XCP-ng 8.3 updates announcements and testing

stormi

Although disabling ssh-rsa is the right thing to do from a security perspective, we'll see what we can do to smoothen the transition.

psafont

@rzr said:

Hi @andrew, thank you for your feedback, the fallback option you're suggesting will work but it will downgrade the security of your system, we suggested to update clients:

If users need to take action, I would rather recommend users to do something that raises the security floor, like generating new keys with newer, future-looking ciphers, like ed25519:

ssh-keygen -t ed25519 -C "<email>"
for server in $servers do ; ssh-copy-id $server; done

gb.123

Hello,
After updating I get this:

This seems harmless as I don't have and scsi drive attached. But these messages were not there before.

Other than that, the server seems to boot fine.

Regards,

PS:
I have updated once for several updates (not one by one) so this messages may also be there in previous updates and may not be related to this particular update.

rzr

@gb.123 said:

Wrong diagnostic page; asked for 1 got 8
Failed to get diagnostic page 0x1
Failed to bind enclosure -19

be there in previous updates and may not be related to this particular update.

I think you're right because the issue you are facing is reported by kernel itself (which was not updated), Can you please share more details about the hardware you're using (is any USB device involved ? try smartmon tools too) eventually post details in other sections of forum.

gb.123

@rzr said:

I think you're right because the issue you are facing is reported by kernel itself (which was not updated), Can you please share more details about the hardware you're using (is any USB device involved ? try smartmon tools too) eventually post details in other sections of forum.

@rzr
CPU is AMD Ryzen 7 7840HS in a mini pc.

No USB involved in boot, but I do have an external USB HDD connected which is passed through to a VM (this should not effect boot)

What details are you looking for and where so you want me to post them ?

Update: I also tried on a AMD Ryzen 9 7945HX, which does not seem to have this message.

Do you think its USB related or motherboard/bios driver related ?

fohdeesha

@gb.123 those scsi messages can be expected and ignored when a USB enclosure is connected, some USB enclosures do not emulate SCSI Enclosure Services (SES) very well, so the kernel complains when it queries them and gets nonsense back. USB passthrough devices are still visible and enumerated by dom0's kernel. If you remove the drive the messages will go away, but they can be safely ignored.

flakpyro

I took the opportunity to swap out the ssh keys on my hosts yesterday from the default rsa keys over to ed25519 keys. I used Ansible to copy the new key over before running another playbook to remove the old key. Having the ability to use Ansible to mange your hosts at scale is very slick!

gduperrey

Thank you everyone for your tests and your feedback!

The updates are live now: https://xcp-ng.org/blog/2026/03/10/march-2026-maintenance-updates-for-xcp-ng-8-3-lts/

MajorP93

@gduperrey On my pool master there are no updates available in yum repository (checked via "yum check-update").
Will it take some more time?

bnerickson

Just a heads up that the updates to net-snmp-libs will break the lldpd package from epel. I know packages from epel aren't supported and are discouraged, but XCP-ng 9 can't come soon enough . Time to boot up an ancient CentOS 7 VM and create a custom lldpd spec/rpm.

gduperrey

@MajorP93 the diffusion of RPMs across different repositories around the world can take some time depending on your geographical location.

Sometimes a yum clean metadata can also help to clear the cache and better detect updates that have just arrived on certain repositories.

MajorP93

@gduperrey After running "yum clean metadata && yum check-update" the package updates are shown. Thanks.