2cd31ac359
Merge remote-tracking branch 'origin/lts-4.3' into release-4.3
6 days ago
15823f11ce
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
7 days ago
56117df813
Merge pull request #16129 from dskarzh/chore/spdx-license-headers-lts-4.3
chore: adopt SPDX license headers on lts-4.3
7 days ago
ec2a614b35
Merge pull request #16116 from dskarzh/chore/spdx-license-headers
chore: adopt SPDX license headers and upgrade license-maven-plugin to 5.1.2
7 days ago
746b3e57eb
chore: adopt SPDX license headers for files added in lts-4.3
1 week ago
ac837f7bdc
Merge branch 'chore/spdx-license-headers' into chore/spdx-license-headers-lts-4.3
# Conflicts:
# application/src/main/java/org/thingsboard/server/service/cf/ctx/state/HasLatestTs.java
# application/src/main/java/org/thingsboard/server/service/security/auth/extractor/AbstractHeaderTokenExtractor.java
# application/src/main/java/org/thingsboard/server/service/security/auth/extractor/JwtQueryTokenExtractor.java
# application/src/main/java/org/thingsboard/server/service/security/auth/extractor/TokenExtractor.java
# application/src/test/java/org/thingsboard/server/service/install/update/DefaultDataUpdateServiceTest.java
# application/src/test/java/org/thingsboard/server/transport/lwm2m/security/cid/serverDtlsCidLength_16/NoSecLwM2MIntegrationDtlsCidLengthTest.java
# application/src/test/java/org/thingsboard/server/transport/lwm2m/security/cid/serverDtlsCidLength_2/PskLwm2mIntegrationDtlsCidLengthTest.java
# common/data/src/main/java/org/thingsboard/server/common/data/cf/configuration/CurrentOwnerDynamicSourceConfiguration.java
# common/data/src/main/java/org/thingsboard/server/exception/DataValidationException.java
# common/data/src/main/java/org/thingsboard/server/exception/EntitiesLimitExceededException.java
# dao/src/main/java/org/thingsboard/server/dao/model/sql/CalculatedFieldLinkEntity.java
# dao/src/main/java/org/thingsboard/server/dao/pat/ApiKeyDao.java
# dao/src/main/java/org/thingsboard/server/dao/service/validator/CalculatedFieldLinkDataValidator.java
# dao/src/main/java/org/thingsboard/server/dao/sql/cf/JpaCalculatedFieldLinkDao.java
# dao/src/main/java/org/thingsboard/server/dao/sql/pat/ApiKeyInfoRepository.java
# dao/src/test/java/org/thingsboard/server/dao/service/validator/CalculatedFieldLinkDataValidatorTest.java
# ui-ngx/src/app/modules/home/components/api-key/api-keys-table-dialog.component.scss
# ui-ngx/src/app/modules/home/components/audit-log/audit-log-details-dialog.component.scss
# ui-ngx/src/app/modules/home/components/audit-log/audit-log-header.component.scss
# ui-ngx/src/app/modules/home/components/calculated-fields/components/calculated-field-arguments/calculated-field-argument-panel.component.ts
# ui-ngx/src/app/modules/home/components/calculated-fields/components/debug-dialog/calculated-field-debug-dialog.component.ts
# ui-ngx/src/app/modules/home/components/calculated-fields/components/panel/calculated-field-argument-panel.component.html
# ui-ngx/src/app/modules/home/components/dashboard-page/dashboard-settings-dialog.component.ts
# ui-ngx/src/app/modules/home/components/device/device-credentials-lwm2m.component.ts
# ui-ngx/src/app/modules/home/components/event/event-content-dialog.component.scss
# ui-ngx/src/app/modules/home/components/profile/tenant/default-tenant-profile-configuration.component.ts
# ui-ngx/src/app/modules/home/pages/admin/two-factor-auth-settings.component.ts
# ui-ngx/src/app/modules/home/pages/alarm/alarm-routing.module.ts
# ui-ngx/src/app/modules/home/pages/iot-hub/iot-hub-alarm-rules-unavailable-page.component.html
# ui-ngx/src/app/modules/home/pages/iot-hub/iot-hub-alarm-rules-unavailable-page.component.scss
# ui-ngx/src/app/modules/home/pages/iot-hub/iot-hub-alarm-rules-unavailable-page.component.ts
# ui-ngx/src/app/modules/login/login-routing.module.ts
# ui-ngx/src/app/modules/login/pages/login/create-password.component.ts
# ui-ngx/src/app/modules/login/pages/login/reset-password.component.ts
# ui-ngx/src/app/shared/components/entity/entity-key-autocomplete.component.ts
# ui-ngx/src/app/shared/components/entity/entity-select.component.ts
# ui-ngx/src/app/shared/components/entity/entity-subtype-list.component.ts
# ui-ngx/src/app/shared/components/logo.component.scss
# ui-ngx/src/app/shared/components/logo.component.ts
# ui-ngx/src/app/shared/components/public-api.ts
# ui-ngx/src/app/shared/components/string-autocomplete.component.ts
# ui-ngx/src/app/shared/components/time-unit-input.component.ts
# ui-ngx/src/app/shared/models/calculated-field.models.ts
# ui-ngx/src/app/shared/models/two-factor-auth.models.ts
# ui-ngx/src/app/shared/models/widget/widget-model.definition.ts
1 week ago
e559297a3a
Merge remote-tracking branch 'origin/lts-4.3' into release-4.3
1 week ago
317a756141
Merge remote-tracking branch 'upstream/lts-4.2' into lts-4.3
1 week ago
a4cb2f9ded
Merge pull request #16125 from mtsymbarov-del/fix-cve
Fix CVE-2026-73088, CVE-2026-73089, CVE-2026-76172, CVE-2026-75931, CVE-2026-75975, CVE-2026-84375 and CVE-2026-75899
1 week ago
b209ed9f2d
Fixed CVE-2026-84375 in web-ui package
1 week ago
5b0f1f1a3a
Merge pull request #16071 from thingsboard/fix_bug_sparkplug_alias
Sparkplug: fixed empty telemetry metric name when using alias
1 week ago
c9caf4fa5e
Fixed CVE-2026-84375
1 week ago
8928da174f
Merge remote-tracking branch 'origin/lts-4.3' into release-4.3
1 week ago
8a58421a4f
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
1 week ago
7b3dfd34a0
Fixed CVE-2026-76172, CVE-2026-75931, CVE-2026-75975 and CVE-2026-75899
1 week ago
aefdcd7298
Fixed CVE-2026-73088 and CVE-2026-73089
1 week ago
764b3e0417
Merge pull request #16123 from thingsboard/fix/cves-lts-4.3
Fixed CVE-2026-65182, CVE-2026-65905, CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277, CVE-2026-68525, CVE-2026-71290
1 week ago
f49cf0c9ac
Merge pull request #16122 from thingsboard/fix/cves-lts-4.2
Fixed CVE-2026-65182, CVE-2026-65905, CVE-2026-66257, CVE-2026-66273, CVE-2026-66274, CVE-2026-66275, CVE-2026-66276, CVE-2026-66277, CVE-2026-68525, CVE-2026-71290
1 week ago
a4972dd845
Version set to 4.3.1.5
1 week ago
0843f11135
Merge branch 'lts-4.3' into release-4.3
# Conflicts:
# application/pom.xml
# common/actor/pom.xml
# common/cache/pom.xml
# common/cluster-api/pom.xml
# common/coap-server/pom.xml
# common/dao-api/pom.xml
# common/data/pom.xml
# common/discovery-api/pom.xml
# common/edge-api/pom.xml
# common/edqs/pom.xml
# common/message/pom.xml
# common/pom.xml
# common/proto/pom.xml
# common/queue/pom.xml
# common/script/pom.xml
# common/script/remote-js-client/pom.xml
# common/script/script-api/pom.xml
# common/stats/pom.xml
# common/transport/coap/pom.xml
# common/transport/http/pom.xml
# common/transport/lwm2m/pom.xml
# common/transport/mqtt/pom.xml
# common/transport/pom.xml
# common/transport/snmp/pom.xml
# common/transport/transport-api/pom.xml
# common/util/pom.xml
# common/version-control/pom.xml
# dao/pom.xml
# edqs/pom.xml
# monitoring/pom.xml
# msa/black-box-tests/pom.xml
# msa/edqs/pom.xml
# msa/js-executor/pom.xml
# msa/monitoring/pom.xml
# msa/pom.xml
# msa/tb-node/pom.xml
# msa/tb/pom.xml
# msa/transport/coap/pom.xml
# msa/transport/http/pom.xml
# msa/transport/lwm2m/pom.xml
# msa/transport/mqtt/pom.xml
# msa/transport/pom.xml
# msa/transport/snmp/pom.xml
# msa/vc-executor-docker/pom.xml
# msa/vc-executor/pom.xml
# msa/web-ui/pom.xml
# netty-mqtt/pom.xml
# pom.xml
# rest-client/pom.xml
# rule-engine/pom.xml
# rule-engine/rule-engine-api/pom.xml
# rule-engine/rule-engine-components/pom.xml
# tools/pom.xml
# transport/coap/pom.xml
# transport/http/pom.xml
# transport/lwm2m/pom.xml
# transport/mqtt/pom.xml
# transport/pom.xml
# transport/snmp/pom.xml
# ui-ngx/pom.xml
1 week ago
8018a11439
Merge fix/cves-lts-4.2 into fix/cves-lts-4.3
1 week ago
8dfc1c0c84
Bump httpclient5 from 5.5.2 to 5.6.4 to fix CVE-2026-71290
1 week ago
64ada3f560
Bump tomcat-embed from 10.1.56 to 10.1.59 to fix CVE-2026-65182, CVE-2026-65905, and CVE-2026-68525
1 week ago
fa82445a70
chore: restore OMA license notice on LwM2M object definitions
2 weeks ago
8d8953ec20
chore: declare Apache 2.0 license in pom.xml
2 weeks ago
7ffdb608c1
chore: keep CRLF line endings in Windows packaging scripts
2 weeks ago
89f1a6068a
chore: adopt SPDX license headers and upgrade license-maven-plugin to 5.1.2
2 weeks ago
25497c2366
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
2 weeks ago
0d3b41e002
Merge pull request #16034 from volodymyr-babak/remove-migrator
Removed outdated migrator tool
2 weeks ago
3f4e18833f
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
2 weeks ago
66075d6c02
Merge remote-tracking branch 'origin/fix/oauth2-user-tenant-lts-4.2' into lts-4.2
2 weeks ago
8dc8cb8d06
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
2 weeks ago
04d91311e3
Merge pull request #16102 from thingsboard/fix/prev-uri-validation-lts-4.2
Validate prevUri redirect parameter
2 weeks ago
1655cf9296
Assert the redirect URLs sent by the OAuth2 handlers
2 weeks ago
b8e17822b1
Include the email in the OAuth2 user resolution log message
2 weeks ago
a6c28e79b9
Allow an underscore in the mobile app callback url scheme
Mobile apps derive the scheme from their package name, which may contain
an underscore. It cannot introduce an authority, so accepting it keeps
the rule as strong as the RFC 3986 grammar.
2 weeks ago
0730387640
Resolve OAuth2 user within the tenant of the OAuth2 client
The user was looked up by email across the whole platform, so a client
belonging to one tenant could resolve a user of another. New users were also
placed in the tenant named by the provider response rather than in the tenant
that owns the client.
Both now follow the client's own tenant. System clients keep the platform-wide
behaviour they rely on.
2 weeks ago
e6ab6871e9
Log rejected prevUri values and share the mail flow constants
A rejected deep link is otherwise invisible to support. AdminController
reuses the prevUri parameter and cookie names instead of its own copies,
and its redirect target moves into a helper so the read side is covered
by a test.
2 weeks ago
1d60693835
Validate the callback url scheme where the redirect is built
The scheme is restored from the oauth2_auth_request cookie, which the
client can replace, so checking it only while the authorization request
is built still let a forged cookie point the token redirect at any host.
Both handlers now re-check it on read, sharing the rule with
OAuth2AppTokenFactory.
The success handler keeps prevUri out of the base URL as well, so the
error redirect no longer appends /login to an in-app path.
2 weeks ago
ee64fa1938
Validate mobile app callback url scheme
2 weeks ago
93b4433e6b
Validate prevUri redirect parameter
2 weeks ago
567a48e429
Merge pull request #15917 from ShvaykaD/fix/entity-aggregation-cf-numeric-result
Fixed timeseries entity aggregation calculated field storing numeric results as strings
2 weeks ago
52feea3326
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
3 weeks ago
c2e7a9f12a
Merge pull request #15910 from ShvaykaD/bugfix/subscription-skip-deleted-tenant
Skip subscription forwarding when tenant no longer exists
3 weeks ago
b8f7ce262d
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
3 weeks ago
66d8af91b1
Merge pull request #16038 from AndriiLandiak/fix/align-on-configuration-update-guard-lts-4.3
Compare edge customer before session state is replaced in onConfigurationUpdate
3 weeks ago
5d7287abd4
Merge pull request #16043 from AndriiLandiak/fix/sync-not-stranded-on-fetcher-failure-lts-4.3
Do not strand edge sync when an event fetcher fails
3 weeks ago
32742a3c38
Merge pull request #16044 from AndriiLandiak/fix/sync-not-stranded-on-fetcher-failure-lts-4.2
Do not strand edge sync when an event fetcher fails
3 weeks ago
db7efabd9d
Merge pull request #15733 from AndriiLandiak/fix-edge-notifications-4.3
Prevent disconnect notification spam from flapping edges
3 weeks ago
612b424e0f
Merge remote-tracking branch 'origin/lts-4.2' into lts-4.3
3 weeks ago
Viacheslav Klimov
Dmytro Skarzhynets
Vladyslav_Prykhodko
Maksym Tsymbarov