I think I see part of what's happening here; it looks like the format for configuration-sync URIs removed the colon (:) between the host and path:
<PROTO>://<USER>:<PASS>@<HOST>:<PATH>
is now:
<PROTO>://<USER>:<PASS>@<HOST><PATH>

The migration scripts probably just need to account for this.

Additionally, it looks like special characters, specifically !, which worked prior (and still works with the save op-mode command), cause a failure in 1.4+:

trae@cr01b-vyos# set system config-management commit-archive location sftp://MYUSER:[email protected]/wdc07/cr01b-vyos
[edit]
trae@cr01b-vyos# set system config-management commit-archive location sftp://MYUSER:[email protected]/wdc07/cr01b-vyos

  "//MYUSER:[email protected]/wdc07/cr01b-vyos" is not a valid URI for the sftp URL scheme
  
  
  Invalid value
  Value validation failed
  Set failed

[edit]
trae@cr01b-vyos# set system config-management commit-archive location 'sftp://MYUSER:[email protected]/wdc07/cr01b-vyos'

  "//MYUSER:[email protected]/wdc07/cr01b-vyos" is not a valid URI for the sftp URL scheme
  
  
  Invalid value
  Value validation failed
  Set failed

[edit]
trae@cr01b-vyos# set system config-management commit-archive location "sftp://MYUSER:[email protected]/wdc07/cr01b-vyos"

  "//MYUSER:[email protected]/wdc07/cr01b-vyos" is not a valid URI for the sftp URL scheme
  
  
  Invalid value
  Value validation failed
  Set failed

[edit]

It also doesn't appear to accept %, *, or ^ in the password. Perhaps we should consider splitting this up into something like:

set system config-management commit-archive location SERVER1 protocol sftp
set system config-management commit-archive location SERVER1 path '/wdc07/cr01b-vyos'
set system config-management commit-archive location SERVER1 host 'stor01a-rh9.int.trae32566.org'
set system config-management commit-archive location SERVER1 user 'myuser'
set system config-management commit-archive location SERVER1 password '$P4SsW0RD!'

I realize this would be a significant departure from the way it is currently done, but I think it's worth it given that it:

• Clearly delineates each part of the configuration, preventing having to find identifiers (ex: : or /) to split up a single long string
• Allows for easy encryption of the password in the configuration in the future
• Removes the concern of special characters in any field other than the password
• Obfuscates away the formatting of the underlying protocol URI

Another good thing is that any logging can be done without spoling the user/pass which otherwise is the case with todays oneliner approach.

That is that the log of failed connection could include just protocol + host (and path).