# proxbox-api v0.0.9 v0.0.9 | Field |Value | | --- | --- | | Canonical URL | https://emersonfelipesp.com/proxbox-api/releases/v0.0.9 | | GitHub URL | https://github.com/emersonfelipesp/proxbox-api/releases/tag/v0.0.9 | | Tag | v0.0.9 | | State | stable | | Author | emersonfelipesp | | Created | 2026-04-28 22:21 UTC | | Published | 2026-04-28 22:37 UTC | | Target | main | | Synced | 2026-08-24 18:36 UTC | | Assets | 0 | ## Release notes ## What's Changed ### New Features #### Controlled field sync with `overwrite_*` parameters (closes #335) Added `overwrite_vm_name`, `overwrite_vm_status`, `overwrite_vm_cluster`, `overwrite_vm_role`, `overwrite_vm_vcpus`, `overwrite_vm_memory`, `overwrite_vm_disk`, `overwrite_vm_platform` and corresponding device variants. When set to `false`, proxbox-api skips updating that field if a value already exists in NetBox, giving operators full control over which fields Proxmox is allowed to overwrite. The parameters are forwarded through all VM stream endpoints (`/virtualization/virtual-machines/full-update/stream`, individual sync, and bulk sync paths) — closes the gap where previously only the top-level endpoint honoured them. #### VM role left free when `VirtualMachineType` is available (closes #241) When Proxmox provides a VM type (e.g. `qemu`, `lxc`) that maps to a NetBox `VirtualMachineType`, the `role` field on the VM is now intentionally left unset. Previously a generic fallback role was always written, which polluted NetBox with low-value data. NetBox 4.6 native VM-type support makes the role field redundant for type classification. #### Python 3.14t (free-threaded) CI job A dedicated `test-free-threaded` job (Python 3.14t, GIL disabled) now runs in CI alongside the standard 3.12 job. It runs `continue-on-error: true` so it is non-blocking today, but serves as an early-warning signal for compatibility issues as the free-threaded CPython ecosystem matures. ### Bug Fixes #### VM tags preserved during sync (closes #337) Proxmox sync no longer overwrites existing NetBox VM tags. Previously, each sync cycle reset the `tags` list to only what Proxmox reported, silently removing any tags that operators had manually added in NetBox. Tags written by proxbox-api (e.g. `Proxmox`, node/cluster labels) are now merged with the existing tag set rather than replacing it. #### `sync_vm_network` and `overwrite_vm_*` forwarded to all stream endpoints The `sync_vm_network` flag and all `overwrite_vm_*` params were previously only respected at the top-level sync entry point. They are now forwarded correctly through the internal dispatch chain to the individual VM sync service, ensuring consistent behaviour across direct calls, SSE streams, and WebSocket paths. #### XSS vulnerability fixed in admin UI dependency (postcss) `postcss` in `nextjs-ui/` bumped to 8.5.10 via npm overrides to address a high-severity XSS vulnerability in the prior version. #### NetBox image pull-or-build fallback in E2E publish gates `netboxcommunity/netbox:v4.6.0-beta2` is not yet published on Docker Hub. Both `e2e-pre-publish` and `e2e-post-publish` CI jobs now fall back to building the NetBox image from source (same logic already present in `ci.yml`) so the publish E2E gates do not fail with docker exit code 125. ### Dependency Updates | Package | Old | New | Notes | |---|---|---|---| | `fastapi[standard]` | unpinned | `==0.136.1` | Pinned for reproducible builds | | `bcrypt` | `~=4.x` | `>=5.0.0,<6.0.0` | Major version bump, API-compatible | | `sqlmodel` | `0.0.22` | `0.0.38` | Latest upstream release | | `postcss` (nextjs-ui) | `<8.5.10` | `8.5.10` | Security fix via npm override | ### NetBox Compatibility - **Certified compatible with NetBox 4.6.0-beta1 and 4.6.0-beta2.** Full API audit confirmed no breaking changes between the two beta releases. - NetBox OpenAPI schema snapshots in `proxbox_api/generated/netbox/` refreshed for both beta releases. These snapshots drive runtime contract validation and the Pydantic model generator. ### CI/CD Improvements - **Pre- and post-publish E2E gates** added to the release workflow (`publish-testpypi.yml`). Before uploading to PyPI the pipeline spins up the full Docker stack (NetBox + Proxmox mock + proxbox-api) and verifies end-to-end connectivity. After publishing to Docker Hub, a second gate pulls the published images and smoke-tests them. - **Docker Hub publish wired to release workflow.** `docker-hub-publish.yml` is now called as a `workflow_call` from the release pipeline, ensuring images are always built from the exact release commit and pushed atomically with the PyPI package. - E2E matrix upgraded to test against NetBox 4.6.0-beta1 (and beta2 built from source when not yet on Docker Hub). - CI reliability fixes: ubuntu:24.04 base for NetBox image build (26.04 missing `libxmlsec1-openssl`), PEP 508 name prefix stripping in `DEV_OVERRIDES` to fix `uv` parse errors, fallback source-build path for NetBox images not yet published to Docker Hub. ### Full Changelog [v0.0.8.post1...v0.0.9](https://github.com/emersonfelipesp/proxbox-api/compare/v0.0.8.post1...v0.0.9) ## Assets No binary assets attached. Source archives: | Format |URL | | --- | --- | | zip | https://api.github.com/repos/emersonfelipesp/proxbox-api/zipball/v0.0.9 | | tar.gz | https://api.github.com/repos/emersonfelipesp/proxbox-api/tarball/v0.0.9 |