ThingsBoard v4.2.2 LTS release notes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

.gitignore

@@ -7,3 +7,4 @@ CNAME
 .idea/**
 **/*.iml
 _config.yml
+/.claude/

_data/upgrade-instructions-data.yml

@@ -12,7 +12,14 @@
   release-date-edge: Jan 21 2026
   lts: "true"
   x: "true"
+4.2.2:
+  upgradable-from: "4.2.0"
+  release-date: Mar 09 2026
+  lts: "true"
+  patch: "true"
+  x: "true"
 4.2.1.2:
+  vulnerable: "true"
   upgradable-from: "4.2.0"
   release-date: Feb 3 2026
   release-date-edge: Feb 4, 2026

_includes/docs/pe/releases/releases-table/v4-2-2.md

@@ -0,0 +1,9 @@
+### ThingsBoard PE v4.2.2 (Mar 09, 2026)
+
+Everything from [CE v4.2.2](/docs/releases/releases-table/v4-2-x/#thingsboard-ce-v422-mar-09-2026){: target="_blank"} with the following fixes.
+
+* Security
+  * Fixed local files enumeration vulnerability
+
+* Edge
+  * Fixed construction of Edge in case add-on

_includes/docs/releases/releases-table/v4-2-2.md

@@ -0,0 +1,41 @@
+### ThingsBoard CE v4.2.2 (Mar 09, 2026)
+
+**What's Changed**
+
+* Security
+  * [#15076](https://github.com/thingsboard/thingsboard/pull/15076) Fixed CVE-2026-24734 and CVE-2025-66614 by @ViacheslavKlimov
+  * [#15079](https://github.com/thingsboard/thingsboard/pull/15079) Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28
+  * [#15109](https://github.com/thingsboard/thingsboard/pull/15109) Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28
+  * [#15123](https://github.com/thingsboard/thingsboard/pull/15123) Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov
+  * [#15124](https://github.com/thingsboard/thingsboard/pull/15124) Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov
+  * [#15128](https://github.com/thingsboard/thingsboard/pull/15128) Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28
+  * Fixed CVE-2026-2781 and CVE-2026-25646 for Docker images by @ViacheslavKlimov and @smatvienko-tb
+
+* Major UI
+  * [#14935](https://github.com/thingsboard/thingsboard/pull/14935) Angular 20 migration by @ikulikov
+
+* Core & Rule Engine
+  * [#15058](https://github.com/thingsboard/thingsboard/pull/15058) Added Cassandra result set byte-size limit by @ViacheslavKlimov
+  * [#15078](https://github.com/thingsboard/thingsboard/pull/15078) Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov
+  * [#15101](https://github.com/thingsboard/thingsboard/pull/15101) Fixed blocking JPA queries on access-validator single thread by @dskarzh
+  * [#15100](https://github.com/thingsboard/thingsboard/pull/15100) Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh
+  * [#15120](https://github.com/thingsboard/thingsboard/pull/15120) Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov
+  * [#15102](https://github.com/thingsboard/thingsboard/pull/15102) Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb
+  * [#15116](https://github.com/thingsboard/thingsboard/pull/15116) Made max WS message size configurable by @DmytroKhylko
+
+* UI
+  * [#15130](https://github.com/thingsboard/thingsboard/pull/15130) Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina
+  * [#14985](https://github.com/thingsboard/thingsboard/pull/14985) Fixed Redirect Url encoding by @mtsymbarov-del
+  * [#14978](https://github.com/thingsboard/thingsboard/pull/14978) Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del
+  * [#15018](https://github.com/thingsboard/thingsboard/pull/15018) Fixed adaptive in mail server configuration by @vvlladd28
+  * [#15071](https://github.com/thingsboard/thingsboard/pull/15071) Fixed a race condition causing the toast component by @mtsymbarov-del
+  * [#15097](https://github.com/thingsboard/thingsboard/pull/15097) Fixed a race condition when init image map by @mtsymbarov-del
+  * [#15142](https://github.com/thingsboard/thingsboard/pull/15142) Removed pattern validation from name field on CF by @mtsymbarov-del
+
+* Transport
+  * [#14760](https://github.com/thingsboard/thingsboard/pull/14760) Fixed Sparkplug BIRTH message validation for metrics with empty string values by @nickAS21
+
+* Edge
+  * [#15050](https://github.com/thingsboard/thingsboard/pull/15050) Event-sourced propagation for admin settings by @volodymyr-babak
+
+**Full Changelog**: [https://github.com/thingsboard/thingsboard/compare/v4.2.1.2...v4.2.2](https://github.com/thingsboard/thingsboard/compare/v4.2.1.2...v4.2.2)

docs/pe/releases/releases-table/v4-2-x.md

@@ -6,15 +6,16 @@ breadcrumbs: 'true'
 breadcrumbs-steps: '1'
 lts: 'true'
 release-date: Aug 15, 2025
-last-updated: Feb 3, 2026
+last-updated: Mar 09, 2026
 release-note-label: Reporting 2.0, Secrets Storage, AI Rule Node
 active-menu-item-click: 'true'
-latest-patch: v4.2.1.2 (Feb 3 2026)
+latest-patch: v4.2.2 (Mar 09 2026)
 effective-url: '/docs/pe/releases/releases-table/'
 ---
 * TOC
 {:toc}
 
+{% include docs/pe/releases/releases-table/v4-2-2.md %}
 {% include docs/pe/releases/releases-table/v4-2-1-2.md %}
 {% include docs/pe/releases/releases-table/v4-2-1.md %}
 {% include docs/pe/releases/releases-table/v4-2-0.md %}

docs/releases/releases-table/v4-2-x.md

@@ -6,15 +6,16 @@ breadcrumbs: 'true'
 breadcrumbs-steps: '1'
 lts: 'true'
 release-date: Aug 15, 2025
-last-updated: Feb 3, 2026
+last-updated: Mar 09, 2026
 release-note-label: AI Rule Node & Security Fixes
 active-menu-item-click: 'true'
-latest-patch: v4.2.1.2 (Feb 3 2026)
+latest-patch: v4.2.2 (Mar 09 2026)
 effective-url: '/docs/releases/releases-table/'
 ---
 * TOC
 {:toc}
 
+{% include docs/releases/releases-table/v4-2-2.md %}
 {% include docs/releases/releases-table/v4-2-1-2.md %}
 {% include docs/releases/releases-table/v4-2-1.md %}
 {% include docs/releases/releases-table/v4-2-0.md %}