thingsboard v4.2.2.1 release notes

Fixed XSS vulnerability in notification center by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15204
Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15244
Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15254
Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15253
Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15251
Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15278
Fixed CVE-2026-33228 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15293
Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15315
Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15322

Sanitize database error messages by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15262
Added OTA package data cleanup by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14775
Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14762
Added WS update on telemetry deletion by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14781

Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15237
Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15203
Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15219
Fixed resetting of validation on storeLink property by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15168
Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15292
Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15273

Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15205

Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15143

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.2.2...v4.2.2.1

thingsboard v4.2.2.1