# thingsboard changelog

> Open-source IoT Platform - Device management, data collection, processing and visualization.

- Vendor: thingsboard
- Category: Frameworks & Libraries
- Official site: https://thingsboard.io/
- Tracked by: What's New (https://whatsnew.fyi/product/thingsboard)
- Harvested from: GitHub (thingsboard/thingsboard)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v4.3.1.3 — ThingsBoard 4.3.1.3 Release

- Date: 2026-06-30
- Version: v4.3.1.3
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.3
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1.3

- **security** — Fixed CVE-2026-44705 and CVE-2026-46625
- **security** — Fixed CVE-2026-45799
- **security** — Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011
- **security** — Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277
- **added** — Integration with IoT Hub
- **changed** — AI models: structured output support for more providers and fix Vertex AI location routing
- **fixed** — Prevented integer overflow in calculated field SUM output
- **fixed** — Fixed queue prefix not applied in some cases causing orphaned topics
- **fixed** — Fixed RPC call request rule node returning null body
- **fixed** — Fixed permission check on alarm comment edit
- **changed** — Hardened device credentials validation
- **fixed** — Fixed transport tenant-profile lock convoy under cold-cache reconnect storm
- **added** — Added help pages for html container
- **fixed** — Fixed Switch Control widget hanging on one-way persistent RPC
- **fixed** — Fixed no widgets shown in mobile view after state transition from divided layout
- **fixed** — Fixed change Password button stays disabled when form is filled programmatically
- **fixed** — Fixed sync highlight overlay scroll on Safari in string-pattern-autocomplete
- **fixed** — Fixed Advanced Widget Style Editor rendering
- **fixed** — Fixed dashboard logo stretch at full width
- **fixed** — Fixed "Confirm exit" dialog appearing when the form was not changed
- **added** — Added handler for WebGL unavailability in map widget
- **fixed** — Fixed edge event loss for kafka edges during sync

<!-- Release notes generated using configuration in .github/release.yml at release-4.3 -->

##### What's Changed
###### Security
* Fixed CVE-2026-44705 and CVE-2026-46625 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15721
* Fixed CVE-2026-45799 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15757
* Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15795
* Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15799
###### Core & Rule Engine
* Integration with IoT Hub by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15193
* AI models: structured output support for more providers; fix Vertex AI location routing by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15728
* Prevented integer overflow in calculated field SUM output by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15620
* Fixed queue prefix not applied in some cases causing orphaned topics by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15666
* Fixed RPC call request rule node returning null body by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15662
* Fixed permission check on alarm comment edit by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15715
* Hardened device credentials validation by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15550
* Fixed transport tenant-profile lock convoy under cold-cache reconnect storm by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15744
###### UI
* Added help pages for html container by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/15767
* Fixed Switch Control widget hanging on one-way persistent RPC by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15711
* Fixed no widgets shown in mobile view after state transition from divided layout by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15710
* Fixed change Password button stays disabled when form is filled programmatically by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15701
* Fixed sync highlight overlay scroll on Safari in string-pattern-autocomplete by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15754
* Fixed Advanced Widget Style Editor rendering by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15803
* Fixed dashboard logo stretch at full width by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15800
* Fixed "Confirm exit" dialog appearing when the form was not changed by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15764
* Added handler for WebGL unavailability in map widget by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15640
###### Edge
* Fixed edge event loss for kafka edges during sync by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15756


**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.3.1.2...v4.3.1.3

### v4.2.2.3 — ThingsBoard 4.2.2.3 Release

- Date: 2026-06-30
- Version: v4.2.2.3
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2.3
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.2.2.3

- **security** — Fixed CVE-2026-44705 and CVE-2026-46625
- **security** — Fixed CVE-2026-45799
- **security** — Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011
- **security** — Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277
- **added** — Integration with IoT Hub
- **changed** — AI models: structured output support for more providers and fix Vertex AI location routing
- **fixed** — Prevented integer overflow in calculated field SUM output
- **fixed** — Fixed queue prefix not applied in some cases causing orphaned topics
- **fixed** — Fixed RPC call request rule node returning null body
- **fixed** — Fixed permission check on alarm comment edit
- **changed** — Hardened device credentials validation
- **fixed** — Fixed transport tenant-profile lock convoy under cold-cache reconnect storm
- **added** — Added help pages for html container
- **fixed** — Fixed Switch Control widget hanging on one-way persistent RPC
- **fixed** — Fixed no widgets shown in mobile view after state transition from divided layout
- **fixed** — Fixed change Password button stays disabled when form is filled programmatically
- **fixed** — Fixed Advanced Widget Style Editor rendering
- **fixed** — Fixed dashboard logo stretch at full width
- **added** — Added handler for WebGL unavailability in map widget
- **fixed** — Fixed edge event loss for kafka edges during sync

<!-- Release notes generated using configuration in .github/release.yml at release-4.2 -->

##### What's Changed
###### Security
* Fixed CVE-2026-44705 and CVE-2026-46625 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15721
* Fixed CVE-2026-45799 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15757
* Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15795
* Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15799
###### Core & Rule Engine
* Integration with IoT Hub by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15193
* AI models: structured output support for more providers; fix Vertex AI location routing by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15728
* Prevented integer overflow in calculated field SUM output by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15620
* Fixed queue prefix not applied in some cases causing orphaned topics by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15666
* Fixed RPC call request rule node returning null body by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15662
* Fixed permission check on alarm comment edit by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15715
* Hardened device credentials validation by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15550
* Fixed transport tenant-profile lock convoy under cold-cache reconnect storm by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15744
###### UI
* Added help pages for html container by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/15767
* Fixed Switch Control widget hanging on one-way persistent RPC by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15711
* Fixed no widgets shown in mobile view after state transition from divided layout by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15710
* Fixed change Password button stays disabled when form is filled programmatically by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15701
* Fixed Advanced Widget Style Editor rendering by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15803
* Fixed dashboard logo stretch at full width by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15800
* Added handler for WebGL unavailability in map widget by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15640
###### Edge
* Fixed edge event loss for kafka edges during sync by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15756


**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.2.2.2...v4.2.2.3

### v4.3.1.2 — ThingsBoard 4.3.1.2 Release

- Date: 2026-05-28
- Version: v4.3.1.2
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.2
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1.2

- **security** — Fixed CWE-770 in Jackson Core
- **security** — Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483
- **security** — Fixed CVE-2025-70340: system alarm comments access control
- **security** — Fixed CVE-2026-39364, CVE-2026-39363, CVE-2026-4800
- **security** — Fixed CVE-2026-40895
- **security** — Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314
- **security** — Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198
- **security** — Fixed SSRF vulnerability in AI model provider URLs
- **security** — Fixed SSRF and file access vulnerabilities in TBEL script sandbox
- **security** — Fixed CVE-2026-40682, CVE-2026-42027
- **security** — Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587
- **security** — Hardened remote JS executor script invocation
- **security** — Fixed CVE-2026-41284, CVE-2026-43512
- **added** — Audit logging for tenant profile operations
- **added** — Added entity keys V2 endpoint with sample values
- **changed** — Performance and reliability improvements for Efento message processing
- **changed** — Refactored APIs to meet OpenAPI standard
- **added** — Exposed HTTP response compression configuration params
- **added** — LZ4 compression support for Kafka
- **fixed** — Fixed WS sessions limit handling for public users

<!-- Release notes generated using configuration in .github/release.yml at release-4.3 -->

##### What's Changed
###### Security
* Fixed CWE-770 in Jackson Core by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15368
* Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15417
* Fixed CVE-2025-70340: system alarm comments access control by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15377
* Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15466
* Fixed CVE-2026-40895 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15538
* Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15458
* Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15557
* Fixed SSRF vulnerability in AI model provider URLs by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15412
* Fixed SSRF and file access vulnerabilities in TBEL script sandbox by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15585
* Fixed CVE-2026-40682, CVE-2026-42027 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15588
* Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15598
* Hardened remote JS executor script invocation by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15600
* Fixed CVE-2026-41284, CVE-2026-43512 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15649
###### Core & Rule Engine
* Audit logging for tenant profile operations by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/13076
* Added entity keys V2 endpoint with sample values by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15044
* Performance and reliability improvements for Efento message processing by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15333
* Refactored APIs to meet OpenAPI standard by @dashevchenko and @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15443
* Exposed HTTP response compression configuration params by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15520
* LZ4 compression support for Kafka by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15565
* Fixed WS sessions limit handling for public users by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15313
* Fixed REST API Call node blocking actor thread and semaphore permit leak by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15334
* Fixed entity filtering by boolean data key for EDQS by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15457
* Fixed alarm rule crash on duration source change by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15439
* Fixed MAX aggregation for mixed double and long telemetry values by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15560
* Added config property to control null ordering in dashboards by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15425
###### UI
* Improved default tenant home dashboard by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15000
* Changed default "Add" button style in entity tables by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14984
* Bumped Node.js version from 22.18.0 to 22.22.2 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15330
* Enhanced localization: "save-to-gallery" translations by @deaflynx in https://github.com/thingsboard/thingsboard/pull/15339
* Exposed http-utils functions via WidgetContext.httpUtils by @vvlladd28 in https://github.com/th

_[Truncated at 4000 characters — full notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.2]_

### v4.2.2.2 — ThingsBoard 4.2.2.2 Release

- Date: 2026-05-28
- Version: v4.2.2.2
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2.2
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.2.2.2

- **security** — Fixed CWE-770 in Jackson Core
- **security** — Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483
- **security** — Fixed CVE-2025-70340: system alarm comments access control
- **security** — Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800
- **security** — Fixed CVE-2026-40895
- **security** — Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314
- **security** — Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198
- **security** — Fixed SSRF vulnerability in AI model provider URLs
- **security** — Fixed SSRF and file access vulnerabilities in TBEL script sandbox
- **security** — Fixed CVE-2026-40682, CVE-2026-42027
- **security** — Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587
- **security** — Hardened remote JS executor script invocation
- **security** — Fixed CVE-2026-41284, CVE-2026-43512
- **changed** — Performance and reliability improvements for Efento message processing
- **added** — Expose HTTP response compression configuration parameters
- **added** — LZ4 compression support for Kafka
- **fixed** — Fixed WS sessions limit handling for public users
- **fixed** — Fixed REST API Call node blocking actor thread and semaphore permit leak
- **fixed** — Fixed entity filtering by boolean data key for EDQS
- **fixed** — Fixed MAX aggregation for mixed double and long telemetry values

<!-- Release notes generated using configuration in .github/release.yml at release-4.2 -->

##### What's Changed
###### Security
* Fixed CWE-770 in Jackson Core by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15368
* Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15417
* Fixed CVE-2025-70340: system alarm comments access control by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15377
* Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15466
* Fixed CVE-2026-40895 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15538
* Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15458
* Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15557
* Fixed SSRF vulnerability in AI model provider URLs by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15412
* Fixed SSRF and file access vulnerabilities in TBEL script sandbox by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15585
* Fixed CVE-2026-40682, CVE-2026-42027 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15588
* Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15598
* Hardened remote JS executor script invocation by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15600
* Fixed CVE-2026-41284, CVE-2026-43512 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15649
###### Core & Rule Engine
* Performance and reliability improvements for Efento message processing by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15333
* Exposed HTTP response compression configuration params by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15520
* LZ4 compression support for Kafka by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15565
* Fixed WS sessions limit handling for public users by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15313
* Fixed REST API Call node blocking actor thread and semaphore permit leak by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15334
* Fixed entity filtering by boolean data key for EDQS by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15457
* Fixed MAX aggregation for mixed double and long telemetry values by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15560
* Added config property to control null ordering in dashboards by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15425
###### UI
* Bumped Node.js version from 22.18.0 to 22.22.2 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15330
* HTML container widget by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15556
* Hidden "Add Telemetry" button for Entity view by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15362
* Added '@angular/core/rxjs-interop' to modules map by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15373
* Fixed select options being clipped in widget settings form by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15399
* Fixed display long texts in Alarm asignee panel by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15408
* Fixed Alarm Assignee icon placement by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15423
* Adjusted size of entity type select to fit error message by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15427
* Fixed show/hide of custom header actions when using function to control visibility by @mtsymbarov-del in h

_[Truncated at 4000 characters — full notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2.2]_

### v4.3.1.1 — ThingsBoard 4.3.1.1 Release

- Date: 2026-03-31
- Version: v4.3.1.1
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.1
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1.1

- **security** — Fixed XSS vulnerability in notification center
- **security** — Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400
- **security** — Added configurable security headers and env-var-backed CORS configuration
- **security** — Fixed SSRF DNS rebinding bypass and added allow-list
- **security** — Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904
- **security** — Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 and upgraded to Spring Boot 3.5
- **security** — Fixed CVE-2026-33228
- **security** — Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq
- **security** — Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671
- **security** — Fixed CVE-2026-0861, CVE-2026-0915, CVE-2025-15281 for Docker images
- **changed** — Sanitize database error messages
- **added** — Added OTA package data cleanup
- **fixed** — Fixed notification requests and RPC cleanup timeout on large datasets
- **added** — Added WS update on telemetry deletion
- **changed** — Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN
- **changed** — Hide "Show on widgets" button on sysadmin level
- **fixed** — Fixed WS reconnect loop and notification spam when session limit is reached
- **fixed** — Fixed missing translation for Polylines toggle in map settings
- **fixed** — Fixed resetting of validation on storeLink property

<!-- Release notes generated using configuration in .github/release.yml at release-4.3 -->

##### What's Changed
###### Security
* Fixed XSS vulnerability in notification center by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15204
* Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15244
* Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15254
* Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15253
* Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15251
* Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15278
* Fixed CVE-2026-33228 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15293
* Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15315
* Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15322
* Fixed CVE-2026-0861, CVE-2026-0915, CVE-2025-15281 for Docker images by @ViacheslavKlimov
###### Core & Rule Engine
* Sanitize database error messages by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15262
* Added OTA package data cleanup by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14775
* Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14762
* Added WS update on telemetry deletion by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14781
###### UI
* Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15237
* Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15203
* Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15219
* Fixed missing translation for Polylines toggle in map settings by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15252
* Fixed resetting of validation on storeLink property by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15168
* Fixed time series table widgets tab style by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15267
* Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15292
* Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15273
###### Edge
* Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15205
###### Transport
* MQTTS metrics and client address logging on exceptionCaught by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15112
* Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15143


**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.3.1...v4.3.1.1

### v4.2.2.1 — ThingsBoard 4.2.2.1 Release

- Date: 2026-03-31
- Version: v4.2.2.1
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2.1
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.2.2.1

- **security** — Fixed XSS vulnerability in notification center
- **security** — Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400
- **security** — Added configurable security headers and env-var-backed CORS configuration
- **security** — Fixed SSRF DNS rebinding bypass and added allow-list
- **security** — Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904
- **security** — Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 and upgraded Spring Boot to 3.5
- **security** — Fixed CVE-2026-33228
- **security** — Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq
- **security** — Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671
- **changed** — Sanitize database error messages
- **added** — Added OTA package data cleanup
- **fixed** — Fixed notification requests and RPC cleanup timeout on large datasets
- **added** — Added WS update on telemetry deletion
- **changed** — Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN
- **changed** — Hidden Show on widgets button on sysadmin level
- **fixed** — Fixed WS reconnect loop and notification spam when session limit is reached
- **fixed** — Fixed resetting of validation on storeLink property
- **fixed** — Fixed proxy error handling for 502/503/504 HTTP status codes
- **fixed** — Fixed string-items-list autocomplete selection and blur handling
- **added** — Support combined PEM cert+key for Edge gRPC SSL
- **fixed** — Fixed LwM2M Redis stores startup by using separate connections for SCAN and GET

<!-- Release notes generated using configuration in .github/release.yml at release-4.2 -->

##### What's Changed
###### Security
* Fixed XSS vulnerability in notification center by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15204
* Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15244
* Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15254
* Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15253
* Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15251
* Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15278
* Fixed CVE-2026-33228 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15293
* Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15315
* Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15322
###### Core & Rule Engine
* Sanitize database error messages by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15262
* Added OTA package data cleanup by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14775
* Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14762
* Added WS update on telemetry deletion by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14781
###### UI
* Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15237
* Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15203
* Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15219
* Fixed resetting of validation on storeLink property by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15168
* Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15292
* Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15273
###### Edge
* Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15205
###### Transport
* Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15143


**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.2.2...v4.2.2.1

### v4.3.1 — ThingsBoard 4.3.1 Release

- Date: 2026-03-10
- Version: v4.3.1
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1

- **security** — Fixed CVE-2026-24734 and CVE-2025-66614
- **security** — Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960
- **security** — Fixed CVE-2026-27903 and CVE-2026-27904
- **security** — Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env)
- **security** — Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq)
- **security** — Fixed CVE-2026-27970 and CVE-2026-2391
- **security** — Fixed CVE-2026-2781, CVE-2026-25646, CVE-2026-21945 and CVE-2026-21932 for Docker images
- **changed** — Migrated UI to Angular 20
- **fixed** — Fixed getTimeseries API (/{entityType}/{entityId}/values/timeseries)
- **added** — Added Cassandra result set byte-size limit
- **fixed** — Fixed TBEL script execution failures on repeated runs
- **fixed** — Fixed blocking JPA queries on access-validator single thread
- **fixed** — Fixed preservation of rule node execution counter in delay and deduplication nodes
- **changed** — Improved Apple OAuth2 mapper and refactored OAuth2 client validation
- **fixed** — Fixed infinite loop when rule chain input node forwards to its own rule chain
- **changed** — Made max WS message size configurable
- **fixed** — Fixed Redirect Url encoding
- **fixed** — Fixed loading and placement of Material icons
- **fixed** — Fixed Popover placement for Marker, Polygon and Circle overlay config
- **fixed** — Fixed adaptive in mail server configuration

<!-- Release notes generated using configuration in .github/release.yml at release-4.3 -->

##### What's Changed
###### Security
* Fixed CVE-2026-24734 and CVE-2025-66614  by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15076
* Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15079
* Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15109
* Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15123
* Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15124
* Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15128
* Fixed CVE-2026-2781, CVE-2026-25646, CVE-2026-21945 and CVE-2026-21932 for Docker images by @ViacheslavKlimov and @smatvienko-tb
###### Major UI
* Angular 20 migration by @ikulikov in https://github.com/thingsboard/thingsboard/pull/14944
###### Core & Rule Engine
* Fixed getTimeseries API (/{entityType}/{entityId}/values/timeseries) by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15054
* Added Cassandra result set byte-size limit by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15058
* Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15078
* Fixed blocking JPA queries on access-validator single thread by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15101
* Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15100
* Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15120
* Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15102
* Made max WS message size configurable by @DmytroKhylko in https://github.com/thingsboard/thingsboard/pull/15116
###### UI
* Fixed Redirect Url encoding by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14985
* Fixed loading and placement of Material icons by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14959
* Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14978
* Fixed adaptive in mail server configuration by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15018
* Fixed Range and Bar chart limits setup by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14964
* Fixed RGBA and HSLA inputs in color picker by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15031
* Fixed Entity key autocomplete change check by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15080
* Fixed a race condition causing the toast component by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15071
* Fixed a race condition when init image map by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15097
* Fixed default timewindow config in widget editor page by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15108
* Removed pattern validation from name field on CF  by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15142
* Updated Ukrainian locale by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15096
* Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina in https://github.com/thingsboard/thingsboard/pull/15130
###### Transport
* Fixed Sparkplug BIRTH message validation for metrics with

_[Truncated at 4000 characters — full notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1]_

### v4.2.2 — ThingsBoard 4.2.2 Release

- Date: 2026-03-10
- Version: v4.2.2
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.2.2

- **security** — Fixed CVE-2026-24734 and CVE-2025-66614
- **security** — Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960
- **security** — Fixed CVE-2026-27903 and CVE-2026-27904
- **security** — Add SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env)
- **security** — Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq)
- **security** — Fixed CVE-2026-27970 and CVE-2026-2391
- **security** — Fixed CVE-2026-2781 and CVE-2026-25646 for Docker images
- **changed** — Migrate UI to Angular 20
- **added** — Add Cassandra result set byte-size limit
- **fixed** — Fix TBEL script execution failures on repeated runs
- **fixed** — Fix blocking JPA queries on access-validator single thread
- **fixed** — Fix preservation of rule node execution counter in delay and deduplication nodes
- **changed** — Improve Apple OAuth2 mapper and refactor OAuth2 client validation
- **fixed** — Fix infinite loop when rule chain input node forwards to its own rule chain
- **added** — Make max WS message size configurable
- **added** — Extend modules map with moment-timezone, canvas-gauges and ngx-hm-carousel
- **fixed** — Fix Redirect Url encoding
- **fixed** — Fix Popover placement for Marker, Polygon and Circle overlay config
- **fixed** — Fix adaptive in mail server configuration
- **fixed** — Fix race condition causing the toast component

<!-- Release notes generated using configuration in .github/release.yml at release-4.2 -->

##### What's Changed
###### Security
* Fixed CVE-2026-24734 and CVE-2025-66614 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15076
* Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15079
* Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15109
* Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15123
* Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15124
* Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15128
* Fixed CVE-2026-2781 and CVE-2026-25646 for Docker images by @ViacheslavKlimov and @smatvienko-tb
###### Major UI
* Angular 20 migration by @ikulikov in https://github.com/thingsboard/thingsboard/pull/14935
###### Core & Rule Engine
* Added Cassandra result set byte-size limit by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15058
* Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15078
* Fixed blocking JPA queries on access-validator single thread by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15101
* Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15100
* Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15120
* Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15102
* Made max WS message size configurable by @DmytroKhylko in https://github.com/thingsboard/thingsboard/pull/15116
###### UI
* Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina in https://github.com/thingsboard/thingsboard/pull/15130
* Fixed Redirect Url encoding by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14985
* Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14978
* Fixed adaptive in mail server configuration by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15018
* Fixed a race condition causing the toast component by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15071
* Fixed a race condition when init image map by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15097
* Removed pattern validation from name field on CF  by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15142
###### Transport
* Fixed Sparkplug BIRTH message validation for metrics with empty string values by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/14760
###### Edge
* Event-sourced propagation for admin settings by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15050

**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.2.1.2...v4.2.2

### v4.3.0.1 — ThingsBoard 4.3.0.1 Release

- Date: 2026-02-03
- Version: v4.3.0.1
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.0.1
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.0.1

- **security** — Fixed CVE-2025-69420 and CVE-2025-69419 for Docker images
- **security** — Fixed CVE-2026-22610
- **fixed** — Fixed propagation path updates handling for propagation CF
- **fixed** — Fixed unnecessary database updates for disabled users during failed login
- **changed** — Updated locales el_GR, es_ES, hi_IN, nl_NL, no_NO
- **fixed** — Fixed form settings in Send RPC and Segmented Button widgets
- **fixed** — Fixed help link for API key
- **changed** — Removed required from "Current Customer" field in entity alias
- **fixed** — Fixed missing '%' character in alias help text
- **fixed** — Fixed default settings in API Usage widget
- **fixed** — Fixed padding in Range Chart and Bar Chart with label widgets when overlay enabled
- **fixed** — Fixed errors when public user views alarm comments
- **fixed** — Fixed errors in alarm rules
- **fixed** — Fixed race condition during Power Button widget initialization

<!-- Release notes generated using configuration in .github/release.yml at release-4.3 -->

##### What's Changed

###### Security
* Fixed CVE-2025-69420 and CVE-2025-69419 for Docker images by @ViacheslavKlimov and @smatvienko-tb
* Fixed CVE-2026-22610 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14865

###### Core & Rule Engine
* Fixed propagation path updates handling for propagation CF by @ShvaykaD in https://github.com/thingsboard/thingsboard/pull/14853
* Fixed unnecessary database updates for disabled users during failed login by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14751

###### UI
* Updated locales el_GR, es_ES, hi_IN, nl_NL, no_NO by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14920
* Fixed form settings in Send RPC and Segmented Button widgets by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14863
* Fixed help link for API key by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14864
* Removed required from "Current Customer" field in entity alias by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14816
* Fixed missing '%' character in alias help text by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14903
* Fixed default settings in API Usage widget by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14909
* Fixed padding in Range Chart and Bar Chart with label widgets when overlay enabled by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14895
* Fixed errors when public user views alarm comments by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14922
* Fixed errors in alarm rules by @ArtemDzhereleiko in https://github.com/thingsboard/thingsboard/pull/14941
* Fixed race condition during Power Button widget initialization by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14925

**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.3...v4.3.0.1

### v4.2.1.2 — ThingsBoard 4.2.1.2 Release

- Date: 2026-02-03
- Version: v4.2.1.2
- Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.1.2
- Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.2.1.2

- **security** — Fixed CVE-2025-68973, CVE-2025-6020, CVE-2025-13601, CVE-2025-69420, CVE-2026-21945, CVE-2025-69419 and CVE-2026-21932 for Docker images
- **security** — Fixed CVE-2026-22610
- **security** — Fixed CVE-2025-15284
- **added** — Added Redis ACL (username) authentication support
- **fixed** — Fixed invalid finish ts for jobs with zero tasks in task manager
- **fixed** — Fixed entity data query for sysadmin
- **fixed** — Fixed partition cleanup for non-public PostgreSQL schemas
- **fixed** — Fixed SMS usage state when disabled in tenant profile
- **fixed** — Fixed unnecessary database updates for disabled users during failed login
- **fixed** — Fixed NPE for LwM2M client context after reboot
- **fixed** — Fixed CoAP Unicast/Multicast MID Conflict and Silent ACK Rejection
- **fixed** — Fixed LwM2M bootstrap toggle not persisting Add Bootstrap config button state
- **fixed** — Fixed map action panel hide when switching to another data layer
- **fixed** — Fixed opening tenant profile autocomplete when Create new button is clicked
- **fixed** — Fixed country autocomplete autofill and improved validation
- **fixed** — Fixed missing '%' character in alias help text
- **fixed** — Fixed padding in Range Chart and Bar Chart with label widgets when overlay enabled
- **fixed** — Fixed errors when public user views alarm comments

<!-- Release notes generated using configuration in .github/release.yml at release-4.2 -->

##### What's Changed

###### Security
* Fixed CVE-2025-68973, CVE-2025-6020, CVE-2025-13601, CVE-2025-69420, CVE-2026-21945, CVE-2025-69419 and CVE-2026-21932 for Docker images by @ViacheslavKlimov and @smatvienko-tb
* Fixed CVE-2026-22610 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14865
* Fixed CVE-2025-15284 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14729

###### Core & Rule Engine
* Added Redis ACL (username) authentication support by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14743
* Fixed invalid finish ts for jobs with zero tasks in task manager by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/14728
* Fixed entity data query for sysadmin by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14564
* Fixed partition cleanup for non-public PostgreSQL schemas by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14631
* Fixed SMS usage state when disabled in tenant profile by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14792
* Fixed unnecessary database updates for disabled users during failed login by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14751

###### Transport
* Fixed NPE for LwM2M client context after reboot by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/14645
* Fixed CoAP Unicast/Multicast MID Conflict and Silent ACK Rejection by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/14748

###### UI
* Fixed LwM2M bootstrap toggle not persisting "Add Bootstrap config" button state by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14614
* Fixed map action panel hide when switching to another data layer by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14746
* Fixed opening tenant profile autocomplete when "Create new" button is clicked by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14804
* Fixed country autocomplete autofill and improved validation by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14802
* Fixed missing '%' character in alias help text by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14903
* Fixed padding in Range Chart and Bar Chart with label widgets when overlay enabled by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14895
* Fixed errors when public user views alarm comments by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14922

**Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.2.1.1...v4.2.1.2