version to 3, the new remote volumes cannot be read by Duplicati versions older than 2.3.0.101.

Support for MacOS ACLs

This release adds support for reading MacOS attributes and ACL strings during backup, and restoring them when permission restores are selected.

Support for Windows Alternate Data Streams

This release implements support for reading and ...

2026-08-26 - 2.3.1.1_beta_2026-08-26

This release is a Beta release intended to be used for testing to identify any issues before releasing the next stable version.

Partition level full disk backup and restore

The full disk backup feature now supports selecting individual partitions as backup sources, in addition to entire disks. This makes it more intuitive to back up a specific partition without filtering.

Restore now also supports partition-to-partition restores, so it is possible to restore a single partition from a full disk backup, or restore a partition backup to a different partition.

Desktop notifications on all platforms

Desktop notifications are now supported on all platforms. Windows toast notifications have been implemented (with click-to-open support), and native notification support has been added for macOS and Linux (via DBus), thanks @JamBalaya56562.

Restore cancellation and reliability improvements

Several issues with the restore process have been fixed. Restores now properly respond to stop/abort requests, file reads and writes can be interrupted, and a critical bug with wrong seek offsets for partial blocks has been fixed, which could cause restores to fail for most files, thanks @JamBalaya56562.

Misconfigured filter detection

A new warning system detects when filters are configured to unconditionally exclude everything. A post-backup check also warns if no files were examined during backup, which helps catch misconfigurations that would otherwise silently produce empty backups.

More robust server connection

The remote server connection has been hardened against network events that could cause it to drop. A watchdog monitors the connection and restarts it if it has been unresponsive for an extended period.

Improved MS365 license counting

The MS365 license counting logic has been simplified. A Duplicati license is now required if an MS365 license is assigned, without needing per-user lookups. The same logic applies to both users and sites, and personal sites of users without a license are not counted.

Faster delete operations

The database query for deleting old backup versions has been optimized, significantly speeding up the delete operation for large backups.

Fixed index file recreation

An issue where recreated index files could be incomplete has been fixed. The index file recreation now happens after block volumes are fully processed, ensuring all blocklists are included. This fixes the intermittent "Found N faulty index files" verification error.

Security fix for credential leaks

Fixed an issue where credentials embedded in URLs could leak into log messages, but only on malformed URLs, thanks @JamBalaya56562.

Auto-configure database metadata

When using a source provider that requires database metadata (such as full disk backup), the --store-metadata-content-in-database option is now automatically applied when needed. This can still be overridden manually.

Detailed list of changes

• Added partition-level full disk backup and partition-to-partition restore support
• Added Windows toast notifications with click-to-open, thanks @JamBalaya56562
• Added macOS native notifications
• Added Linux DBus notifications
• Added detection and warning for misconfigured filters that exclude everything
• Added watchdog for more robust console connection handling
• Added automatic database metadata configuration for source providers that need it
• Added index on restore file table join columns for better restore performance, thanks @JamBalaya56562
• Added sync command to CLI help output
• Simplified MS365 license counting to check license assignment without per-user lookups
• Improved MS365 user/site listing with alphabetical sorting and fewer API calls
• Improved HyperV and MSSQL enumeration to handle errors gracefully
• Improved pagination for backend listing results
• Fixed wrong seek offset in restore when copying verified local blocks, which could break restores, thanks @JamBalaya56562
• Fixed restore not responding to stop/abort requests, thanks @JamBalaya56562
• Fixed restore cancellation not interrupting file reads and writes, thanks @JamBalaya56562
• Fixed local files being incorrectly marked as broken when a shutdown interrupted writes, thanks @JamBalaya56562
• Fixed requested shutdown being reported as a failure instead of a user-initiated stop, thanks @JamBalaya56562
• Fixed index file recreation producing incomplete index files
• Fixed similarly named paths being incorrectly excluded from backup sources
• Fixed quota errors being reported during read-only operations like restore, thanks @JamBalaya56562
• Fixed stale query statistics causing slow backups, thanks @JamBalaya56562
• Fixed backend statistics reporting unset timestamps in JSON output, thanks @JamBalaya56562
• Fixed legacy symlink folder restore using wrong path, thanks @JamBalaya56562
• Fixed slow query monitoring not tracking database queries, thanks @JamBalaya56562
• Fixed credentials leaking through URL sanitizer on malformed URLs, thanks @JamBalaya56562
• Fixed destination connection test failing on missing probe file, thanks @JamBalaya56562
• Fixed invalid update check interval being silently ignored, thanks @JamBalaya56562
• Fixed Google credentials not being read as service accounts, thanks @JamBalaya56562
• Fixed SharpAESCrypt version inconsistency across projects, thanks @JamBalaya56562
• Fixed Linux notifier using obsolete DBus API, thanks @JamBalaya56562
• Fixed Microsoft.Extensions packages left at older versions, thanks @JamBalaya56562
• Fixed SecretProvider package version alignment, thanks @JamBalaya56562
• Fixed Box folder lookup failing when folder name already exists, thanks @JamBalaya56562
• Fixed Box backend ignoring the requested path in entry lookups, thanks @JamBalaya56562
• Fixed IDrive e2 backend GetEntryAsync returning null for all paths, thanks @JamBalaya56562
• Fixed pCloud uploads not checking HTTP response status, thanks @JamBalaya56562
• Fixed Tahoe-LAFS deletes not checking response status, thanks @JamBalaya56562
• Fixed Filejump error handler infinite recursion causing stack overflow, thanks @JamBalaya56562
• Fixed Filen downloads not checking response status before decrypting, thanks @JamBalaya56562
• Fixed full disk provider not initializing when listing folders
• Updated all NuGet packages to latest versions
• Updated SSH.NET dependency
• Updated all translations, thanks to all translators
• Updated licenses project with missing packages

Changes in ngclient

• Added support for choosing sort order in the file tree
• Added support for partition-level full disk backup and restore in the UI
• Added warning if filters appear to exclude everything
• Added load-more pagination for file browsing
• Added prefill of restore options from configured settings, thanks @JamBalaya56562
• Added option to allow encryption changes for imported backups, thanks @JamBalaya56562
• Improved schedule summary with templates, reducing translation burden, thanks @JamBalaya56562
• Improved MS365 tenant counter display
• Disabled menu options that do not apply to sync jobs
• Fixed Chinese locale selection, thanks @JamBalaya56562 and @scambra
• Fixed source filter highlighting, thanks @JamBalaya56562
• Fixed commandline output auto-scrolling, thanks @JamBalaya56562
• Fixed remote source selection copy, thanks @JamBalaya56562
• Fixed destination editor identity preservation, thanks @JamBalaya56562
• Fixed usage statistics compatibility across UIs, thanks @JamBalaya56562
• Fixed absolute assets path ignoring X-Forwarded-Prefix header, thanks @scambra
• Updated all translations, thanks to all translators

This release is a canary release intended to be used for testing.

Database update to version 20

This release updates the local database schema to version 20. The update adds a label column to the fileset table and is applied automatically on first use. After the update, the database can no longer be opened by earlier versions of Duplicati. If you need to downgrade, the bundled database tool (duplicati-database-tool) can downgrade the database back to version 19; downgrading removes the labels, but otherwise causes no data loss.

Labels on backup versions

Backup versions can now carry an optional text label. Labels have no functional purpose, but they help mark and distinguish versions, for example when backups are hand-curated instead of running on a schedule. The CLI and UI supports setting and showing labels.

Partition-level backup and restore

It is now possible to select a single disk partition as the backup source, instead of selecting the full disk and filtering the unwanted partitions. Restores are likewise more flexible: in addition to disk-to-disk restores, a single partition can now be restored into a partition on another disk, creating the partition as needed.

This also fixes a bug where a failing priority file would leave the restore stuck until it was cancelled, and a number of issues with enumerating and filtering disks and partitions, in particular on Windows.

Automatic metadata storage for sources that need it

Backups using a source provider that relies on database metadata, such as the disk image provider, previously required the user to set --store-metadata-content-in-database=true manually. The setting is now applied automatically when the source needs it, and can still be overridden by setting the option explicitly.

QNAP packages

This release adds native QNAP package support. Similar to the Synology package, it integrates with the QNAP OS, uses the built-in authentication, and only allows access for administrators.

Stricter Google Cloud Storage credentials

Google Cloud Storage credentials are now read as service account credentials, which is what the options are documented to take. Other credential types, such as stored user credentials or external account configurations, are now refused. If you authenticate to Google Cloud Storage, or the Google Cloud secret provider, with anything other than a service account key, you need to switch to a service account key.

Detailed list of changes

• Updated all localizations, thanks to all translators
• Added labels to backup versions, with CLI, API, and UI support
• Added partition-level backup and partition-to-partition restore
• Fixed disk image provider not initializing when listing drives, and improved disk enumeration and filter handling on Windows
• Automatically enabled --store-metadata-content-in-database when the source provider requires it
• Added native QNAP package support
• Added a watchdog that restarts a stale remote management connection, and fixed issues that could drop the connection
• Google Cloud Storage credentials are now read strictly as service accounts, thanks @JamBalaya56562
• Fixed WebDAV destinations with a + in the path reporting uploaded files as missing, thanks @JamBalaya56562
• Fixed Windows file:// target URLs with a query string being misparsed
• Stopped reporting quota errors on read-only operations such as restore, thanks @JamBalaya56562
• Fixed stale SQLite query statistics causing extremely slow fileset and consistency queries on growing databases, thanks @JamBalaya56562
• Sped up cleanup after deleting a backup version by avoiding a full table scan
• Fixed a similarly named file and folder in the source causing the folder to be omitted, and allowed explicitly including a file inside an excluded folder
• Fixed backend statistics reporting a bogus zero timestamp in the operation log, thanks @JamBalaya56562
• Fixed Linux desktop notifications using an unsupported signal API, thanks @JamBalaya56562
• Fixed a restore with failing priority files getting stuck instead of failing
• Aligned SharpAESCrypt, AWSSDK.Core, Azure.Core, and Microsoft.Extensions package versions across the solution, thanks @JamBalaya56562

Updates to ngclient

• Added settings to control sorting of tree views
• Added support for editing version labels
• Disabled menu options that do not apply to sync jobs
• Fixed the destination editor mixing up connection state when a destination is removed, thanks @JamBalaya56562
• Allowed changing encryption settings for imported backups, thanks @JamBalaya56562
• Fixed the usage statistics setting not matching the format used by the legacy UI and server settings, thanks @JamBalaya56562
• Added a plain-language summary to the custom schedule editor, thanks @JamBalaya56562
• Added support for browsing disks and partitions and for restoring disk images and partitions
• Fixed Chinese locale selection, thanks @JamBalaya56562
• Fixed absolute asset paths ignoring the path prefix when running behind a reverse proxy, thanks @scambra
• Updated all translations, thanks to all translators

This release is a canary release intended to be used for testing.

Native desktop notifications

This release adds native desktop notifications on all supported desktop platforms. Backup results and other tray-icon notifications are now shown as real operating-system notifications instead of only appearing inside the UI.

On Windows, notifications are shown as Windows toast notifications with click-to-open support, thanks @JamBalaya56562. On macOS, notifications are shown via the native notification center. On Linux, notifications are sent over DBus and integrate with the desktop environment's notification daemon.

Native environment variable syntax on Linux and macOS

Paths and filters now support the native $VAR and ${VAR} environment variable syntax on Linux and macOS, most notably $HOME, thanks @JamBalaya56562. Previously only the Windows-style %VAR% syntax was expanded, so the native forms were silently left unexpanded on non-Windows systems.

The expansion is additive: %VAR% keeps working everywhere, and an undefined variable is left as-is. If you previously worked around this with literal $ characters in paths or filters, those entries will now be expanded.

Restore improvements and fixes

Several restore issues have been fixed in this release, thanks @JamBalaya56562. Restore now honors stop requests promptly: an abort interrupts in-progress file reads and writes, where it previously could keep running for minutes after the request. An aborted restore no longer reports errors, blames the backup, or leaks temporary files, and files that a shutdown interrupted are no longer listed as broken. A requested shutdown is in general no longer reported as a failure. Two bugs that could corrupt restored data were fixed: a wrong seek offset when copying verified local blocks, and an incorrect buffer copy when merging a hash fragment. Restore now also preserves the selected folder and applies configured default options (such as --restore-permissions) when the restore request does not explicitly specify them. On the legacy restore engine, restoring a directory symlink no longer creates a real folder in its place.

Stricter validation of settings

This release adds validation in places that previously failed silently, which may surface new warnings or errors after upgrading:

• Misconfigured filters are now detected and reported with a warning, instead of silently matching nothing.
• An unusable update check interval is now rejected instead of being ignored.
• An invalid webservice timezone now fails instead of being silently reset.

Detailed list of changes

• Let an abort interrupt the restore's file reads and writes, so a restore stops promptly, thanks @JamBalaya56562
• Stopped listing files interrupted by a shutdown as broken during restore, thanks @JamBalaya56562
• Stopped reporting a requested shutdown as a failure, thanks @JamBalaya56562
• Fixed the legacy restore engine creating a real folder in place of a directory symlink, thanks @JamBalaya56562
• Ran all main database queries through the slow-query monitor, so --long-database-query-threshold now warns about hanging queries, thanks @JamBalaya56562
• Added native desktop notifications: Windows toast notifications with click-to-open, macOS notifications, and Linux DBus notifications, thanks @JamBalaya56562
• Added support for native $VAR/${VAR} environment variable syntax in paths and filters on Linux and macOS, thanks @JamBalaya56562
• Made restore honor stop requests; aborted restores no longer report errors, blame the backup, or leak temp files, thanks @JamBalaya56562
• Fixed wrong seek offset when copying verified local blocks during restore, thanks @JamBalaya56562
• Fixed incorrect buffer copy when merging a hash fragment during restore, thanks @JamBalaya56562
• Preserved the selected folder during restore, thanks @JamBalaya56562
• Let configured default options apply when restore options are not specified, thanks @JamBalaya56562
• Prevented credentials from leaking through URL sanitizing on malformed URLs, thanks @JamBalaya56562
• Fixed corrupted target URL for local paths containing @, thanks @JamBalaya56562
• Matched backend URL schemes without regard to case, thanks @JamBalaya56562
• Fixed decoding of %uXXXX unicode escapes in URLs, thanks @JamBalaya56562
• Kept repeated path components in alternate update URLs, thanks @JamBalaya56562
• Parsed SSH, SMB, FTP, XMPP, pCloud, Tahoe-LAFS, and OAuth login URLs with the standard URI parser, thanks @JamBalaya56562
• Renamed the internal URL parser to RelaxedUri
• Removed unused parts of the relaxed URL parser and documented its constraints, thanks @JamBalaya56562
• Re-created missing index files after the block volumes are processed, thanks @JamBalaya56562
• Recomputed the next scheduled run when weekdays or interval change, thanks @JamBalaya56562
• Fixed logout not awaiting invalidation and not clearing the refresh cookie, thanks @JamBalaya56562
• Improved console connection reconnect handling and allowed concurrent message processing
• Guarded Hyper-V and MSSQL enumeration against errors
• Simplified MS365 seat counting and improved site classification
• Fixed MS365 user listing classification and return results sorted
• Fixed pagination when listing backend destination folders
• Treated an existing folder as success when auto-creating a destination, thanks @JamBalaya56562
• Made the connection test accept a missing probe file, thanks @JamBalaya56562
• Fixed Box folder resolution when the folder name is already in use, thanks @JamBalaya56562
• Fixed Box lookups ignoring the requested path, thanks @JamBalaya56562
• Fixed IDrive e2 reporting existing entries as missing, thanks @JamBalaya56562
• Reported the server error when a multipart upload fails, thanks @JamBalaya56562
• Observed read timeout on chunked uploads to Google and Dropbox, thanks @JamBalaya56562
• Checked response status before decrypting a Filen download, thanks @JamBalaya56562
• Checked response status before treating a pCloud upload as done, thanks @JamBalaya56562
• Checked response status when deleting a Tahoe-LAFS file, thanks @JamBalaya56562
• Fixed Filejump error handler calling itself indefinitely, thanks @JamBalaya56562
• Made BackendTester cleanup accept an already deleted file, thanks @JamBalaya56562
• Added detection of misconfigured filters with a warning
• Rejected unusable update check intervals instead of ignoring them, thanks @JamBalaya56562
• Failed on an invalid webservice timezone instead of silently resetting it, thanks @JamBalaya56562
• Updated the help text for the sync command
• Relaxed data folder permission checks for debug builds
• Synced Japanese and Chinese README files with the English version, thanks @JamBalaya56562
• Updated all packages to latest versions
• Updated SSH.NET and BouncyCastle dependencies
• Updated js-yaml, fast-uri, and postcss dependencies
• Updated the licenses project

Updates to ngclient

• Fixed commandline autoscrolling, thanks @JamBalaya56562
• Fixed source filter highlighting, thanks @JamBalaya56562
• Prefill restore settings from configured backup settings, thanks @JamBalaya56562
• Updated Google Workspace icon
• Fixed pagination in source tree
• Database query timeout is now a "short time" type
• Added a visual warning if filters are "exclude all"
• Use -filename* as the default new filter to avoid having exclude all as the default
• Updated all translations, thanks all translators