# Duplicati changelog

> Free backup software to store encrypted backups online.

- Vendor: Duplicati
- Category: Developer Tools
- Official site: https://duplicati.com
- Tracked by: What's New (https://whatsnew.fyi/product/duplicati)
- Harvested from: GitHub (duplicati/duplicati)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v2.3.1.0_beta_2026-07-28

- Date: 2026-07-28
- Version: v2.3.1.0_beta_2026-07-28
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.1.0_beta_2026-07-28
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.1.0-beta-2026-07-28
- Labels: Pre-release

- **security** — Require exact expected permissions on the data folder and refuse to use it if permissions are incorrect, with opt-out options via --allow-insecure-datafolder flag, DUPLICATI__ALLOW_INSECURE_DATAFOLDER environment variable, or insecure-permissions.txt in the installation folder
- **changed** — Move insecure-permissions.txt support from the data folder to the installation folder
- **removed** — Remove support for preload.json at /usr/local/share/Duplicati/preload.json and C:\ProgramData\Duplicati\preload.json
- **added** — Add secure-datafolder command to ConfigureTool to force correct permissions on the data folder
- **added** — Add sync copy mode that simply copies files from source to destination with options for --sync-then-delete and --sync-remote-state configuration
- **added** — Support remote sources, snapshots, and multiple destinations in sync jobs
- **added** — Integrate service installation and TLS certificate generation into the Windows installer with checkbox toggles
- **added** — Configure Windows service as delay-start service to avoid startup issues on boot
- **added** — Add live-reporting module that sends current backup progress to a user-specified URL
- **added** — Add PAR2 parity module for error-correction data on remote volumes with --parity-module=par2 option
- **added** — Enable store-task-config option by default for encrypted backups to store backup configuration with backup data
- **changed** — Allow customization of configuration storage for unencrypted backups with options to store none, self, or all configurations with or without secrets
- **added** — Update UI to allow restoring backup configuration from destination with support for selecting multiple backup configurations
- **added** — Add support for backing up SharePoint subsites beneath a site collection
- **changed** — Improve handling of Microsoft 365 shared mailboxes with better detection

This release is a Beta release intended to be used for testing to identify any issues before releasing the next stable version.

#### Breaking change: Locked-down data folder permissions

This release hardens security around the data folder and is a **breaking change** for some setups.

Duplicati now **requires** that the data folder has the exact expected permissions, or it will refuse to use it. Previously, Duplicati would silently lock down the folder if it was not already locked.

To opt out of the permission check, you need to either pass `--allow-insecure-datafolder`, set the environment variable `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true`, or place a file name `insecure-permissions.txt` in the installation folder.

Note that the previous method of placing `insecure-permissions.txt` in the data folder is no longer supported.

This change also applies to `preload.json`, such that it will only be loaded if the folder is trusted, or one of the opt-out methods are activated. Additionally, the previous trusted paths `/usr/local/share/Duplicati/preload.json` and `C:\ProgramData\Duplicati\preload.json` are no longer supported as they cannot be guaranteed to be locked down.

A `preload.json` inside the data folder is still supported, provided the folder passes the permission check.

The `ConfigureTool` has a new `secure-datafolder` command that can be used to force the correct permissions on the data folder.

For most users this should not cause any problems, as Duplicati has been locking down the folder already, but if you rely on lax folder permissions the setup needs to change. Some Docker setups may not be able to set the permissions and will need to apply `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true` in the image to run without the protections.

#### Sync copy mode

This release adds a often requested feature that enables simple copying of files from source to destination.
Where the regular backups are deduplicated, compressed, encrypted and versioned, the new sync mode will instead simply copy from source to destination.

The copy is currently a one-way sync, where the source is replicated on the destination. Files can be deleted on the destination during sync (use `--sync-then-delete`), but destination folders will not be deleted.

The option `--sync-remote-state` is by default set to `UseRemoteState` which will list the destination and figure out what to upload. The setting `UseLocalState` uses a local database, similar to how backups work, to keep track of known remote files, and reduce the amount of remote listings done. Finally, the `BlindlyUpload` setting will just copy everything as-is to the remote.

The sync jobs support remote sources, snapshots, and multiple destinations. If snapshots are enabled, the copy is done from the snapshot, ensuring reliable reads.

Configuration of such a sync job is done the same way as with backup, but using a toggle option in the first step of the UI. Note that backup and sync jobs are not compatible as they use very different storage logic, so it is not possible to change the job mode after creating a job.

CLI mode also supports sync.

#### Improved Windows installer

This change brings a major update to the Windows installers, which now integrates the ability to run as a service, as well as generate and use TLS (https). The service feature has been present for a while in the `WindowsService.exe` tool and the TLS certificates were added as part of the `Duplicati.CommandLine.ConfigureTool.exe`. With this update these things are now integrated into the installer, and exposed as simple checkboxes to toggle the features. Installing the service from a regular user account, will also auto-generate a secure password and configure the TrayIcon to connect to the service (only for the current user).

If you have installed the service manually, do not activate the new checkbox as it only works if there is no pre-existing service. The installer-driven service does not support commandline argume

_[Truncated at 4000 characters — full notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.1.0_beta_2026-07-28]_

### v2.3.0.108_canary_2026-07-20

- Date: 2026-07-20
- Version: v2.3.0.108_canary_2026-07-20
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.108_canary_2026-07-20
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.108-canary-2026-07-20
- Labels: Pre-release

- **added** — Support for backing up SharePoint subsites beneath a site collection
- **changed** — Improved detection and enumeration of shared mailboxes within a Microsoft 365 tenant
- **changed** — License counter now excludes shared mailboxes without a license and supports top-level filtering of users, sites, and groups based on classification
- **added** — Information button on the source page showing a summary of content found in the Microsoft 365 tenant
- **added** — Option to perform case-insensitive matching of remote filenames
- **changed** — Improved filter parsing logic to handle more edge cases and produce more predictable results
- **added** — Support for `wipe-encryption` command in the database tool to remove all encrypted fields from a server database
- **fixed** — BackendTester now actually retries failed uploads
- **fixed** — The `--restore-preallocate-size` option now has an effect
- **added** — Re-introduce `insecure-permissions.txt` file in install folder
- **changed** — Use the application data folder for the control directory filter
- **fixed** — Several options declared as Integer that are not integers
- **fixed** — Broken date-time format strings
- **fixed** — Secure-datafolder for service permissions
- **fixed** — Restore-control-files with non-standard options
- **changed** — Unify `--datafolder` option name in configuretool
- **fixed** — Loading of locale files with hyphenated culture names
- **added** — Option to manually start a console-managed backup
- **added** — Support for `tr` and `ko` languages in the UI
- **fixed** — Error attempting to save a backup with a schedule

This release is a canary release intended to be used for testing.

If no major faults are found, **this release is intended to be the basis of the next beta release**.

#### MS365 subsites and shared mailboxes

This release improves the Microsoft 365 backup support with two additions.
Support for backing up SharePoint subsites has been added, making it possible
to include sub-sites beneath a site collection in a backup.

The handling of shared mailboxes has also been improved, with better detection
and enumeration of shared mailboxes within a tenant.

The license counter now excludes shared mailboxes without a license, and supports
top-level filtering of users/sites/groups based on classification.

An extra information button is added to the source page that shows a summary
of what content was found in the MS365 tenant.

#### Case-insensitive remote filename matching

A new option has been added to perform case-insensitive matching of remote
filenames. This helps with backends that do not preserve filename casing, and
prevents issues where files cannot be found because of case differences.

#### Improved filter parsing

The filter parsing logic has been improved to handle more edge cases and
produce more predictable results when building filter expressions.

#### Added `wipe-encryption` to database tool

The database tool now supports a `wipe-encryption` command that can be used to remove all encrypted fields from a server database. With this command it is possible to get an encrypted database back into a state where it can be opened again. After encrypted fields are wiped, the user can then edit backups and settings to replace the lost data.

##### Detailed list of changes

- Make BackendTester actually retry failed uploads, thanks @JamBalaya56562
- Fix `--restore-preallocate-size` option having no effect, thanks @JamBalaya56562
- Re-introduce `insecure-permissions.txt` file in install folder
- Use the application data folder for the control directory filter, thanks @JamBalaya56562
- Fix several options declared as Integer that are not integers, thanks @JamBalaya56562
- Add case-insensitive remote filename matching, thanks @JamBalaya56562
- Fix broken date-time format strings, thanks @JamBalaya56562
- Fix secure-datafolder for service permissions
- Log errors when user-supplied settings fail to parse, thanks @JamBalaya56562
- Support MS365 subsites in backup and restore
- Updated all translations, thanks to all translators
- Fixed pulling mulitple new languages
- Improve MS365 shared mailbox handling and item classification
- Improve filter parsing with regards to embedded path separators
- Fixed restore-control-files with non-standard options
- Unify `--datafolder` option name in configuretool
- Fail the backend test when verification finds a problem, thanks @JamBalaya56562
- Use local executable name for configuretool
- Fix loading of locale files with hyphenated culture names, thanks @JamBalaya56562

##### UI updates

- Added option to manually start a console-managed backup
- Added `tr` and `ko` languages to the UI
- Updated all translations, thanks to all translators
- Fixed an error attempting to save a backup with a schedule
- Added button to show MS365 tenant counters

### v2.3.0.107_canary_2026-07-13

- Date: 2026-07-13
- Version: v2.3.0.107_canary_2026-07-13
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.107_canary_2026-07-13
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.107-canary-2026-07-13
- Labels: Pre-release

- **security** — Require exact permissions on the data folder and refuse to use it if permissions are incorrect, with opt-out available via --allow-insecure-datafolder flag or environment variable
- **added** — Add secure-datafolder command to ConfigureTool to set correct permissions on the data folder
- **added** — Add live reporting module for sending backup progress to a user-specified URL
- **added** — Add pluggable PAR2 parity module system for error-correction of remote volumes
- **changed** — Improve TLS certificate validation and fall back to OS-default certificate validator
- **changed** — Lock the server database with a busy timeout to prevent concurrent access issues
- **changed** — Improve metadata update handling to better show remote versions
- **fixed** — Guard the compact operation against race conditions
- **fixed** — Fix database inconsistency after shared metadata delete
- **fixed** — Avoid secondary transaction errors after repair failure
- **fixed** — Delete the incomplete recreate database when the remote is empty
- **fixed** — Stabilize ZipFallback database cleanup on Windows
- **fixed** — Reset restore rendezvous barriers per operation
- **fixed** — Fix test-filters ignoring --source from a parameters file
- **removed** — Remove redundant cancel button from restore progress
- **fixed** — Do not attach stack traces to known-problem path warnings
- **changed** — Make CLI find search all backup versions by default
- **changed** — Use effective dbpath for show-log and delete-db endpoints
- **changed** — Report script execution in operation status
- **added** — Add commandline target URL done action

This release is a canary release intended to be used for testing.

If no major faults are found, **this release is intended to be the basis of the next beta release**.

#### Breaking change: Locked-down data folder permissions

This release hardens security around the data folder and is a **breaking change** for some setups.

Duplicati now **requires** that the data folder has the exact expected permissions, or it will refuse to use it. Previously, Duplicati would silently lock down the folder if it was not already locked. The previous `insecure-permissions.txt` opt-out file is no longer supported.

The only way to opt out of the permission check is to pass `--allow-insecure-datafolder` or set the environment variable `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true`. This setting can be placed in `preload.json`, but only if _that_ file is in a trusted location (the directory with the binaries, or the path pointed to by `DUPLICATI_PRELOAD_SETTINGS`). The previous trusted paths `/usr/local/share/Duplicati/preload.json` and `C:\ProgramData\Duplicati\preload.json` are no longer supported as they cannot be guaranteed to be locked down.

A `preload.json` inside the data folder is still supported, provided the folder passes the permission check.

The `ConfigureTool` has a new `secure-datafolder` command that can be used to force the correct permissions on the data folder.

For most users this should not cause any problems, as Duplicati has been locking down the folder already, but if you rely on lax folder permissions the setup needs to change. Some Docker setups may not be able to set the permissions and will need to apply `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true` in the image to run without the protections.

##### Feedback requested

We are grateful for any feedback on changes or hints for how we can lessen the impact before the next stable release.

#### Live reporting module

This release adds a new live-reporting module that sends the current progress of backups to a user-specified URL. The intention is that this can be used for dashboards that want to show the current progress for backups. By default, the module is not configured and has no impact.

The module supports multiple activity targets and includes metadata in the activity report, as well as a server-provided activity URL.

#### PAR2 parity / error-correction for remote volumes

This release adds a pluggable parity module that produces error-correction data for remote data volumes, so they can be repaired after bit-rot or corruption on the backend, thanks @JamBalaya56562.

A pluggable `IParity` module system is introduced, mirroring the existing compression/encryption modules. The default `Par2Parity` implementation shells out to the `par2` (par2cmdline) program. If the `par2` command is installed this will transparently handle creating and using parity files to guard against flipped bits.

#### Improved TLS certificate validation

The TLS certificate validation has been improved, and Duplicati now falls back to using the OS-default certificate validator. This should resolve issues with custom certificate chains and improve compatibility with various TLS setups.

##### Detailed list of changes

- Locked down data folder permissions and require exact permissions, with opt-out via `--allow-insecure-datafolder`
- Added `secure-datafolder` command to the ConfigureTool
- Added a live reporting module for sending backup progress to a URL
- Added pluggable PAR2 parity module for error-correction of remote volumes, thanks @JamBalaya56562
- Improved TLS certificate validation and fallback to OS-default validator
- Locked the server database with a busy timeout to prevent concurrent access issues
- Improved metadata update handling to better show remote versions
- Guarded the compact operation against race conditions
- Fixed database inconsistency after shared metadata delete
- Avoid secondary transaction errors after repair failure, thanks @JamBalaya56562
- Delete the incomplete r

_[Truncated at 4000 characters — full notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.107_canary_2026-07-13]_

### v2.3.0.4_stable_2026-07-09

- Date: 2026-07-09
- Version: v2.3.0.4_stable_2026-07-09
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.4_stable_2026-07-09
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.4-stable-2026-07-09

- **security** — Improved handling of filtered paths so that paths excluded by filters are no longer accessed
- **security** — Filter sensitive paths out of reported log data
- **security** — Use default OS certificate validator for reports
- **security** — Block path traversal in recovery tool
- **fixed** — Fixed memory leak that could occur when backing up the macOS Photos library
- **fixed** — Fixed startup race condition in the Agent that could cause instability on launch
- **fixed** — Made the backup process more robust against metadata errors to prevent crash
- **added** — Add configurable authentication timeout to the Duplicati backend
- **fixed** — Fixed retry of HTTP messages for transient failures
- **fixed** — Fixed handling of MSSQL default instances
- **fixed** — Corrected option types for the S3 lock mode
- **added** — Allow disable default secret provider
- **changed** — Improved secret provider loader and license checker for greater flexibility
- **changed** — Updated libsecret integration to work better with KDE
- **fixed** — Prevent creating a useless encryption key in certain scenarios
- **fixed** — Fixed incorrect help text
- **added** — Add server-side filter evaluation
- **changed** — Updated rclone in Docker images
- **fixed** — Fixed minor issues with remote sources
- **added** — Added ability to browse for a destination path in ngclient

#### About this release

This release patches version 2.3.0.3 with fixes for a number of issues that were discovered after the release.
The main focus of this release is stability and security hardening, along with a few backend and configuration improvements.

##### Security and Privacy

We improved handling of filtered paths so that paths excluded by filters are no longer accessed, and sensitive paths are now filtered out of reported log data. For reports we now rely on the OS default certificate validator.

##### Stability Fixes

We fixed a memory leak that could occur when backing up the macOS Photos library, and fixed a startup race condition in the Agent that could cause instability on launch.
We also made the backup process more robust against metadata errors, preventing a crash that could otherwise abort the backup.

##### Backend and Configuration Improvements

The Duplicati backend now has a configurable authentication timeout, and the HTTP message sending logic now retries transient failures correctly.
We also fixed the handling of MSSQL default instances, and corrected the option types for the S3 lock mode so the correct values are displayed.

##### Secret Provider and Licensing

It is now possible to disable the default secret provider, and the secret provider loader has been improved together with the license checker for greater flexibility.
The libsecret integration was updated to work better with KDE, and we now prevent creating a useless encryption key in certain scenarios.

##### Other Changes

This release adds server-side filter evaluation, fixes a few minor issues with remote sources, updates rclone in the Docker images, and corrects some incorrect help text.

##### Detailed list of changes:

- Allow disable default secret provider
- Block path traversal in recovery tool
- Add server-side filter eval
- Improve license flexibility
- Add an auth timeout to the Duplicati backend
- Avoid crash on metadata error
- Filter paths in reported log data
- Don't access filtered path
- Fixed retry of HTTP messages
- Fix incorrect option types for lock mode
- Fix MSSQL default instance handling
- Update libsecret for KDE
- Improve secret provider and license checker
- Prevent creating a useless key
- Fix incorrect help text
- Fix Agent startup race
- Fix MacOS Photos memory usage
- Update rclone in Docker images
- Fix minor issues with remote sources
- Use default OS certificate validator

##### Updates to ngclient

- Prevent frontend from requesting lock repair override
- Added ability to browse for a destination path.
- Added support for browsing MS365 and Google Workspace, so filters can be applied while content is visible.
- Added support for server-side filters in treeview.
- Showing shortcuts in pickers as we can now resolve them.
- Added a debouncer to filter calls.
- Added error indicator to tree view.
- Clean up target disk layout.
- Apply extended search only if we are restoring from a destination that needs it.
- Include server-only options, if any.
- Better Google Workspace error messages.
- Fixes to allow listing full disks on Windows.
- Fixed issue with evaluating globbing.

### v2.3.0.106_canary_2026-07-03

- Date: 2026-07-03
- Version: v2.3.0.106_canary_2026-07-03
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.106_canary_2026-07-03
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.106-canary-2026-07-03
- Labels: Pre-release

- **added** — Sync copy mode that enables simple one-way copying of files from source to destination without deduplication, compression, encryption or versioning
- **added** — Option --sync-then-delete to delete files on the destination during sync
- **added** — Option --sync-remote-state with settings UseRemoteState, UseLocalState, and BlindlyUpload to control how destination state is tracked
- **added** — Support for remote sources, snapshots, and multiple destinations in sync jobs
- **added** — UI toggle option to configure sync jobs in the first step, with sync and backup jobs being incompatible modes
- **added** — CLI mode support for sync
- **added** — Option --restore-all-files to restore files matching a filter from multiple versions
- **added** — Restore callback module
- **added** — Option to control OCSP/CRL failure handling
- **added** — UI support for editing sync jobs
- **changed** — Update localizations
- **changed** — Show multiple destinations on overview
- **changed** — Updated ShipUI and Angular
- **changed** — Improved the secret provider loader and license checker
- **changed** — Bumped SQLite and StreamJson dependencies
- **fixed** — MacOS Photos memory usage
- **fixed** — Agent startup race condition
- **fixed** — Incorrect help text for remote locks
- **fixed** — Issue with forcing lock refresh
- **fixed** — Prevent creating a useless encryption key on startup
- **fixed** — Warn when VCRedist is missing on VSS failure

This release is a canary release intended to be used for testing.

#### Sync copy mode

This release adds a often requested feature that enables simple copying of files from source to destination.
Where the regular backups are deduplicated, compressed, encrypted and versioned, the new sync mode will instead simply copy from source to destination.

The copy is currently a one-way sync, where the source is replicated on the destination. Files can be deleted on the destination during sync (use `--sync-then-delete`), but destination folders will not be deleted.

The option `--sync-remote-state` is by default be set to `UseRemoteState` which will list the destination and figure out what to upload. The setting `UseLocalState` uses a local database, similar to how backups work, to keep track of known remote files, and reduce the amount of remote listings done. Finally, the `BlindlyUpload` setting will just copy everything as-is to the remote.

The sync jobs support remote sources, snapshots, and multiple destinations. If snapshots are enabled, the copy is done from the snapshot, ensuring reliable reads.

Configuration of such a sync job is done the same way as with backup, but using a toggle option in the first step of the UI. Note that backup and sync jobs are not compatible as they use very different storage logic, so it is not possible to change the job mode after creating a job.

CLI mode also supports sync.

#### Multi version restore

A new option, `--restore-all-files` can be used to restore files matching a filter from multiple versions. This can be used to select specific versions and then restore a set of files in all versions. This option does not currently have a UI component.

##### Detailed list of changes

- Fix MacOS Photos memory usage.
- Fix Agent startup race condition.
- Warn when VCRedist is missing on VSS failure.
- Update localizations.
- Fix incorrect help text for remote locks.
- Added a restore callback module.
- Added support for restoring files across multiple versions.
- Added a sync command to the Controller and CLI.
- Prevent creating a useless encryption key on startup.
- Added an option to control OCSP/CRL failure handling.
- Improved the secret provider loader and license checker.
- Bumped SQLite and StreamJson dependencies.

##### UI changes

- Added support for editing sync jobs
- Show multiple destinations on overview
- Updated localizations
- Fixed issue with forcing lock refresh
- Updated ShipUI and Angular

### v2.3.0.105_canary_2026-06-24

- Date: 2026-06-24
- Version: v2.3.0.105_canary_2026-06-24
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.105_canary_2026-06-24
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.105-canary-2026-06-24
- Labels: Pre-release

- **added** — Store backup configuration with backup data, enabled by default for encrypted backups
- **added** — Support for reading and restoring MacOS attributes and ACL strings during backup and restore
- **added** — Support for reading and writing Windows Alternate Data Streams with the advanced option --enable-ads-backup
- **added** — Searching in metadata for remote sources
- **added** — Auth timeout to Duplicati backend
- **added** — Unified interface for remote browsing with browse button for destination configuration
- **added** — Server-side filter evaluation when filters are not simple filters
- **added** — Ability to restore from remote config in ngclient
- **added** — Ability to browse for a destination path in ngclient
- **changed** — Missing sources now trigger a warning instead of aborting the backup by default
- **changed** — Database paths are now stored relative to the data folder by default
- **changed** — License usage calculation to allow filtering items before counting towards limits
- **changed** — Source tree to show content of remote sources including Microsoft 365 tenants and Google Workspace subscriptions
- **changed** — Helper entries like My Documents now resolve to full paths in all picker situations
- **changed** — Updated rclone in Docker images to use recent releases
- **fixed** — MSSQL backups for default instance configuration
- **fixed** — Incorrect option types for lock mode now showing as enums in the UI
- **fixed** — Retry of HTTP messages
- **fixed** — Case-insensitive search and exposed the flag in the API
- **fixed** — Case-change issue with USN on Windows

#### 2026-06-24 - 2.3.0.105_canary_2026-06-24

This release is a canary release intended to be used for testing.

#### Store configuration with backup

This release revives the `store-task-config` option and makes it enabled by default for encrypted backups. The backup configuration is stored with the backup data, making it easier to restore a configuration later.

For unencrypted backups, no secrets are stored by default. The behavior can be customized with options to store none, self, or all configurations, with or without secrets. The UI has been updated to allow restoring from the destination config. If multiple configurations are found, the user can select one or more backup configurations to restore.

#### Support for MacOS ACLs

This release adds support for reading MacOS attributes and ACL strings during backup, and restoring them when permission restores are selected.

#### Support for Windows Alternate Data Streams

This release implements support for reading and writing alternate data streams (ADS) on Windows. This feature is disabled by default and can be enabled with the advanced option `--enable-ads-backup`. If ADS content is found in the source, this is restored by default but can be disabled with `--disable-ads-restore`.

#### Fixed MSSQL backups

Since 2.1 the MSSQL backups would produce errors if attempting to back up an MSSQL server that was running as the default instance, but would work with a named instance. This release fixes the issue and now handles both default- and named instances.

#### Improved missing source handling

The default behavior when sources are missing has changed. Previously, a missing source would abort the backup. Now, a missing source will only trigger a warning unless the option `--abort-if-source-missing` is set. The option `--allow-missing-source` can still be used to suppress warnings entirely. If no sources are found at all, the backup will still abort.

#### Relative database paths

Database paths are now stored relative to the data folder by default. This makes it simpler to move the data folder as the paths are not stored in full. Existing backups retain their full paths, but manually updating a database path will make it relative if it is within the data folder.

#### Updated LibSecret support for KDE

The LibSecret support has been updated to work correctly on KDE Plasma 5+6. The default collection alias is now properly resolved, fixing issues where a new collection named `default` would be created incorrectly.

#### License flexibility in MS365 and Google Workspace

The way license usage is calculated has been updated. Enumeration is now applied without imposing limitations, but actually reading the items is limited. This allows filtering unwanted items before they count towards usage.

#### Improved source tree

To make it easier to see what data is included, the source tree will now show the content of remote sources, including Microsoft 365 tenants, Google workspace subscriptions and full-disk content.

##### Easier filter configuration

Expanding the content will show item inclusion state. Clicking items will toggle them, similar to how regular file select works. This allows selective backup of remote data, such as picking which MS365 mailboxes to include.

For the full-disk selection is now possible to select an entire disk as the source, or select the individual partitions.

##### Server-side filters

Additionally, the filter evaluation will now be performed server-side if the filters are not "simple filters". When a non-trivial filter is in the list, the C# code will be asked to evaluate the list and produces the filtered results which are then displayed. This increases the correctness of the displayed filter state because the same code is now used for both display and actual backup operations.

##### Resolve helper entries

The helper entries, like "My Documents" are now show in all picker situations and resolve to the full path. This makes it possible to use thes

_[Truncated at 4000 characters — full notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.105_canary_2026-06-24]_

### v2.3.0.3_stable_2026-06-10

- Date: 2026-06-10
- Version: v2.3.0.3_stable_2026-06-10
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.3_stable_2026-06-10
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.3-stable-2026-06-10

- **fixed** — Optimized synthetic filelist creation process to improve performance and prevent dangling metadata entries
- **added** — Added failsafe checks to ensure synthetic filelists are always valid
- **fixed** — Fixed remote file locking issue that could cause database locking problems
- **fixed** — Fixed S3 lock mode configuration to show correct values
- **fixed** — Fixed SMB backend issue where files could be incorrectly treated as folders
- **fixed** — Fixed timeout issue in OneDrive backend where slow transfers could trigger unexpected timeout
- **deprecated** — Deprecated OneDrive for Business and SharePoint backends in favor of Microsoft Graph backend
- **added** — Made Duplicati storage backend publicly available for backup destinations
- **added** — Added --exclude-non-local-files option to exclude files stored in cloud services
- **fixed** — Fixed warnings when backing up macOS Photos folder
- **changed** — Improved error messages with additional guidance on how to resolve issues
- **changed** — Renamed Office 365 branding to Microsoft 365
- **changed** — Persist the used compression module in backup metadata
- **fixed** — Fixed folders incorrectly showing as files in the filesystem API
- **added** — Added support for extended Win32 file attributes in backups
- **fixed** — Fixed issue where file size would not be shown in the file tree
- **fixed** — Fixed issue with using stored destinations which would fail to create folders
- **fixed** — Fixed issue with importing backups where schedule edits would be ignored
- **fixed** — Fixed off-by-one issue with scheduled backup dates when edited
- **changed** — Optimized ngclient query flow to use websockets instead of polling

#### About this release

This release patches version 2.3.0.1 with fixes for a few issues that were discovered after the release.
This is the same as the 2.3.0.2 release but with a few additional fixes that were missed by the 2.3.0.2 release.

##### Reliability Fixes

This release optimizes the synthetic filelist creation process to improve performance significantly. Additionally, there are a few added failsafe checks to ensure syntehtic filelists are always valid.

We also fixed an issue with remote-file locking that could (ironically) cause database locking issues in some cases. And we fixed the S3 lock mode configuration to show the correct values.

##### Backend Fixes and Improvements

We fixed an issue where the SMB backend could incorrectly treat files as folders giving warnings when attempting to enumerate them. We also fixed a timeout issue for OneDrive where slow transfers could trigger an unexpected timeout.

The OneDrive for Business and SharePoint backends have been deprecated in favor of the Microsoft Graph backend, as the older backends relied on an API that is no longer supported.

We also made the Duplicati storage backend publicly available, so you can now use Duplicati storage for your backups. Duplicati storage is integrated with the Duplicati Console, so there is zero storage configuration needed on the client.

##### Platform and Restore Improvements

This release also features a new option `--exclude-non-local-files` that can be used to exclude files that are stored in the cloud, such as OneDrive, Dropbox, etc.

We also fixed an issue causing warnings when doing backups of the MacOS Photos folder, and improved some error messages to include more guidance on how to resolve them.

##### Detailed list of changes:

- Renamed Office 365 branding to Microsoft 365
- Optimized synthetic filelist creation to prevent dangling metadata entries
- Improved Docker image build configuration
- Persist the used compression module in backup metadata
- Updated usage reporter integration
- Improved websocket handling for remote management connections
- Fixed Filen backend CI and authentication issues
- Added failsafe checks for synthetic filelist metadata
- Improved restore messages with additional result details
- Deprecated older OneDrive and SharePoint backends
- Fixed folders incorrectly showing as files in the filesystem API
- Added defensive handling for macOS Photos library timestamps
- Updated MEGA S4 endpoints for S3 backend
- Improved snapshot error messages with permission guidance
- Fixed timeout handling in OneDrive backend
- Updated Duplicati backend with improved timeout options
- Removed explicit defaults from new backup template
- Cleaned up remote controller registration state handling
- Fixed SMB backend issue where files could be treated as folders
- Fixed remote file locking on Windows
- Fixed S3 lock mode configuration
- Added support for extended Win32 file attributes in backups
- Update Avalonia to avoid DirectX dependency
- Improved handling of expired links
- Fix incorrect quota size reported
- Fixed version based search for restored
- Added guard when deleting old versions
- Log 500 errors to system log or local local
- Detect if locking is used when recreating database
- Support the do-not-track environment variable
- Guard against secret provider init failure

##### Updates to ngclient

- Added toggle to show advanced option names instead of descriptions
- Added confirmation popup before exporting configuration without encryption
- Now showing remote lock results on log page
- Fixed websocket not connecting on welcome page
- Added a welcome page for simpler console connections
- Removed attributes filter options on source page, in favor of using advanced options
- Prevent iteration of non-folder paths
- Enable selecting hidden items
- Added path resolving on the "dynamic paths", such as "My documents"
- Fixed compression option not being visible
- Added support for showing backends as deprecated

_[Truncated at 4000 characters — full notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.3_stable_2026-06-10]_

### v2.3.0.2_stable_2026-06-10

- Date: 2026-06-10
- Version: v2.3.0.2_stable_2026-06-10
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.2_stable_2026-06-10
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.2-stable-2026-06-10

- **changed** — Optimized synthetic filelist creation process to improve performance and prevent dangling metadata entries
- **added** — Failsafe checks to ensure synthetic filelists are always valid
- **fixed** — Remote-file locking issue that could cause database locking in some cases
- **fixed** — S3 lock mode configuration to show the correct values
- **fixed** — SMB backend incorrectly treating files as folders and giving warnings when attempting to enumerate them
- **fixed** — OneDrive timeout issue where slow transfers could trigger an unexpected timeout
- **deprecated** — OneDrive for Business and SharePoint backends in favor of the Microsoft Graph backend
- **added** — Duplicati storage backend now publicly available for use in backups with zero storage configuration needed on the client
- **added** — New option --exclude-non-local-files to exclude files stored in the cloud such as OneDrive and Dropbox
- **fixed** — Warnings when doing backups of the MacOS Photos folder
- **changed** — Renamed Office 365 branding to Microsoft 365
- **changed** — Persist the used compression module in backup metadata
- **fixed** — Filen backend CI and authentication issues
- **changed** — Improved error messages to include more guidance on how to resolve them
- **changed** — Improved websocket handling for remote management connections
- **fixed** — Folders incorrectly showing as files in the filesystem API
- **changed** — Improved snapshot error messages with permission guidance
- **added** — Defensive handling for macOS Photos library timestamps
- **changed** — Updated MEGA S4 endpoints for S3 backend
- **added** — Support for extended Win32 file attributes in backups

#### About this release

This release patches version 2.3.0.1 with fixes for a few issues that were discovered after the release.

##### Reliability Fixes

This release optimizes the synthetic filelist creation process to improve performance significantly. Additionally, there are a few added failsafe checks to ensure syntehtic filelists are always valid.

We also fixed an issue with remote-file locking that could (ironically) cause database locking issues in some cases. And we fixed the S3 lock mode configuration to show the correct values.

##### Backend Fixes and Improvements

We fixed an issue where the SMB backend could incorrectly treat files as folders giving warnings when attempting to enumerate them. We also fixed a timeout issue for OneDrive where slow transfers could trigger an unexpected timeout.

The OneDrive for Business and SharePoint backends have been deprecated in favor of the Microsoft Graph backend, as the older backends relied on an API that is no longer supported.

We also made the Duplicati storage backend publicly available, so you can now use Duplicati storage for your backups. Duplicati storage is integrated with the Duplicati Console, so there is zero storage configuration needed on the client.

##### Platform and Restore Improvements

This release also features a new option `--exclude-non-local-files` that can be used to exclude files that are stored in the cloud, such as OneDrive, Dropbox, etc.

We also fixed an issue causing warnings when doing backups of the MacOS Photos folder, and improved some error messages to include more guidance on how to resolve them.

##### Detailed list of changes:

- Renamed Office 365 branding to Microsoft 365
- Optimized synthetic filelist creation to prevent dangling metadata entries
- Improved Docker image build configuration
- Persist the used compression module in backup metadata
- Updated usage reporter integration
- Improved websocket handling for remote management connections
- Fixed Filen backend CI and authentication issues
- Added failsafe checks for synthetic filelist metadata
- Improved restore messages with additional result details
- Deprecated older OneDrive and SharePoint backends
- Fixed folders incorrectly showing as files in the filesystem API
- Added defensive handling for macOS Photos library timestamps
- Updated MEGA S4 endpoints for S3 backend
- Improved snapshot error messages with permission guidance
- Fixed timeout handling in OneDrive backend
- Updated Duplicati backend with improved timeout options
- Removed explicit defaults from new backup template
- Cleaned up remote controller registration state handling
- Fixed SMB backend issue where files could be treated as folders
- Fixed remote file locking on Windows
- Fixed S3 lock mode configuration
- Added support for extended Win32 file attributes in backups

##### Updates to ngclient

- Added toggle to show advanced option names instead of descriptions
- Added confirmation popup before exporting configuration without encryption
- Now showing remote lock results on log page
- Fixed websocket not connecting on welcome page
- Added a welcome page for simpler console connections
- Removed attributes filter options on source page, in favor of using advanced options
- Prevent iteration of non-folder paths
- Enable selecting hidden items
- Added path resolving on the "dynamic paths", such as "My documents"
- Fixed compression option not being visible
- Added support for showing backends as deprecated or untested
- Fixed an issue where file size would not be shown in the file tree
- Added an option to retry loading a backup list
- Show "last backup" with the same date in both detail and grid view
- Show actual scheduled time for backups
- Fixed an issue with using stored destinations which would fail to create folders
- Fixed an issue with importing backups where the schedule edits would be ignored
- Fixed an issue where the date for a scheduled backup would be off-by-one when edited
- Optimized que

_[Truncated at 4000 characters — full notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.2_stable_2026-06-10]_

### v2.3.0.104_canary_2026-06-04

- Date: 2026-06-04
- Version: v2.3.0.104_canary_2026-06-04
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.104_canary_2026-06-04
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.104-canary-2026-06-04
- Labels: Pre-release

- **added** — Windows installer now integrates ability to run as a service with simple checkbox toggle
- **added** — Windows installer now integrates TLS (https) certificate generation and usage with simple checkbox toggle
- **added** — Service installation from regular user account auto-generates secure password and configures TrayIcon connection
- **added** — Extended NTFS full-disk backup support on Windows with advanced option --diskimage-filesystem-parsed=true
- **added** — New AutoTune tool (Duplicati.CommandLine.AutoTuneTool / duplicati-autotune) to evaluate and optimize performance-related settings
- **added** — Backends now support read-only context-aware testing for safe connection testing without risking unintended changes
- **added** — UI now shows welcome page with option to connect to console or continue without, suppressible with --webservice-suppress-welcome-page=true or DUPLICATI__SUPPRESS_WELCOME_PAGE=true environment variable
- **added** — TrayIcon connection no longer shows initial password setup dialog
- **added** — Handling for extended Win32 file attributes and option to ignore non-local files such as OneDrive and Dropbox files
- **added** — Toggle in ngclient to show advanced option names instead of descriptions
- **added** — Confirmation popup in ngclient before exporting configuration without encryption
- **added** — Remote lock results now displayed on ngclient log page
- **added** — Welcome page added to ngclient for simpler console connections
- **fixed** — S3 lock mode values now display correctly
- **fixed** — Remote file locking on Windows
- **fixed** — SMB source listing misclassifying directories as files
- **fixed** — Websocket connection on ngclient welcome page
- **changed** — FS parsing made experimental
- **removed** — Attributes filter options on ngclient source page in favor of using advanced options

This release is a canary release intended to be used for testing.

#### Improved Windows installer

This change brings a major update to the Windows installers, which now integrates the ability to run as a service, as well as generate and use TLS (https). The service feature has been present for a while in the `WindowsService.exe` tool and the TLS certificates were added as part of the `Duplicati.CommandLine.ConfigureTool.exe`. With this update these things are now integrated into the installer, and exposed as simple checkboxes to toggle the features. Installing the service from a regular user account, will also auto-generate a secure password and configure the TrayIcon to connect to the service (only for the current user).

If you have installed the service manually, do not activate the new checkbox as it only works if there is no pre-existing service.

#### NTFS full-disk backup

This release extends the full disk backup feature to include NTFS support on Windows. With this support it is more efficient to make backups of NTFS formatted disks. To enable this feature, add the advanced option `--diskimage-filesystem-parsed=true` and the backups will attempt to parse the disk, and if it is one of the supported formats, it will only read the relevant sectors.

#### New Auto-Tune tool

This release also introduces a new AutoTune tool (`Duplicati.CommandLine.AutoTuneTool` / `duplicati-autotune`), designed to help evaluate and optimize performance-related settings automatically based on the system.

#### Read-only testing of backends

Backends now support read-only context-aware testing, which allows testing connections safely without risking unintended changes to the storage. The read-only testing is applied when testing a restore destination or a remote source, such that no files are attempted written to the remote storage.

#### New welcome page and start

The UI will now show a welcome page showing how to connect to the console with an option to continue without. 
This can be suppressed with the option `--webservice-suppress-welcome-page=true` or environment variable `DUPLICATI__SUPPRESS_WELCOME_PAGE=true`.

If the connection is made from the TrayIcon, the initial dialog asking to set a password is no longer shown, as the intention is to use the TrayIcon to connect.
It is still possible to change the password from the Settings page if needed.

##### Detailed list of changes

- Added handling for extended Win32 file attributes and option to ignore non-local files, such as OneDrive and Dropbox files
- Fixed showing correct S3 lock mode values
- Added full disk NTFS support
- Added AutoTune tool
- Added read-only testing to backends, thanks @realtek2017
- Made FS parsing experimental
- Fixed remote file locking on Windows
- Fixed SMB source listing misclassifying directories as files, thanks @realtek2017
- Improved MSI installer package for Service
- Simplified console handling
- Cleaned up state after registering
- Removed explicit defaults in backup config
- Hardened MSI installer

##### Changes in ngclient

- Added toggle to show advanced option names instead of descriptions
- Added confirmation popup before exporting configuration without encryption
- Now showing remote lock results on log page
- Toggling read-only testing of backends based on context
- Fixed websocket not connecting on welcome page
- Added a welcome page for simpler console connections
- Removed attributes filter options on source page, in favor of using advanced options

### v2.3.0.103_canary_2026-05-22

- Date: 2026-05-22
- Version: v2.3.0.103_canary_2026-05-22
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.3.0.103_canary_2026-05-22
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.3.0.103-canary-2026-05-22
- Labels: Pre-release

- **added** — Duplicati Storage backend for zero-configuration storage setup
- **added** — Experimental setting to run backup, restore, and verify operations in an isolated sub-process
- **added** — Support for marking backends as deprecated or untested
- **added** — Movistar storage backend
- **added** — Failsafe when creating synthetic filelists
- **added** — Check code to ensure synthetic filelists are generated with required fields
- **added** — Path resolving on dynamic paths such as My documents in ngclient
- **added** — Option to retry loading a backup list in ngclient
- **deprecated** — od4b and mssp backends as the API is no longer working
- **fixed** — Issue with Filen.io renaming
- **fixed** — Restore message when no files are restored to reflect if existing files are found
- **fixed** — Some files showing as folders and missing size information
- **fixed** — Parsing MacOS timestamps from year 0000
- **fixed** — Issue where option settings could potentially be sticky across operations
- **fixed** — 100 second timeout with OneDrive and SharePoint v2
- **fixed** — Compression option not being visible in ngclient
- **fixed** — File size not being shown in file tree in ngclient
- **changed** — Internal controller to only expose async methods
- **changed** — Mega S4 endpoint list
- **changed** — Duplicati Backend to use the new API

This release is a canary release intended to be used for testing.

#### Changes in this version

This release marks the soft-launch of the Duplicati Storage service, giving a zero-configuration setup of storage. The Duplicati Storage backend works like any other backend, but there is no configuration to set up. Once the client is connected to the console, it can use the Duplicati Storage backend.

The service is currently in soft-launch mode and anyone interrested can contact Duplicati support to have a storage trial activated on their account.

In this release there is an experimental setting option that makes the actual operations (backup, restore, verify, etc.) run in an isolated sub-process. When this setting is enabled, the Duplicati server will spawn a new process for each operation, and the operation will run in that process. This means that if the process crashes or hangs, the Duplicati server will not be affected. It also allows the Duplicati server, and by extension the user, to force-kill a stuck process. While this feature is tested, it is not enabled by default as we are aware that there might be subtle issues and would like feedback on how the feature works in real-world scenarios.

The previous "SharePoint" and "OneDrive for Business" backends have been marked as deprecated, as Microsoft shut down the API they were calling. The migration step is to use the "SharePoint v2" backend (renamed to just "SharePoint" in this version) which uses the Microsoft Graph API.

This version also adds a new backend for the Spanish proivder Movistar, thanks to @redmars27. The backend is marked as "untested" as it can only be used (and tested) by Movistar customers.

This update also adds some more guards to the synthetic filelist generation update from 2.3.0.102, and a fix for OneDrive timeouts.

##### Detailed list of changes

- Fixed an issue with Filen.io renaming
- Added a failsafe when creating synthetic filelists
- Added check code to ensure synthetic filelists are generated with required fields
- Fixed restore message when no files are restored to reflect if existing files are found
- Added support for marking backends as deprecated or untested
- Deprecated `od4b` and `mssp` backends as the API is no longer working
- Fixed some files showing as folders and missing size information
- Hide the `--unittest-mode` flag from supported options
- Fix parsing MacOS timestamps that are from year 0000
- Updated internal controller to only expose `async` methods
- Updated Mega S4 endpoint list
- Fixed an issue where option settings could potentially be sticky across operations
- Updated warning logic on restore if no files were restored
- Fix a 100s timeout with OneDrive and SharePoint v2
- Updated the Duplicati Backend to use the new API
- Added support for running backup and restore in an isolated sub-process
- Added MoviStar storage backend, thanks @redmars27

##### Changes in ngclient

- Prevent iteration of non-folder paths
- Enable selecting hidden items
- Added path resolving on the "dynamic paths", such as "My documents"
- Fixed compression option not being visible
- Added support for showing backends as deprecated or untested
- Fixed an issue where file size would not be shown in the file tree
- Added an option to retry loading a backup list