aefdcd7298
Fixed CVE-2026-73088 and CVE-2026-73089
3 days ago
f49cf0c9ac
Merge pull request #16122 from thingsboard/fix/cves-lts-4.2
Fixed CVE-2026-65182, CVE-2026-65905, CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277, CVE-2026-68525, CVE-2026-71290
3 days ago
8dfc1c0c84
Bump httpclient5 from 5.5.2 to 5.6.4 to fix CVE-2026-71290
3 days ago
64ada3f560
Bump tomcat-embed from 10.1.56 to 10.1.59 to fix CVE-2026-65182, CVE-2026-65905, and CVE-2026-68525
3 days ago
0d3b41e002
Merge pull request #16034 from volodymyr-babak/remove-migrator
Removed outdated migrator tool
1 week ago
66075d6c02
Merge remote-tracking branch 'origin/fix/oauth2-user-tenant-lts-4.2' into lts-4.2
1 week ago
04d91311e3
Merge pull request #16102 from thingsboard/fix/prev-uri-validation-lts-4.2
Validate prevUri redirect parameter
1 week ago
1655cf9296
Assert the redirect URLs sent by the OAuth2 handlers
1 week ago
b8e17822b1
Include the email in the OAuth2 user resolution log message
1 week ago
a6c28e79b9
Allow an underscore in the mobile app callback url scheme
Mobile apps derive the scheme from their package name, which may contain
an underscore. It cannot introduce an authority, so accepting it keeps
the rule as strong as the RFC 3986 grammar.
1 week ago
0730387640
Resolve OAuth2 user within the tenant of the OAuth2 client
The user was looked up by email across the whole platform, so a client
belonging to one tenant could resolve a user of another. New users were also
placed in the tenant named by the provider response rather than in the tenant
that owns the client.
Both now follow the client's own tenant. System clients keep the platform-wide
behaviour they rely on.
1 week ago
e6ab6871e9
Log rejected prevUri values and share the mail flow constants
A rejected deep link is otherwise invisible to support. AdminController
reuses the prevUri parameter and cookie names instead of its own copies,
and its redirect target moves into a helper so the read side is covered
by a test.
1 week ago
1d60693835
Validate the callback url scheme where the redirect is built
The scheme is restored from the oauth2_auth_request cookie, which the
client can replace, so checking it only while the authorization request
is built still let a forged cookie point the token redirect at any host.
Both handlers now re-check it on read, sharing the rule with
OAuth2AppTokenFactory.
The success handler keeps prevUri out of the base URL as well, so the
error redirect no longer appends /login to an in-app path.
1 week ago
ee64fa1938
Validate mobile app callback url scheme
2 weeks ago
93b4433e6b
Validate prevUri redirect parameter
2 weeks ago
c2e7a9f12a
Merge pull request #15910 from ShvaykaD/bugfix/subscription-skip-deleted-tenant
Skip subscription forwarding when tenant no longer exists
2 weeks ago
32742a3c38
Merge pull request #16044 from AndriiLandiak/fix/sync-not-stranded-on-fetcher-failure-lts-4.2
Do not strand edge sync when an event fetcher fails
2 weeks ago
36e818718b
Merge pull request #16026 from MazurenkoNick/fix/edge-uplink-connectivity-gate
Fix uplink stall and off-heap memory growth after cloud disconnect (edge-side copy to CE)
2 weeks ago
0f42f09287
Version set to 4.2.2.5-SNAPSHOT
2 weeks ago
6431a4e4cd
Merge pull request #16057 from thingsboard/fix/cves-lts-4.2
Fixed CVE-2026-59902, CVE-2026-59903, CVE-2026-62243, CVE-2026-63337, CVE-2026-69219, CVE-2026-69220, CVE-2026-75595
3 weeks ago
193fb25ec9
Bump com.rabbitmq:amqp-client from 5.25.0 to 5.33.1 to fix CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220
3 weeks ago
bd6ec386fc
Bump io.netty from 4.1.136.Final to 4.1.137.Final to fix CVE-2026-59902, CVE-2026-59903, and 2 others
3 weeks ago
3648c1f3ce
Merge pull request #16039 from thingsboard/fix/cves-lts-4.2
Fixed CVE-2026-8763, CVE-2026-12185, CVE-2026-12802, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13006, CVE-2026-13506, CVE-2026-14682, CVE-2026-44891, CVE-2026-53434, CVE-2026-54291, CVE-2026-54399, CVE-2026-54428, CVE-2026-55831, CVE-2026-55833, CVE-2026-55851, CVE-2026-55955, CVE-2026-56745, CVE-2026-56817, CVE-2026-56819, CVE-2026-56820, CVE-2026-56821, CVE-2026-56822, CVE-2026-58059, CVE-2026-58060, CVE-2026-58061, CVE-2026-58062, CVE-2026-59639, CVE-2026-59642, CVE-2026-59645, CVE-2026-59650, CVE-2026-59651, CVE-2026-59889, CVE-2026-59901, CVE-2026-59920, CVE-2026-59949, CVE-2026-73507
3 weeks ago
bd062e3a0a
Merge pull request #16050 from thingsboard/fix/alarm-comment-audit-log-assertion
Compare deleted alarm comment audit log argument against the persisted comment
3 weeks ago
3a58059931
Compare deleted alarm comment audit log argument against the persisted comment
3 weeks ago
3f9f7f63c0
Merge pull request #16046 from mtsymbarov-del/fix/cves
Fixed CVE-2026-13149, CVE-2026-13311, CVE-2026-13676, CVE-2026-14257, CVE-2026-16221, CVE-2026-18446, CVE-2026-48815, CVE-2026-54466, CVE-2026-55388, CVE-2026-55603, CVE-2026-59869, CVE-2026-59873, CVE-2026-59874, CVE-2026-59879, CVE-2026-59880, CVE-2026-67213, CVE-2026-67214, CVE-2026-68945, CVE-2026-69151, CVE-2026-69152, CVE-2026-69192, CVE-2026-73646 and CWE-407
3 weeks ago
61d60f9fa5
Moved CSS to SCSS
3 weeks ago
19c433edd5
Review fixes
3 weeks ago
600bdf4ce4
Fixed CVE-2025-71329 and CVE-2025-71330
3 weeks ago
e32ae5cbbf
Updated Angular version to minimize resolutions
3 weeks ago
ce30d3ae56
Migrated from TinyMCE editor to Hugerte
3 weeks ago
7ccc6d3381
Fixed CVE-2026-73646
3 weeks ago
7c4d1774df
Fixed CVE-2026-55603
3 weeks ago
63aea3dcfe
Fixed CVE-2026-48815
3 weeks ago
eb9e405cd3
Fixed CVE-2026-13676, CVE-2026-16221 and CVE-2026-18446
3 weeks ago
5beb2b32cd
Fixed CVE-2026-59869 and CWE-407
3 weeks ago
c1344f6308
Fixed CVE-2026-69192
3 weeks ago
b5fe54b537
Fixed CVE-2026-13149, CVE-2026-69152 and CVE-2026-14257
3 weeks ago
08466774fa
Fixed CVE-2026-67213 and CVE-2026-67214
3 weeks ago
13afeacc0d
Fixed CVE-2026-55388
3 weeks ago
ec658c71bd
Fixed CVE-2026-68945 and CVE-2026-69151
3 weeks ago
2c96b3c75a
Merge pull request #15945 from mtsymbarov-del/fix/functionality-update
Updated functionality block at System Administrator level
3 weeks ago
e4988de4c0
Fixed CVE-2026-13311
3 weeks ago
a78ce1e7b8
Fixed CVE-2026-59879 and CVE-2026-59880
3 weeks ago
631c81b736
Fixed CVE-2026-54466
3 weeks ago
18e90c06e4
Fixed CVE-2026-59873 and CVE-2026-59874
3 weeks ago
1ad0c481dd
Do not strand edge sync when an event fetcher fails
3 weeks ago
a7d80406ed
Bump postgresql from 42.7.11 to 42.7.12 to fix CVE-2026-54291
3 weeks ago
06740c48f0
Bump jackson from 2.21.4 to 2.21.5 to fix CVE-2026-59889
3 weeks ago
0c3850f2ea
Bump logback from 1.5.34 to 1.5.38 to fix CVE-2026-13006
3 weeks ago
Maksym Tsymbarov
Viacheslav Klimov
Vladyslav Prykhodko
Andrii Landiak