Changes compared to 26.10.0

Epimetheus is the latest entry in our quarterly rollup series. It branches off from our main rolling Voyager development into a fixed target for our partners to qualify and build upon.

This quarterly release is named after Epimetheus, one of Saturn’s smaller moons and the orbital companion of Janus, our previous release’s namesake.

In Greek mythology, Epimetheus means “hindsight,” while his brother Prometheus represents “foresight.” And much like its mythological namesake, Epimetheus has an interesting history of looking back. When astronomers first observed the moons in the 1960s, they didn’t immediately realize they were seeing two separate objects. It took years of observations to unravel the mystery.

Sometimes, even in space, hindsight is 20/20!

Comet 26.10.0 Epimetheus is mostly about restores and integrations. Highlights include in-browser restores from the Comet Management Console, restoring directly to remote and cloud locations, mounting snapshots as a read-only folder on Linux, new NinjaOne RMM and ConnectWise Manage PSA integrations, a rule-based Microsoft 365 account selector with exclude rules, scheduled backup speed limits, Admin API tokens, and NFSv4 Storage Vaults. This release also adds a Disk Management tool to the WinPE Recovery Environment, more codesigning options, and large memory and speed improvements when loading Storage Vault indexes.

As always for a new quarterly release, there are two changelogs for 26.10.0 depending on whether you are coming from the previous quarterly release or the previous Voyager release:

Changes compared to 26.7.3 (Janus)

Notice​

Microsoft 365 OneDrive service selection is now honoured by full backups​

Previously, a Protected Item covering a user's personal OneDrive captured that OneDrive during a full backup even when the OneDrive service was not selected, and then dropped it from every later incremental backup. Full and incremental backups now both follow the OneDrive service selection. If unselected personal OneDrive data was being captured before, it will no longer be included in new backups, and a warning is logged whenever content is skipped for this reason.

New Features​

In-browser restore in the Comet Management Console​

Users and administrators can now restore a Protected Item, or a whole snapshot, from a Storage Vault directly in the web browser as a downloadable archive, without installing the Comet Backup desktop app. A new Restore... action is available on the Protected Items table of the user page.

A new Allow administrator to restore data option lets an administrator perform an in-browser restore on a user's behalf. The user can turn it on from the Comet Backup desktop app, and it can be turned off from either the Comet Management Console or the desktop app.

Restore Comet-Hosted Microsoft 365 data to a download archive​

Selected items, or a whole snapshot, from a Comet-Hosted Microsoft 365 Protected Item can now be downloaded as a TAR or ZIP archive.

Restore directly to remote and cloud locations​

Restores can now write directly to remote and cloud storage locations, instead of only to a local disk on the device.

Mount a snapshot as a read-only folder on Linux​

A File and Folder snapshot can now be mounted as a read-only folder from the Restore dialog of the Comet Backup desktop app on Linux, including when running inside WSL2. Files are only downloaded from the Storage Vault when they are opened, and active mounts can be opened or unmounted from the new Mounted snapshots dialog.

NinjaOne RMM integration​

NinjaOne is a unified IT management platform combining RMM, endpoint management, and ticketing. Comet's new NinjaOne integration surfaces backup status directly inside NinjaOne, so you can monitor your customers' backups alongside the rest of their endpoint data instead of switching between tools.

Once configured, Comet writes the outcome of each backup to custom fields on the matching NinjaOne device (Last Backup Status, Last Backup Time, Last Backup Destination, Last Backup Total Size, and the Comet Job ID), refreshed automatically after every job.

You can also enable automatic ticketing. When a backup fails, Comet opens a NinjaOne ticket against the affected device, with a link back to the Comet job log and a summary of the run. Repeated failures on the same device and Protected Item add a comment to the existing ticket and escalate its severity rather than creating duplicates, and when the next backup succeeds Comet resolves the ticket automatically.

The integration is configured under Settings → Integrations in the Comet Management Console and requires the NinjaOne Agent on each device. For full setup instructions, see the NinjaOne integration guide.

ConnectWise Manage PSA integration​

ConnectWise Manage joins Comet's existing PSA integrations. Comet Server automatically raises a ConnectWise Manage ticket when a backup job fails or a scheduled backup is missed, matched to the affected client, device, and Protected Item, with a severity based on the failure type. Repeated failures on the same device and Protected Item add a note to the existing ticket and escalate its severity instead of opening duplicates. The integration is configured under the PSA settings in the Comet Management Console.

Rule-based Microsoft 365 account selection with exclude rules​

Account selection for Microsoft 365 Protected Items has been redesigned around an ordered list of include and exclude rules, in both the Comet Management Console and the Comet Backup desktop app. You can now exclude specific users, groups, teams, or sites, for example to back up an entire organization except a few accounts, while an "All accounts" rule automatically protects users added to the organization later. Rules require Comet Backup 26.8.1 or later on the device.

Automatically start a Bulk Update Campaign when the Comet Management Console restarts​

A new Automatic Upgrade Campaign option starts a fresh Bulk Update Campaign each time the Comet Management Console restarts, rolling the update out across your devices with no manual step. A new campaign is only started if it has been more than 24 hours since the last one, so quick or repeated restarts do not cause redundant campaigns.

A top-level administrator can turn this on under the Backup Agent Downloads settings, and use Configure upgrade campaign to choose how the campaign behaves: whether to upgrade older versions and/or downgrade newer ones, whether to wait for running backup jobs or interrupt them, and whether to target all devices or a filtered subset.

Scheduled backup speed limits​

A backup job's speed limit can now follow a schedule, so a job can be held to a lower speed during business hours and run at full speed overnight. This has been a long-standing request from customers whose devices share a slow internet connection, where a large first backup can run for days. When a scheduled window starts or ends, the new limit applies immediately, including to transfers already in progress.

Admin API tokens and read-only admin accounts​

Administrators can now create Admin API tokens for programmatic API access, without sharing their password or 2FA. A new admin policy option, Restrict this account to read-only access, prevents an admin account from using any API method that performs a write action.

Disk Management in the WinPE Recovery Environment​

The WinPE Recovery Environment now has its own Disk Management dialog, so disks can be prepared for a Disk Image restore without calling out to Windows' diskmgmt.msc. It can list disks and their partitions, initialize a raw disk as GPT or MBR, clean a disk, create a new simple volume, format a partition, assign or change a drive letter, extend a volume into adjacent unallocated space, shrink an NTFS volume, and delete a partition.

NFSv4 Storage Vaults​

NFSv4 is now a supported option for Storage Vaults and Comet Storage Gateway.

Automatic access key rotation for Backblaze B2 and Comet Storage Gateway templates​

Storage Vaults provisioned from a Backblaze B2 Storage Template or a Comet Storage Gateway Template now support automatically rotating their access keys and clearing Storage Vault locks. You can also issue a new key for an existing bucket from the Storage Buckets page of the Comet Management Console.

More codesigning options​

• Windows Authenticode codesigning of client software can now use a key stored in AWS Key Management Service (KMS) or Google Cloud Key Management Service (Cloud KMS)
• Windows Authenticode codesigning can now use Azure Artifact Signing (formerly Azure Trusted Signing)
• A new Linux (RPM) tab in the Codesigning settings dialog accepts a GPG signing key to sign the Linux RPM backup-tool installer
• A top-level administrator can now keep an allowlist of the PKCS#11 driver module file paths permitted for Authenticode codesigning. Any PKCS#11 module paths already in use are added to the allowlist automatically on upgrade

Custom code in the Branding settings​

A top-level administrator can now add custom JavaScript and CSS to the web interface from a new Custom code section on the Branding page. Code can be supplied inline or loaded from an external URL, placed in the document head or at the end of the body, and applies to the login page and the web interface of all tenants. The page Content-Security-Policy is extended automatically to permit only the code that was configured.

Extra Fields on the user profile page​

User profiles have supported free-form metadata since Comet 26.2.1, but it could only be edited through the API. The user profile page in the Comet Management Console now has an Extra Fields section for editing it directly, useful for notes, contact details, or IDs linking the user to an external system. Each entry can be marked as admin-only or visible to the end user.

Test Connection for Proxmox restores in the Comet Management Console​

The Proxmox destination page of the Restore dialog in the Comet Management Console now has a Test Connection button, matching the Comet Backup desktop app. The test is relayed through the connected device, so it checks the same SSH connection the restore job will use. SSH host key verification options have also been added to this page; previously, Proxmox restores started from the web interface always skipped host key verification.

Create Linux recovery media on Windows using WSL2​

The Create Recovery Media wizard of the Comet Backup desktop app can now build the Linux ISO recovery media on Windows using WSL2, so Docker or Podman is no longer required.

Skip existing items when restoring to Office 365​

When restoring to the Office 365 cloud, mail messages and OneDrive and SharePoint files that are already present at the destination can now be skipped. The option is enabled by default in the restore dialog.

MySQL user accounts, grants, and recovery metadata in snapshots​

MySQL Protected Items can now store an integration's own recovery metadata file in each snapshot using the METADATA_FILE EngineProps key, and can capture the server's user accounts and privilege grants as a SQL script using the INCLUDE_USERS_GRANTS EngineProps key. Both are skipped by database replay restores and can be retrieved with a file restore.

Enhancements​

Faster Storage Vault index loading​

Loading Storage Vault indexes in backup jobs and restores is now faster and uses less memory, especially for large Storage Vaults. Index lookups are also faster for Storage Vaults with many index files, and fewer file handles are held open when using on-disk indexes.

More reliable Linux Disk Image backups​

Fixed-size LVM snapshots are now monitored during a Disk Image backup and extended automatically before their copy-on-write space fills up, which previously caused backups of busy volumes to fail with I/O errors. Linux Disk Image backups now also keep their snapshot difference storage on disk instead of in RAM where possible, and that storage can grow during the backup. If a snapshot does become invalid, the job log now shows a clear warning naming the affected device and the cause, instead of only unexplained "input/output error" failures.

Safer Disk Image restores​

The Restore dialogs of the Comet Backup desktop app and the Comet Management Console now ask for confirmation, and the job log shows a warning, when a Disk Image restore targets a currently-mounted volume.

Show advanced actions in the Device Actions dialog​

A new Show advanced actions option is available in the Device Actions dialog of the Comet Management Console.

Other enhancements​

• Improved performance of running retention pass cleanups on Comet Storage Gateway (COMET-1482)
• Reduced load on the Comet Management Console if jobs are scheduled frequently (COMET-59684)
• Improved cancellation of backup and restore jobs using FTP Storage Vaults
• Added support for seamless redirection when attempting to log in to the Comet web interface with external OAuth credentials (COMET-4519)
• Improved Microsoft 365 backup resilience: a SharePoint or OneDrive site that fails an incremental backup now falls back to a full backup of that site instead of being dropped from the snapshot (COMET-60143)
• Microsoft 365 mailbox and SharePoint/OneDrive backups now share a single bounded worker pool with guaranteed shares for each kind, instead of two independent pools (COMET-60143)
• Reduced temporary-disk and memory usage when a Comet Server Storage Role forwards large uploads to an S3-compatible backend, by streaming the data through to the provider instead of spooling each upload to a temporary file first
• Migrated Microsoft 365 mailbox restores from the Exchange Web Services (EWS) API to the Microsoft Graph API, improving restore performance (COMET-5867)
• Added a prompt to the Comet Backup desktop app when a user policy change is made that requires user consent (COMET-59416)
• Storage Vault content statistics measured during a retention pass now use exact on-disk pack sizes instead of index estimates; reported values may shift slightly after upgrading (COMET-60144)
• Reduced memory usage and improved the speed of Microsoft 365 mail backups through batch streaming (COMET-60111)
• Significantly reduced the RAM required to restore or browse a single snapshot (COMET-3533)
• Significantly reduced peak memory use and CPU time when saving a backup snapshot's directory tree. This most affects Office 365 Protected Items with very large mailboxes, calendars, or SharePoint site lists (COMET-60370)
• Allow configuring X-Forwarded-For and SMTP SSRF protection via the Comet Core web interface settings page (COMET-2410)
• Added safety measures to defend against concurrent changes to a user profile in the Comet Management Console web interface (COMET-1493)
• Improved the Test Connection result on the Proxmox restore destination page of the Comet Backup desktop app to prompt for a destination node and storage target when they have not yet been selected (COMET-5839)
• Improved the speed of backup jobs that run while a retention pass is in progress (COMET-60193)
• Table view settings in the Comet Management Console (visible columns, sorting, page size, and the group-view toggle) are now kept when upgrading Comet Server, instead of being reset on every upgrade. If a table's columns changed in the new version, only the settings for the changed columns are reset (COMET-60015)
• The engine1/mysql EngineProps keys are now documented in the SDK docs (COMET-60200)
• Updated the Comet Management Console API to report details about invalid parameters in many cases (COMET-60493)
• Duplicating a Protected Item in the Comet Backup desktop app now selects the new copy (COMET-60631)
• Improved the clarity of administrator account permissions in the Comet Management Console (COMET-59380)
• Unlocking a Storage Vault now also removes damaged lock files, and reports an error instead of success if some locks could not be read (COMET-60518)
• Updated the OpenSSL library bundled with the VMware (VDDK) support on Windows to a newer 3.0.x release (COMET-5831)
• The Comet Backup desktop app now runs Storage Vault search, email preview, retention passes, index rebuilds, and snapshot and file deletion through the background service, instead of starting them as the logged-in user (COMET-60727)
• Improved the startup performance of restoring data, if only a few files were selected (COMET-60793)
• Improved the job log message when a restore to VMware vSphere fails while creating or registering a VM, so it includes the detail reported by vCenter and the host and resource pool used (COMET-5517)
• Improved the job log message when a Hyper-V backup fails while creating a checkpoint, so it includes the detail reported by Hyper-V (COMET-61007)
• Storage Vaults created from a Storage Template that refers to "This Server" now keep the "This Server" address instead of the server's URL at the time of creation, so they keep working when the Comet Server is first opened on 127.0.0.1 or its external address changes. A warning is shown before choosing "This Server" for an account that has older devices (COMET-1871)
• Updated the Portuguese (Brazil) translation (COMET-60781)

Changes compared to 26.8.9

New Features​

• Added in-browser restore to the Comet Management Console. Users and administrators can now restore a Protected Item, or a whole snapshot, from a Storage Vault directly in the web browser as a downloadable archive, without installing the Comet Backup desktop app. A new "Restore..." action is available on the Protected Items table of the user page (COMET-59389)
• Added an "Allow administrator to restore data" option for users, so that an administrator can perform an in-browser restore on the user's behalf. It can be enabled by the user from the Comet Backup desktop app, and disabled from the Comet Management Console or the desktop app (COMET-59115)
• Added a restore to download archive for Comet-Hosted Microsoft 365. Selected items, or a whole snapshot, can be downloaded as a TAR or ZIP archive (COMET-60210)

Changes compared to 26.8.8

New Features​

• Added support for Windows Authenticode codesigning of client software using a key stored in AWS Key Management Service (KMS) or in Google Cloud Key Management Service (Cloud KMS), configurable in the Codesigning dialog of the Comet Management Console (COMET-60714)
• Added support for Windows Authenticode codesigning of client software using Azure Artifact Signing (formerly Azure Trusted Signing), configurable in the Codesigning dialog of the Comet Management Console (COMET-5374)
• Added the ability to mount a File and Folder snapshot as a read-only folder from the Restore dialog of the Comet Backup desktop app on Linux, including when running inside WSL2. Files are downloaded from the Storage Vault only when they are opened, and active mounts can be opened or unmounted from the new Mounted snapshots dialog (COMET-60718)
• Added an option to skip Office 365 mail messages and OneDrive and SharePoint files that are already present at the destination when restoring to the Office 365 cloud, enabled by default in the restore dialog (COMET-60209)
• Added support for automatically rotating Storage Vault access keys and clearing Storage Vault locks for Storage Vaults provisioned from a Backblaze B2 Storage Template (COMET-60613)
• Added support for automatically rotating Storage Vault access keys and clearing Storage Vault locks for Storage Vaults provisioned from a Comet Storage Gateway Template (COMET-60612)
• Added an option to issue a new key for an existing bucket, from the Storage Buckets page of the Comet Management Console (COMET-3289)

Changes compared to 26.8.7

Enhancements​

• Improved the speed and reduced the memory usage of loading Storage Vault indexes in Comet Backup jobs and restores, especially for large Storage Vaults (COMET-60533)
• Improved index lookup performance for Storage Vaults with a large number of index files, and reduced the number of open file handles when using on-disk indexes (COMET-60749)
• Linux Disk Image backups now keep their snapshot difference storage on disk instead of in RAM where possible, and the storage can grow during the backup, so large or busy devices are less likely to run out of snapshot space (COMET-59641)
• Updated the OpenSSL library bundled with the VMware (VDDK) support on Windows to a newer 3.0.x release (COMET-5831)
• The Comet Backup desktop app now runs Storage Vault search, email preview, retention passes, index rebuilds, and snapshot and file deletion through the background service, instead of starting them as the logged-in user (COMET-60727)

Changes compared to 26.8.6

New Features​

• Added support for creating the Linux ISO recovery media on Windows using WSL2 in the Create Recovery Media wizard of the Comet Backup desktop app, so Docker or Podman is no longer required (COMET-60638)
• Added NFSv4 as a supported option for Storage Vaults and Storage Gateway (COMET-2248)
• Added a Linux (RPM) tab to the Codesigning settings dialog for uploading a GPG signing key to sign the Linux RPM backup-tool installer (COMET-59136)

Changes compared to 26.7.2

Changes compared to 26.8.5

Changes compared to 26.8.4

New Features​

Added a custom partition tool in the WinPE Recovery Environment (COMET-2138)​

The WinPE Recovery Environment now has its own Disk Management dialog, so disks can be prepared for a Disk Image restore without calling out to Windows' diskmgmt.msc. It can list disks and their partitions, initialize a raw disk as GPT or MBR, clean a disk, create a new simple volume through a wizard, format a partition, assign or change a drive letter, extend a volume into adjacent unallocated space, shrink an NTFS volume, and delete a partition.

Added the ability to set the backup job speed limit to specific times and days (COMET-3574)​

A backup job's speed limit can now follow a schedule, so a job can be held to a lower speed during business hours and run at full speed overnight. This is a long-standing feature request from customers whose devices share a slow internet connection, where a large first backup can run for days. When a scheduled window starts or ends, the new limit applies immediately, including to transfers already in progress.

engine1/mysql Protected Items support a METADATA_FILE EngineProps key: an optional client-local file stored in each snapshot as .metadata, skipped by database replay restores and retrievable with a file restore (COMET-60200)​

This lets an integration attach its own recovery metadata to every MySQL snapshot, so each snapshot is self-contained for disaster recovery. Comet only carries the file: it is read at backup time, only the path appears in the Protected Item settings, and if the file is missing the job logs a warning while the database streams still back up.

engine1/mysql Protected Items support an INCLUDE_USERS_GRANTS EngineProps key: when set to "1", the server's user accounts and privilege grants are captured as a SQL script stored in each snapshot as .users-grants.sql, skipped by database replay restores and retrievable with a file restore. Verified against MySQL 8.0.43 and MariaDB 11.4 and 10.6, including MariaDB roles; servers without SHOW CREATE USER fall back to SHOW GRANTS alone (COMET-60200)​

The generated script replays in dependency order and creates each account with IF NOT EXISTS, so an account that already exists on the target, such as root, is left alone while its grants still apply. A restore never runs the script automatically, because doing so could rewrite the target server's accounts; it is retrieved with a file restore and applied by hand.

Changes compared to 26.8.3

New Features​

Added an Extra Fields section to the user profile page in the Comet Management Console for free-form content (COMET-60171)​

User profiles have supported free-form metadata since Comet 26.2.1, but it could only be edited through the API. The user profile page in the Comet Management Console now has an Extra Fields section for editing it directly, useful for notes, contact details, or IDs linking the user to an external system. Each entry can be marked as admin-only or visible to the end user, and the same key name may be stored at both visibility levels independently.

Added a Test Connection button to the Proxmox destination page of the Restore dialog in the Comet Management Console, testing SSH connectivity via the connected device (COMET-5839)​

Previously, a wrong server address or credentials for a Proxmox restore started from the Comet Management Console only surfaced after the job had been submitted. The Proxmox destination page of the Restore dialog now has a Test Connection button, matching the Comet Backup desktop app. The test is relayed through the connected device, so it checks the same SSH connection the restore job itself will use. A successful test with no destination node or storage target selected prompts you to pick them, and a failed test against the Proxmox web interface port (8006) suggests using the SSH port instead.