Borg Backup Server

v2.64.1 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 9d Backup & Recovery

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

backup backup-manager borg-backup borgbackup borgbackup-gui borgbackup-web-ui

+2 more

self-hosted web-gui

Summary

AI summary

Fixed installer hangs on fresh installs and restored SSH compatibility with older clients.

Type	Severity	Summary	CVE
Bugfix
Bugfix	Medium	Installer no longer hangs at Composer step on fresh installs. Installer no longer hangs at Composer step on fresh installs. Source: llm_adapter@2026-07-18 Confidence: low	—
Bugfix	Medium	Backups from older clients no longer fail with "connection closed by remote host". Backups from older clients no longer fail with "connection closed by remote host". Source: llm_adapter@2026-07-18 Confidence: low	—
Bugfix	Medium	Installer runs Composer non-interactively with visible output. Installer runs Composer non-interactively with visible output. Source: granite4.1:30b@2026-07-18-audit Confidence: low	—
Bugfix	Medium	Dependency lock pinned to minimum supported PHP for fresh installs. Dependency lock pinned to minimum supported PHP for fresh installs. Source: granite4.1:30b@2026-07-18-audit Confidence: low	—
Bugfix	Medium	Legacy SSH key‑exchange algorithms re‑enabled for older clients. Legacy SSH key‑exchange algorithms re‑enabled for older clients. Source: granite4.1:30b@2026-07-18-audit Confidence: low	—

Full changelog

Installer stuck at the Composer step on fresh installs (#351) — the installer could hang silently while installing PHP dependencies, and on Ubuntu 22.04 (PHP 8.1) the locked dependency set was incompatible with the platform. Composer now runs non-interactively with visible output, and the dependency lock is pinned to the minimum supported PHP so a clean install succeeds.
Backups from older clients failed with "connection closed by remote host" (#352) — a base-image update shipped a newer OpenSSH that had dropped the legacy key-exchange algorithms older clients rely on (e.g. Windows Server 2016, NAS boxes running Dropbear), so they were rejected during the SSH handshake. Legacy key-exchange support is now re-enabled alongside the existing legacy host-key support, and the compatibility settings refresh automatically on upgrade.

This is a server-only release; the agent is unchanged from v2.64.0.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Borg Backup Server

Get notified when new releases ship.

About Borg Backup Server

Centrally manage BorgBackup across endpoints