ThingsBoard 4.3.1.3 Release

What's Changed

Security

• Fixed CVE-2026-44705 and CVE-2026-46625 by @mtsymbarov-del in #15721
• Fixed CVE-2026-45799 by @ViacheslavKlimov in #15757
• Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011 by @ViacheslavKlimov in #15795
• Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277 by @mtsymbarov-del in #15799

Core & Rule Engine

• Integration with IoT Hub by @ikulikov in #15193
• AI models: structured output support for more providers; fix Vertex AI location routing by @dskarzh in #15728
• Prevented integer overflow in calculated field SUM output by @volodymyr-babak in #15620
• Fixed queue prefix not applied in some cases causing orphaned topics by @AndriiLandiak in #15666
• Fixed RPC call request rule node returning null body by @dashevchenko in #15662
• Fixed permission check on alarm comment edit by @dashevchenko in #15715
• Hardened device credentials validation by @dashevchenko in #15550
• Fixed transport tenant-profile lock convoy under cold-cache reconnect storm by @ViacheslavKlimov in #15744

UI

• Added help pages for html container by @pinkevmladchy in #15767
• Fixed Switch Control widget hanging on one-way persistent RPC by @mtsymbarov-del in #15711
• Fixed no widgets shown in mobile view after state transition from divided layout by @mtsymbarov-del in #15710
• Fixed change Password button stays disabled when form is filled programmatically by @mtsymbarov-del in #15701
• Fixed sync highlight overlay scroll on Safari in string-pattern-autocomplete by @mtsymbarov-del in #15754
• Fixed Advanced Widget Style Editor rendering by @mtsymbarov-del in #15803
• Fixed dashboard logo stretch at full width by @mtsymbarov-del in #15800
• Fixed "Confirm exit" dialog appearing when the form was not changed by @mtsymbarov-del in #15764
• Added handler for WebGL unavailability in map widget by @mtsymbarov-del in #15640

Edge

• Fixed edge event loss for kafka edges during sync by @AndriiLandiak in #15756

Full Changelog: v4.3.1.2...v4.3.1.3

ThingsBoard 4.2.2.3 Release

What's Changed

Security

• Fixed CVE-2026-44705 and CVE-2026-46625 by @mtsymbarov-del in #15721
• Fixed CVE-2026-45799 by @ViacheslavKlimov in #15757
• Fixed CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45292, CVE-2026-45416, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-48006, CVE-2026-48059, CVE-2026-50010, CVE-2026-50011 by @ViacheslavKlimov in #15795
• Fixed CVE-2026-44705, CVE-2026-50171, CVE-2026-50170, CVE-2026-54267, CVE-2026-54266, CVE-2026-54290, CVE-2026-48779, CVE-2026-54268, CWE-426, CWE-494, CVE-2026-53571, CVE-2026-12143, CVE-2026-9277 by @mtsymbarov-del in #15799

Core & Rule Engine

• Integration with IoT Hub by @ikulikov in #15193
• AI models: structured output support for more providers; fix Vertex AI location routing by @dskarzh in #15728
• Prevented integer overflow in calculated field SUM output by @volodymyr-babak in #15620
• Fixed queue prefix not applied in some cases causing orphaned topics by @AndriiLandiak in #15666
• Fixed RPC call request rule node returning null body by @dashevchenko in #15662
• Fixed permission check on alarm comment edit by @dashevchenko in #15715
• Hardened device credentials validation by @dashevchenko in #15550
• Fixed transport tenant-profile lock convoy under cold-cache reconnect storm by @ViacheslavKlimov in #15744

UI

• Added help pages for html container by @pinkevmladchy in #15767
• Fixed Switch Control widget hanging on one-way persistent RPC by @mtsymbarov-del in #15711
• Fixed no widgets shown in mobile view after state transition from divided layout by @mtsymbarov-del in #15710
• Fixed change Password button stays disabled when form is filled programmatically by @mtsymbarov-del in #15701
• Fixed Advanced Widget Style Editor rendering by @mtsymbarov-del in #15803
• Fixed dashboard logo stretch at full width by @mtsymbarov-del in #15800
• Added handler for WebGL unavailability in map widget by @mtsymbarov-del in #15640

Edge

• Fixed edge event loss for kafka edges during sync by @AndriiLandiak in #15756

Full Changelog: v4.2.2.2...v4.2.2.3

ThingsBoard 4.3.1.2 Release

What's Changed

Security

• Fixed CWE-770 in Jackson Core by @zzzeebra in #15368
• Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 by @zzzeebra in #15417
• Fixed CVE-2025-70340: system alarm comments access control by @dashevchenko in #15377
• Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 by @vvlladd28 in #15466
• Fixed CVE-2026-40895 by @mtsymbarov-del in #15538
• Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 by @zzzeebra in #15458
• Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 by @zzzeebra in #15557
• Fixed SSRF vulnerability in AI model provider URLs by @zzzeebra in #15412
• Fixed SSRF and file access vulnerabilities in TBEL script sandbox by @zzzeebra in #15585
• Fixed CVE-2026-40682, CVE-2026-42027 by @zzzeebra in #15588
• Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 by @ViacheslavKlimov in #15598
• Hardened remote JS executor script invocation by @smatvienko-tb in #15600
• Fixed CVE-2026-41284, CVE-2026-43512 by @ViacheslavKlimov in #15649

Core & Rule Engine

• Audit logging for tenant profile operations by @zzzeebra in #13076
• Added entity keys V2 endpoint with sample values by @dskarzh in #15044
• Performance and reliability improvements for Efento message processing by @dashevchenko in #15333
• Refactored APIs to meet OpenAPI standard by @dashevchenko and @ViacheslavKlimov in #15443
• Exposed HTTP response compression configuration params by @dashevchenko in #15520
• LZ4 compression support for Kafka by @volodymyr-babak in #15565
• Fixed WS sessions limit handling for public users by @dashevchenko in #15313
• Fixed REST API Call node blocking actor thread and semaphore permit leak by @smatvienko-tb in #15334
• Fixed entity filtering by boolean data key for EDQS by @dashevchenko in #15457
• Fixed alarm rule crash on duration source change by @zzzeebra in #15439
• Fixed MAX aggregation for mixed double and long telemetry values by @dashevchenko in #15560
• Added config property to control null ordering in dashboards by @dashevchenko in #15425

UI

• Improved default tenant home dashboard by @vvlladd28 in #15000
• Changed default "Add" button style in entity tables by @vvlladd28 in #14984
• Bumped Node.js version from 22.18.0 to 22.22.2 by @ViacheslavKlimov in #15330
• Enhanced localization: "save-to-gallery" translations by @deaflynx in #15339
• Exposed http-utils functions via WidgetContext.httpUtils by @vvlladd28 in #15395
• Added roundDown option to ShortNumberPipe by @vvlladd28 in #15393
• HTML container widget by @ikulikov in #15556
• Hidden "Add Telemetry" button for Entity view by @mtsymbarov-del in #15362
• Added '@angular/core/rxjs-interop' to modules map by @vvlladd28 in #15373
• Fixed Datasource determination for autocomplete patterns if datasource is empty by @mtsymbarov-del in #15340
• Fixed hint alignment for propagate alarm rule field by @mtsymbarov-del in #15360
• Fixed missing 'type' property in alarm rule condition on save by @vvlladd28 in #15392
• Fixed select options being clipped in widget settings form by @vvlladd28 in #15399
• Fixed translation for Asset and Device profile by @mtsymbarov-del in #15421
• Removed "Alarm rules" step from setting up device profile by @mtsymbarov-del in #15422
• Fixed display long texts in Alarm asignee panel by @mtsymbarov-del in #15408
• Fixed Alarm Assignee icon placement by @mtsymbarov-del in #15423
• Adjusted size of entity type select to fit error message by @mtsymbarov-del in #15427
• Fixed show/hide of custom header actions when using function to control visibility by @mtsymbarov-del in #15430
• Fixed not set pageSize to child nodes in Entities hierarchy widget by @mtsymbarov-del in #15433
• Fixed not process aggregation keys in Entities hierarchy widget by @mtsymbarov-del in #15434
• Fixed icon placement in Value stepper icon by @mtsymbarov-del in #15489
• Fixed display column panel hiding not selectable columns by @mtsymbarov-del in #15490
• Fixed map shape labels drifting from center after viewport resize by @mtsymbarov-del in #15531
• Map widget: fixed data aggregation for additional data keys and import/export widget JSON for polylines layer by @ChantsovaEkaterina in #15579
• Fixed CSV import not unescaping double quotes in unquoted fields by @ChantsovaEkaterina in #15581
• Removed unnecessary DomSanitizer bypass in photo camera input widget by @mtsymbarov-del in #15639

Transport

• Added automatic SSL/TLS certificate reload for transports without service restart by @AndriiLandiak in #15301
• Fixed app hanging on MQTT port conflict at startup by @zzzeebra in #15451
• SNMP: defer querying tasks until transport session is registered by @volodymyr-babak in #15346

Edge

• Added syncInProgress as edge attribute by @volodymyr-babak in #15111
• API key edge sync support by @volodymyr-babak in #15167

Full Changelog: v4.3.1.1...v4.3.1.2

ThingsBoard 4.2.2.2 Release

What's Changed

Security

• Fixed CWE-770 in Jackson Core by @zzzeebra in #15368
• Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 by @zzzeebra in #15417
• Fixed CVE-2025-70340: system alarm comments access control by @dashevchenko in #15377
• Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 by @vvlladd28 in #15466
• Fixed CVE-2026-40895 by @mtsymbarov-del in #15538
• Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 by @zzzeebra in #15458
• Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 by @zzzeebra in #15557
• Fixed SSRF vulnerability in AI model provider URLs by @zzzeebra in #15412
• Fixed SSRF and file access vulnerabilities in TBEL script sandbox by @zzzeebra in #15585
• Fixed CVE-2026-40682, CVE-2026-42027 by @zzzeebra in #15588
• Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 by @ViacheslavKlimov in #15598
• Hardened remote JS executor script invocation by @smatvienko-tb in #15600
• Fixed CVE-2026-41284, CVE-2026-43512 by @ViacheslavKlimov in #15649

Core & Rule Engine

• Performance and reliability improvements for Efento message processing by @dashevchenko in #15333
• Exposed HTTP response compression configuration params by @dashevchenko in #15520
• LZ4 compression support for Kafka by @volodymyr-babak in #15565
• Fixed WS sessions limit handling for public users by @dashevchenko in #15313
• Fixed REST API Call node blocking actor thread and semaphore permit leak by @smatvienko-tb in #15334
• Fixed entity filtering by boolean data key for EDQS by @dashevchenko in #15457
• Fixed MAX aggregation for mixed double and long telemetry values by @dashevchenko in #15560
• Added config property to control null ordering in dashboards by @dashevchenko in #15425

UI

• Bumped Node.js version from 22.18.0 to 22.22.2 by @ViacheslavKlimov in #15330
• HTML container widget by @ikulikov in #15556
• Hidden "Add Telemetry" button for Entity view by @mtsymbarov-del in #15362
• Added '@angular/core/rxjs-interop' to modules map by @vvlladd28 in #15373
• Fixed select options being clipped in widget settings form by @vvlladd28 in #15399
• Fixed display long texts in Alarm asignee panel by @mtsymbarov-del in #15408
• Fixed Alarm Assignee icon placement by @mtsymbarov-del in #15423
• Adjusted size of entity type select to fit error message by @mtsymbarov-del in #15427
• Fixed show/hide of custom header actions when using function to control visibility by @mtsymbarov-del in #15430
• Fixed not set pageSize to child nodes in Entities hierarchy widget by @mtsymbarov-del in #15433
• Fixed not process aggregation keys in Entities hierarchy widget by @mtsymbarov-del in #15434
• Fixed map shape labels drifting from center after viewport resize by @mtsymbarov-del in #15531
• Fixed CSV import not unescaping double quotes in unquoted fields by @ChantsovaEkaterina in #15581

Transport

• Added automatic SSL/TLS certificate reload for transports without service restart by @AndriiLandiak in #15301
• Fixed app hanging on MQTT port conflict at startup by @zzzeebra in #15451
• SNMP: defer querying tasks until transport session is registered by @volodymyr-babak in #15346

Full Changelog: v4.2.2.1...v4.2.2.2

ThingsBoard 4.3.1.1 Release

What's Changed

Security

• Fixed XSS vulnerability in notification center by @vvlladd28 in #15204
• Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in #15244
• Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in #15254
• Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in #15253
• Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in #15251
• Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in #15278
• Fixed CVE-2026-33228 by @vvlladd28 in #15293
• Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in #15315
• Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in #15322
• Fixed CVE-2026-0861, CVE-2026-0915, CVE-2025-15281 for Docker images by @ViacheslavKlimov

Core & Rule Engine

• Sanitize database error messages by @ViacheslavKlimov in #15262
• Added OTA package data cleanup by @AndriiLandiak in #14775
• Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in #14762
• Added WS update on telemetry deletion by @dashevchenko in #14781

UI

• Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in #15237
• Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in #15203
• Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in #15219
• Fixed missing translation for Polylines toggle in map settings by @vvlladd28 in #15252
• Fixed resetting of validation on storeLink property by @mtsymbarov-del in #15168
• Fixed time series table widgets tab style by @mtsymbarov-del in #15267
• Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in #15292
• Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in #15273

Edge

• Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in #15205

Transport

• MQTTS metrics and client address logging on exceptionCaught by @smatvienko-tb in #15112
• Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in #15143

Full Changelog: v4.3.1...v4.3.1.1

ThingsBoard 4.2.2.1 Release

What's Changed

Security

• Fixed XSS vulnerability in notification center by @vvlladd28 in #15204
• Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in #15244
• Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in #15254
• Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in #15253
• Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in #15251
• Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in #15278
• Fixed CVE-2026-33228 by @vvlladd28 in #15293
• Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in #15315
• Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in #15322

Core & Rule Engine

• Sanitize database error messages by @ViacheslavKlimov in #15262
• Added OTA package data cleanup by @AndriiLandiak in #14775
• Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in #14762
• Added WS update on telemetry deletion by @dashevchenko in #14781

UI

• Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in #15237
• Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in #15203
• Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in #15219
• Fixed resetting of validation on storeLink property by @mtsymbarov-del in #15168
• Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in #15292
• Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in #15273

Edge

• Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in #15205

Transport

• Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in #15143

Full Changelog: v4.2.2...v4.2.2.1

ThingsBoard 4.3.1 Release

What's Changed

Security

• Fixed CVE-2026-24734 and CVE-2025-66614 by @ViacheslavKlimov in #15076
• Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28 in #15079
• Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28 in #15109
• Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov in #15123
• Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov in #15124
• Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28 in #15128
• Fixed CVE-2026-2781, CVE-2026-25646, CVE-2026-21945 and CVE-2026-21932 for Docker images by @ViacheslavKlimov and @smatvienko-tb

Major UI

• Angular 20 migration by @ikulikov in #14944

Core & Rule Engine

• Fixed getTimeseries API (/{entityType}/{entityId}/values/timeseries) by @dashevchenko in #15054
• Added Cassandra result set byte-size limit by @ViacheslavKlimov in #15058
• Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov in #15078
• Fixed blocking JPA queries on access-validator single thread by @dskarzh in #15101
• Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh in #15100
• Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov in #15120
• Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb in #15102
• Made max WS message size configurable by @DmytroKhylko in #15116

UI

• Fixed Redirect Url encoding by @mtsymbarov-del in #14985
• Fixed loading and placement of Material icons by @mtsymbarov-del in #14959
• Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del in #14978
• Fixed adaptive in mail server configuration by @vvlladd28 in #15018
• Fixed Range and Bar chart limits setup by @mtsymbarov-del in #14964
• Fixed RGBA and HSLA inputs in color picker by @mtsymbarov-del in #15031
• Fixed Entity key autocomplete change check by @mtsymbarov-del in #15080
• Fixed a race condition causing the toast component by @mtsymbarov-del in #15071
• Fixed a race condition when init image map by @mtsymbarov-del in #15097
• Fixed default timewindow config in widget editor page by @vvlladd28 in #15108
• Removed pattern validation from name field on CF by @mtsymbarov-del in #15142
• Updated Ukrainian locale by @vvlladd28 in #15096
• Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina in #15130

Transport

• Fixed Sparkplug BIRTH message validation for metrics with empty string values by @nickAS21 in #14760

Edge

• Event-sourced propagation for admin settings by @volodymyr-babak in #15050

Full Changelog: v4.3.0.1...v4.3.1

ThingsBoard 4.2.2 Release

What's Changed

Security

• Fixed CVE-2026-24734 and CVE-2025-66614 by @ViacheslavKlimov in #15076
• Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28 in #15079
• Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28 in #15109
• Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov in #15123
• Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov in #15124
• Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28 in #15128
• Fixed CVE-2026-2781 and CVE-2026-25646 for Docker images by @ViacheslavKlimov and @smatvienko-tb

Major UI

• Angular 20 migration by @ikulikov in #14935

Core & Rule Engine

• Added Cassandra result set byte-size limit by @ViacheslavKlimov in #15058
• Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov in #15078
• Fixed blocking JPA queries on access-validator single thread by @dskarzh in #15101
• Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh in #15100
• Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov in #15120
• Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb in #15102
• Made max WS message size configurable by @DmytroKhylko in #15116

UI

• Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina in #15130
• Fixed Redirect Url encoding by @mtsymbarov-del in #14985
• Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del in #14978
• Fixed adaptive in mail server configuration by @vvlladd28 in #15018
• Fixed a race condition causing the toast component by @mtsymbarov-del in #15071
• Fixed a race condition when init image map by @mtsymbarov-del in #15097
• Removed pattern validation from name field on CF by @mtsymbarov-del in #15142

Transport

• Fixed Sparkplug BIRTH message validation for metrics with empty string values by @nickAS21 in #14760

Edge

• Event-sourced propagation for admin settings by @volodymyr-babak in #15050

Full Changelog: v4.2.1.2...v4.2.2

ThingsBoard 4.3.0.1 Release

What's Changed

Security

• Fixed CVE-2025-69420 and CVE-2025-69419 for Docker images by @ViacheslavKlimov and @smatvienko-tb
• Fixed CVE-2026-22610 by @vvlladd28 in #14865

Core & Rule Engine

• Fixed propagation path updates handling for propagation CF by @ShvaykaD in #14853
• Fixed unnecessary database updates for disabled users during failed login by @AndriiLandiak in #14751

UI

• Updated locales el_GR, es_ES, hi_IN, nl_NL, no_NO by @vvlladd28 in #14920
• Fixed form settings in Send RPC and Segmented Button widgets by @mtsymbarov-del in #14863
• Fixed help link for API key by @vvlladd28 in #14864
• Removed required from "Current Customer" field in entity alias by @mtsymbarov-del in #14816
• Fixed missing '%' character in alias help text by @mtsymbarov-del in #14903
• Fixed default settings in API Usage widget by @mtsymbarov-del in #14909
• Fixed padding in Range Chart and Bar Chart with label widgets when overlay enabled by @mtsymbarov-del in #14895
• Fixed errors when public user views alarm comments by @mtsymbarov-del in #14922
• Fixed errors in alarm rules by @ArtemDzhereleiko in #14941
• Fixed race condition during Power Button widget initialization by @mtsymbarov-del in #14925

Full Changelog: v4.3...v4.3.0.1

ThingsBoard 4.2.1.2 Release

What's Changed

Security

• Fixed CVE-2025-68973, CVE-2025-6020, CVE-2025-13601, CVE-2025-69420, CVE-2026-21945, CVE-2025-69419 and CVE-2026-21932 for Docker images by @ViacheslavKlimov and @smatvienko-tb
• Fixed CVE-2026-22610 by @vvlladd28 in #14865
• Fixed CVE-2025-15284 by @vvlladd28 in #14729

Core & Rule Engine

• Added Redis ACL (username) authentication support by @AndriiLandiak in #14743
• Fixed invalid finish ts for jobs with zero tasks in task manager by @ViacheslavKlimov in #14728
• Fixed entity data query for sysadmin by @dashevchenko in #14564
• Fixed partition cleanup for non-public PostgreSQL schemas by @AndriiLandiak in #14631
• Fixed SMS usage state when disabled in tenant profile by @dashevchenko in #14792
• Fixed unnecessary database updates for disabled users during failed login by @AndriiLandiak in #14751

Transport

• Fixed NPE for LwM2M client context after reboot by @nickAS21 in #14645
• Fixed CoAP Unicast/Multicast MID Conflict and Silent ACK Rejection by @nickAS21 in #14748

UI

• Fixed LwM2M bootstrap toggle not persisting "Add Bootstrap config" button state by @mtsymbarov-del in #14614
• Fixed map action panel hide when switching to another data layer by @vvlladd28 in #14746
• Fixed opening tenant profile autocomplete when "Create new" button is clicked by @mtsymbarov-del in #14804
• Fixed country autocomplete autofill and improved validation by @vvlladd28 in #14802
• Fixed missing '%' character in alias help text by @mtsymbarov-del in #14903
• Fixed padding in Range Chart and Bar Chart with label widgets when overlay enabled by @mtsymbarov-del in #14895
• Fixed errors when public user views alarm comments by @mtsymbarov-del in #14922

Full Changelog: v4.2.1.1...v4.2.1.2