ThingsBoard Files

What's Changed

Security

• Fixed CVE-2026-24734 and CVE-2025-66614 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15076
• Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15079
• Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15109
• Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15123
• Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15124
• Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15128
• Fixed CVE-2026-2781, CVE-2026-25646, CVE-2026-21945 and CVE-2026-21932 for Docker images by @ViacheslavKlimov and @smatvienko-tb

Major UI

• Angular 20 migration by @ikulikov in https://github.com/thingsboard/thingsboard/pull/14944

Core & Rule Engine

• Fixed getTimeseries API (/{entityType}/{entityId}/values/timeseries) by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15054
• Added Cassandra result set byte-size limit by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15058
• Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15078
• Fixed blocking JPA queries on access-validator single thread by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15101
• Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15100
• Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15120
• Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15102
• Made max WS message size configurable by @DmytroKhylko in https://github.com/thingsboard/thingsboard/pull/15116

UI

• Fixed Redirect Url encoding by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14985
• Fixed loading and placement of Material icons by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14959
• Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14978
• Fixed adaptive in mail server configuration by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15018
• Fixed Range and Bar chart limits setup by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14964
• Fixed RGBA and HSLA inputs in color picker by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15031
• Fixed Entity key autocomplete change check by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15080
• Fixed a race condition causing the toast component by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15071
• Fixed a race condition when init image map by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15097
• Fixed default timewindow config in widget editor page by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15108
• Removed pattern validation from name field on CF by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15142
• Updated Ukrainian locale by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15096
• Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina in https://github.com/thingsboard/thingsboard/pull/15130

Transport

• Fixed Sparkplug BIRTH message validation for metrics with empty string values by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/14760

Edge

• Event-sourced propagation for admin settings by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15050

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.3.0.1...v4.3.1