Unvalidated sortProperty on GET /api/iot-hub/installedItems was passed straight into Spring Data's Sort.by, so a client could trigger a 500 PropertyReferenceException by naming an unknown entity field. Add ALLOWED_SORT_PROPERTIES on IotHubInstalledItemEntity (createdTime, itemName, itemType, version) and call validatePageLink in the service so the failure is a 400 with a clear message.
If iotHubInstalledItemService.save throws after the local entity was already created, the entity was orphaned — visible in the tenant but invisible to IoT Hub update/delete. Extracted the per-type entity-deletion dispatch from deleteInstalledItem into a deleteEntityForDescriptor helper and call it from doInstallVersion and registerDeviceInstall on tracking-save failure. registerDeviceInstall now also wraps reportVersionInstalled best-effort to match doInstallVersion.
The post-install Thread.sleep was driven by installTimeoutMs from the uploaded solution.json with no upper bound — a malicious or misconfigured template could pin an HTTP worker thread indefinitely. Cap it at a configurable max (default 60s) exposed as iot-hub.max-install-timeout-ms with an IOT_HUB_MAX_INSTALL_TIMEOUT_MS env override.
Stream entries through a fixed buffer and abort with IOException when the archive crosses any of three configurable thresholds: total uncompressed bytes, per-entry uncompressed bytes, or entry count. Defaults — 200 MiB total, 50 MiB per entry, 10 000 entries — and env-var overrides IOT_HUB_MAX_UNCOMPRESSED_ARCHIVE_BYTES / IOT_HUB_MAX_UNCOMPRESSED_ENTRY_BYTES / IOT_HUB_MAX_ARCHIVE_ENTRY_COUNT are exposed under iot-hub in thingsboard.yml.
Add youtubeUrl to CreatorView and render it alongside the other creator social links. Reindents the link block so it nests correctly inside the surrounding flex column.
Root entries other than WIDGET or SOLUTION_TEMPLATE should always be installed even when a prior version is already installed — only widgets and solution templates are deduplicated by item id at install-plan resolution time.
Switch from base64 data URLs to URL.createObjectURL for images extracted from the device package zip. Revokes them in ngOnDestroy to avoid leaking memory, and avoids embedding multi-megabyte data URLs in the DOM.
Split the detail dialog close button into desktop (inline in header) and mobile (absolute, top-right) variants. Switch meta-grid first column to minmax(0, …) so the creator section can shrink, and truncate the creator name with a tooltip. Add 8px right margin to the card type label.
Move the zip fetch from IotHubActionsService into TbDeviceInstallDialogComponent.ngOnInit so the dialog opens immediately and shows its own loading spinner instead of blocking the caller. Drops the now-unused fetchZipData helper and zipData field from DeviceInstallDialogData.
Drop the (optionSelected) handler and route navigation through the option's (click) instead. Setting [value]="searchText" makes Material write the typed string back through ngModel (a no-op) rather than the MpItemVersionView object, so the input keeps the user's query after the detail dialog closes and searchText.trim() in seeAllResults() stays safe.
Route all parse-failure throws through a single parseFailure(action, itemType[, section], cause) helper so the user-facing wording lives in one place and update paths share the template with install paths.
Align the four entity table "Add from IoT Hub" descriptors (devices,
rule chains, calculated fields, widget types) with the new hub icon
already used by the IoT Hub menu and breadcrumb. Drops the old
`store` glyph that no longer matches the rest of the IoT Hub UI.
- IotHubRestClient.getVersionFileData now streams the response and
enforces a configurable size cap (iot-hub.max-file-data-size-bytes,
env IOT_HUB_MAX_FILE_DATA_SIZE_BYTES, default 100 MiB). Oversized
payloads are rejected up front via Content-Length and mid-stream
for chunked transfers, preventing OOMs from unknown bodies.
- DefaultIotHubService guards every iotHubRestClient.getVersionInfo
call against a null response, and rejects update attempts where
the installed item's type does not match the new version's type
("Installed item type does not match the new version's item type.").
Solution-template descriptor is also populated with
tenantTelemetryKeys / tenantAttributeKeys captured during install.
Drops the empty updateDeviceProfile stub.
- Add a tenant-scoped findByTenantIdAndId + deleteByTenantIdAndId to
IotHubInstalledItemDao (and the bulk deleteByTenantIdAndIdIn JPA
query). IotHubInstalledItemServiceImpl now uses these so reads
and deletes always honour the tenant boundary.
- Database: add lts schema_update.sql + schema-entities-idx.sql
indexes on iot_hub_installed_item(tenant_id),
(tenant_id, item_type), and (tenant_id, item_id) for the new
tenant-scoped lookups.
- DefaultSolutionService: minor cleanup touched alongside.
- .gitignore trailing-newline fix; remove stale superpowers
plan/spec docs that have been folded into the implementation.
- New input[matAutocomplete]/textarea[matAutocomplete] directive
that keeps an open MatAutocomplete panel attached to its anchor
while the page scrolls or the window resizes: tracks the
input's visibility via IntersectionObserver and re-requests
panel position (or closes the panel when off-screen) when the
nearest scroll container or window emits a resize/scroll event.
- Declare and export the directive from SharedModule so it lights
up across every screen that uses mat-autocomplete.
- Drop the transparent backdrop from
MAT_AUTOCOMPLETE_DEFAULT_OPTIONS (the directive now handles
scroll-and-resize repositioning, so the backdrop-driven outside-
click close is no longer needed) and keep the existing
hideSingleSelectionIndicator default.
Add a DEVICE arm to getInstalledItemUrl so device-installs link to
their generated dashboard (descriptor.dashboardId / EntityType.DASHBOARD),
matching the existing SOLUTION_TEMPLATE handling instead of falling
through to no URL.
Bump the installed-items table .mat-column-createdTime width
from 100px to 160px so the new "MMM d, y, h:mm a" format
(introduced when the column started showing the install time)
fits without wrapping or ellipsis.
Switch the createdTime column formatter from 'mediumDate' (date
only) to the custom pattern 'MMM d, y, h:mm a' so each row also
surfaces the install time. Angular's built-in 'medium' alias was
not used because it includes seconds.
- Guard the helper against a missing descriptor by short-circuiting
to null up front instead of letting the switch crash on
`undefined.type`.
- Expand the inline single-line `case 'X': … break;` arms in the
switch so each branch reads on its own line, matching the
formatting of the already-multi-line CALCULATED_FIELD /
ALARM_RULE arms.
- Add a single getInstalledItemUrl(descriptor) helper to
iot-hub-installed-item.models that maps every descriptor type
(WIDGET / DASHBOARD / CALCULATED_FIELD / ALARM_RULE / RULE_CHAIN /
SOLUTION_TEMPLATE) to its entity-details URL via the shared
getEntityDetailsPageURL utility, appending `?selectedTab=cf` for
calculated-field installs so the entity tabs page lands on the CF
tab on first paint.
- Drop the parallel resolveEntityDetailsUrl helper +
iot-hub-components.models.ts file and rewire every installed-item
open path (install dialog, update dialog, installed-items table,
item detail dialog) to call getInstalledItemUrl. Installed-items
table openEntity collapses to parseUrl + serializeUrl on the
helper's output now that any selectedTab is part of the URL.
- Teach EntityDetailsPageComponent to honour a `selectedTab=…`
query param: read it from the current route on entityId change,
strip it (replaceUrl) so refresh doesn't keep jumping the tab,
then resolve a tab index via the new
EntityTabsComponent.resolveTabIndex(tab) hook. Asset, device,
asset-profile, and device-profile tabs override the hook to map
the `cf` shortcut to their respective Calculated Fields tab
position; other entities fall back to index 0.
- EntityDetailsPanelComponent now applies this.selectedTab to the
underlying MatTabGroup both when the entity-tabs query list
refreshes and after view init, so the initial tab matches the
resolved index instead of staying on 0.
- Add a `showOverflowedTitle` boolean input (defaults to false,
coerceBoolean-decorated) to ChipOverflowDirective. When true and
hiddenCount > 0, the overflow `+N` chip gets a `title` attribute
set to the comma-joined trimmed textContent of every overflowing
chip, surfacing them via the native browser tooltip. When the
flag is off, no items overflow, or hiddenCount drops back to
zero, the title attribute is removed.
- Keep `pointer-events` in sync with the title so the native
tooltip actually fires: remove `pointer-events: none` while a
title is present; reapply it otherwise (matches the initial
state set in createOverflowChip).
- Opt the IoT Hub item detail dialog's three tb-chip-overflow
meta-chip groups (connectivity, categories, use-cases) into
showOverflowedTitle so hovering the `+N` chip lists the hidden
values.
Igor Kulikov
Maksym Tsymbarov
dpinkevych
Vladyslav_Prykhodko
Viacheslav Klimov
Andrii Landiak