Download page What's new highlights

• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-81841

Download page What's new highlights

• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-81841

• Migration to Java 25 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/14976
• Remote agents by @MazurenkoNick
• Integration executor: push directly to rule engine by @AndriiLandiak

• Front-end sidebar/toolbar redesign by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15888

• Fixed CVE-2026-17495, CVE-2026-84375, CVE-2026-85061, CVE-2026-87776, CVE-2026-90711 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/16200
• Fixed CVE-2026-63126, CVE-2026-68497, CVE-2026-75516, CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877, CVE-2026-90560, CVE-2026-90852 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16195
• Fixed CVE-2026-59969, CVE-2026-84439, CVE-2026-84939, CVE-2026-89425, CVE-2026-91777, CVE-2026-93488, CVE-2026-93491, CVE-2026-93560, CVE-2026-100655, CVE-2026-100656, CVE-2026-100657 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16207

• OR conditions support for dashboard filters by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15286
• WebSocket API key authentication by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15170
• Added dedicated alarm rules API by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15326
• Added request body template support for REST API call node by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/15127
• Added Kafka OAUTHBEARER (OAuth2) support by @jkitn in https://github.com/thingsboard/thingsboard/pull/15098
• Resharing of dashboard groups by @dashevchenko
• Added more default integration decoders by @dashevchenko
• Dynamic Y-axis configuration in Reporting by @mtsymbarov-del
• Made Reporting available on customer level by @dashevchenko
• Added support for public report download links by @dashevchenko
• Batched async RPC persistence with idempotent create and striped rule-engine notifications by @ShvaykaD
• Added feature to enable/disable Web UI microservice HTTP response compression by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15836

• Rule chain notes by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15121
• Hid the 'Events' tab for unsupported entities by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15087
• Standardized description field formatting by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15156
• Added custom translate support for gauge and label widgets by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15236
• Updated Korean locale translations by @wbg1991 in https://github.com/thingsboard/thingsboard/pull/15242
• Moved inputs to outlined styles by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15265
• Added OpenFreeMap provider and vector tiles support for map widgets by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15337
• Added support for Angular control flow syntax in markdown by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15384
• String limit for 300> characters on attribute entity table by @jrkubic in https://github.com/thingsboard/thingsboard/pull/14910
• Added hint for Unread notifications widget in widget selector by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15681
• Chart widgets: zoom interaction now syncs the active time window by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15624
• Migrated help/doc links to new documentation structure by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15832
• Extended allowed entities with Role and Group permissions for entity type filter node by @mtsymbarov-del
• Normalized "Add role" and "View role" capitalization on Roles page by @mtsymbarov-del
• Renamed Scheduler event creation dialog title to "Add scheduler event" by @mtsymbarov-del
• Added "Allow downlink" toggle for ChirpStack integration application server config by @mtsymbarov-del
• Fixed inconsistent Attributes area visibility in scheduler Update Attributes event by @mtsymbarov-del
• Improvements for test decoder function by @dashevchenko
• Renamed legacy report Type label to "Web report" to avoid Reporting 2.0 entity confusion by @mtsymbarov-del
• Renamed "Queues" section to "Queue" in RabbitMQ integration by @mtsymbarov-del
• Added decimals support for missing Scada symbols by @mtsymbarov-del
• Improved "generate report" rule node settings form with toggles and setting hints by @mtsymbarov-del
• Updated "Initial value" control and RPC control widgets settings UI to new form panel design by @mtsymbarov-del
• Added a widget action to save browser location and mobile app actions to save phone location and track live GPS by @deaflynx
• Extended version control entity picker to support JS Modules by @mtsymbarov-del
• Changed 'Add new widget' action in widget bundles to standard primary button by @mtsymbarov-del
• Added help popup and widened dialog for Advanced CSS in White Labeling by @mtsymbarov-del
• Added new linter for CSS validation to support new CSS features by @mtsymbarov-del
• Widget actions export/import by @rusikv
• Made dashboard select dropdown sort by title by @harvspeedplumb-cell in https://github.com/thingsboard/thingsboard/pull/16036

• No activity reporting on device disconnect event by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15305
• Support for Execute operation with arguments (OMA LwM2M v1.0.2) by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/14881
• Unified attribute request — fetch-all per scope + scope-separated gateway response by @ShvaykaD
• Added v2 short MQTT topic for device claiming by @ShvaykaD

• Fixed query parameter encoding in REST API call rule node by @dskarzh in https://github.com/thingsboard/thingsboard/pull/14540
• Fixed cache cleanup on tenant/entity deletion by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15280
• Fixed Nashorn Global PropertyMap leak on JS script release by @MazurenkoNick in https://github.com/thingsboard/thingsboard/pull/15964
• Fixed RabbitMQ integration ignoring the downlink converter by @vvlladd28
• Fixed failed integrations not being destroyed and MQTT client leaking sessions by @volodymyr-babak

• Allowed the "Hide dashboard toolbar" option for public dashboards by @pgrisu in https://github.com/thingsboard/thingsboard/pull/14945
• Fixed state change of "Select all" checkbox in attributes table by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14973
• Fixed stateController resolution for the "Home page widgets" bundle type by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15409
• Fixed missing error notification on 429 response status by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15679
• Fixed device/asset profile import when default rule chain no longer exists by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15718
• Fixed JavaScript modules with special characters being corrupted on upload by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15498
• Fixed overlapping columns in IoT Hub markdown tables by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16138
• Fixed installed items count not refreshing after an install, update or delete by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16139
• Added CARTO as a separate map provider with an optional API key by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/16189
• Fixed Asset and Entity Views table header alignment by @mtsymbarov-del
• Fixed ChirpStack integration form validity not propagating to parent form by @mtsymbarov-del
• Fixed numeric/boolean filter predicates failing to save due to invalid "ignoreCase" field by @mtsymbarov-del
• Fixed mail template footer vertical gap and width misalignment by @mtsymbarov-del
• Hid AI dashboard generation actions when the AI feature is disabled by @mtsymbarov-del
• Fixed layout bugs and improved mobile layout for "Add device profile" modal by @mtsymbarov-del
• Fixed secret password not clearing on Mail server settings save by @mtsymbarov-del
• Fixed end of day shown as noon in alarm schedule summary by @mtsymbarov-del
• Fixed validation errors overlapping form fields in MQTT and AWS IoT advanced settings by @mtsymbarov-del

• Fixed negative values encoding for LwM2M Integer resources by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/15962
• Fixed handling of LwM2M unsigned integer resources across downlink and uplink operations by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/16095
• Fixed LwM2M device profile import failing when bootstrap short server id is non-zero by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/16133
• Fixed gateway persistent RPC not being marked DELIVERED on PUBACK by @ShvaykaD

• Fixed edge activity state being cleared when the session moves to another node by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/16156

• @wbg1991 made their first contribution in https://github.com/thingsboard/thingsboard/pull/15242
• @jrkubic made their first contribution in https://github.com/thingsboard/thingsboard/pull/14910
• @jkitn made their first contribution in https://github.com/thingsboard/thingsboard/pull/15098
• @bruak made their first contribution in https://github.com/thingsboard/thingsboard/pull/15759
• @harvspeedplumb-cell made their first contribution in https://github.com/thingsboard/thingsboard/pull/16036

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.3.1.5...v4.4

Download page What's new highlights

• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-81841
• Security: Fix CVE-2026-81842

Download page What's new highlights

• Security: Fix CVE-2026-13719
• Security: Fix CVE-2026-13720
• Security: Fix CVE-2026-81841
• Security: Fix CVE-2026-81842

• Unified Storage: Return 403 instead of 500 on namespace mismatch #133595, @pstibrany

• filer: clean up manifest resolve error propagation and add webdav tes… by @giftz in https://github.com/seaweedfs/seaweedfs/pull/11297
• rust-volume: fix Windows build of find_needle_from_ecx by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11298
• test/ec: pin rack in seedAndSpread volume.grow to stop silent no-ops by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11299
• admin: bind worker gRPC listener to -ip instead of wildcard by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11300
• build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11311
• build(deps): bump golang.org/x/image from 0.45.0 to 0.46.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11304
• build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.20.1 to 1.20.4 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11305
• rust: clippy-clean both crates and adopt the std APIs the 1.91 MSRV allows by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11312
• shell: warn when fs.mergeVolumes source holds only orphan needles by @lucndm in https://github.com/seaweedfs/seaweedfs/pull/11310
• s3api: configurable trusted-proxy allowlist for aws:SourceIp (#11302) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11315
• build(deps): bump github.com/go-sql-driver/mysql from 1.10.0 to 1.10.1 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11308
• admin: default to 0.0.0.0 for authenticated HTTP, keep worker gRPC on loopback by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11314
• build(deps): bump google.golang.org/api from 0.296.0 to 0.297.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11307
• s3: populate Initiated timestamp in ListMultipartUploads by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11313
• helm: grant List to the generated read-only S3 identity by @rchenzheng in https://github.com/seaweedfs/seaweedfs/pull/11318
• build(deps): bump github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11306
• s3: preserve versions for POST policy uploads by @davidchrisr in https://github.com/seaweedfs/seaweedfs/pull/11316
• Cloud/remote storage & tiering: configurable multipart upload/download concurrency by @jackusm in https://github.com/seaweedfs/seaweedfs/pull/11319
• rust: tonic 0.14 / prost 0.14, drop the result_large_err allow by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11327
• rust-volume: fold the 8–15-argument functions into parameter structs by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11328
• rust: cargo fmt both crates, with a commented-out fmt --check CI step by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11329
• s3: drain request body before error response by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11334
• s3: cover object lock retention on version deletes by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11335
• helm: roll master pods when master config changes by @banjoh in https://github.com/seaweedfs/seaweedfs/pull/11331
• rust volume: stream the tail scan and release the store lock by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11275
• s3: a list marker that sorts before the prefix excludes nothing by @robfischer1 in https://github.com/seaweedfs/seaweedfs/pull/11322
• shell: fs.verify -pruneEntries deletes entries whose needles are lost by @lucndm in https://github.com/seaweedfs/seaweedfs/pull/11338
• rust volume: parse vid/fid paths once; the proxy redirect drops the extension like Go by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11341
• ci: run seaweed-volume unit tests on Windows by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11349
• fix(volume): reject negative Size, recover poisoned store lock by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11345
• fix(ec): validate ShardId at gRPC boundary, reject >=32 by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11346
• filer: preserve accepted metadata log records on shutdown by @davidchrisr in https://github.com/seaweedfs/seaweedfs/pull/11359
• server: add filer-specific disableHttp flag by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11360
• s3: separate Object Lock configuration permission by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11361
• fix(ec): encode drops tombstoned needles, last-wins replay by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11347
• filer: join shutdown paths before closing metadata store by @davidchrisr in https://github.com/seaweedfs/seaweedfs/pull/11363
• fix(ec): BatchDelete cookie fail-closed via locate_data geometry by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11348
• admin: replace Font Awesome with MIT-licensed icons by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11364
• s3: enforce dedicated Object Lock actions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11362
• s3tables: hide inaccessible catalog resources by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11365
• rust volume: one positional read helper; never seek a dup'd handle on Windows by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11342
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace from 1.44.0 to 1.45.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11372
• security: require go 1.26.6 and bump vulnerable deps by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11374
• build(deps): bump go.opentelemetry.io/otel/exporters/zipkin from 1.36.0 to 1.45.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11373
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11371
• s3api: don't delete chunks when CreateEntry outcome is ambiguous by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11376
• ci: make telemetry deploy work on Oracle Linux 7 by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11377
• mount/shell: bucket allow-empty-folders toggle, mount keeps explicit false by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11370
• s3: commit multipart upload and remove .uploads atomically; purge completed uploads metadata-only by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11375
• s3: tighten STS session token handling by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11383
• s3api: unify auth error handling across s3tables, iceberg and lance by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11381
• s3: abort completed multipart uploads metadata-only by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11385
• s3: drop implicit reader cache budget that throttled S3 GETs by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11384
• s3api: delete orphaned chunks only when the entry is confirmed absent by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11389
• volume: validate copy/tail source addresses before dialing by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11390
• fix(volume): return an error instead of panicking on a corrupt needle size by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/11393
• s3api: add Snowflake s3compat API integration tests by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11394
• fix(volume): derive needle body tail bound from the version layout by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11395
• [Volume] Scrub local deletion tombstones during FULL scrub by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11396
• fix(volume): return an error instead of 201 when a write lands on no volume by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/11397
• fix(volume): validate sizes in ReadNeedleBlob and WriteNeedleBlob by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/11399
• fix(volume): stop ScanVolumeFileFrom at a header it cannot advance past by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/11398
• s3: multipart upload checksum inheritance and validation by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11403
• helm: let admin.allowInsecureBind satisfy the admin auth render guard by @nevivurn in https://github.com/seaweedfs/seaweedfs/pull/11404
• rust volume: document every unsafe block and stop mutating the process env in tests by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11352
• rust volume: derive has_remote_file instead of mirroring it by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11353
• rust volume: typed errors for store compaction so gRPC can answer NotFound by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11355
• rust volume: keep the EC shard-location map, its refresh time and stale mark under one lock by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11356
• rust volume: one S3 tier registry instead of two kept in sync by hand by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11357
• rust: a seaweed-common crate for the address and TLS helpers both crates carry by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11358
• rust volume: share the I/O-error tracker between Volume and EcVolume by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11351
• rust volume: build outgoing gRPC clients in one place and give every dial a connect timeout by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11354
• volume server: HTTP DELETE on a distributed EC volume by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11405
• volume server: ReceiveFile loses bytes and hides fsync failures by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11407
• volume: load the .ecj deletion journal in chunks, and repair a torn tail by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11408
• volume: fix 5-byte index offset corruption in makeupDiff by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11411
• build(deps): bump cloud.google.com/go/kms from 1.33.0 to 1.34.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11418
• build(deps): bump github.com/tarantool/go-tarantool/v3 from 3.0.1 to 3.0.2 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11417
• build(deps): bump go.uber.org/atomic from 1.11.0 to 1.12.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11416
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts from 1.50.0 to 1.51.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11420
• build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11419
• build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11421
• build(deps): bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11422
• build(deps): bump github/codeql-action from 4.38.0 to 4.38.1 by @dependabot[bot] in https://github.com/seaweedfs/seaweedfs/pull/11423
• rust volume: regression test for makeup_diff replay across a 32 GiB offset boundary (#11410) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11427
• [Volume] Keep DAT and index state consistent after async batch Sync failure by @ssshr-66 in https://github.com/seaweedfs/seaweedfs/pull/11425
• lance: authenticate the catalog with Bearer tokens and x-api-key by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11431
• volume: walk_index_file keeps row alignment across short reads by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11412
• volume server: the write queue answers uploads with the needle's real ETag by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11414
• volume: an EC volume needs an .ecx to mount, and a 0-byte stub never outranks a real index by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11415
• volume server: sweep stale EC artifacts before VolumeEcShardsGenerate re-encodes by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11413
• ecbalancer: let a non-overflow parity shard leave a data-bearing rack by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11438
• topology: wake the vacuum dispatcher when a worker frees quota by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11436
• filer: resolve the collection a bucket delete drops by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11439
• test(s3tables): add an OLake Iceberg catalog integration test by @pingqiu in https://github.com/seaweedfs/seaweedfs/pull/11441
• filer.remote.sync: stamp entries with IF_CHUNKS_EQUAL so a stale write-back cannot delete live chunks by @jsas in https://github.com/seaweedfs/seaweedfs/pull/11435
• volume server: validate ext and collection in gRPC CopyFile/ReceiveFile (Rust) by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11451
• shell: refuse s3.bucket.create on an existing bucket by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11455
• volume server: VolumeMarkReadonly answers NotFound when the volume vanished under the lock by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11443
• filer: keep lazy remote reads from resurrecting deleted paths by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11452
• master,filer: fix lock ring poisoning after leader change by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11453
• s3api: exclude marker part in listObjectParts pagination by @Tyagiquamar in https://github.com/seaweedfs/seaweedfs/pull/11463
• volume: detect S3 not-found by typed SDK errors, not the "service error" string by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11444
• docs: restore the HTTP REST API reference by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11454
• volume: reject invalid -minFreeSpace and duration flags at startup like Go by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11447
• volume server: VolumeEcShardsDelete full teardown unloads every disk and keeps the shard gauge honest by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11446
• volume: one long-lived tokio runtime for blocking tiered S3 reads by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11448
• s3: honor assignment fsync in UploadWithRetry by @ilidemi in https://github.com/seaweedfs/seaweedfs/pull/11449
• shell: let volume.deleteEmpty drop volumes with no live needles by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11437
• volume server: do not finish a GET when the needle CRC mismatches by @Yi-111-a in https://github.com/seaweedfs/seaweedfs/pull/11464
• util: serialize all ViperProxy access so startup cannot hit concurrent map read/write by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11470
• volume: make volume.scrub report a live needle whose stored id is damaged by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11468
• volume: never finish serving a needle whose data fails its CRC by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11467
• s3: evaluate bucket policy before ACL public-read for anonymous requests by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11471
• volume: skip TTL last-write scan when it cannot fit its budget by @Tyagiquamar in https://github.com/seaweedfs/seaweedfs/pull/11472
• filer: honor is_moved only from ring member connections by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11456
• s3: keep dedicated object-lock actions pinned during action resolution by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11475
• s3: honor configured session bounds on AssumeRole and LDAP identity by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11478
• s3: record requester identity before the authz verdict by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11479
• vacuum: let the sweep release volumes that stay empty and quiet by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11477
• volume server: collect heartbeats under the store read lock, off the runtime by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11480
• volume server: stream ReadAllNeedles without holding the store lock by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11481
• volume server: run the vacuum compaction copy without the store lock by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11482
• volume: typed tier errors so a missing remote object answers NotFound by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11484
• fix(volume-rust): reserve a disk before replacing a replica in VolumeCopy, and check record counts by @hsdfat in https://github.com/seaweedfs/seaweedfs/pull/11483
• volume server: split volume_copy into phases and type the delete-after-status gate by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11485
• volume server: read GET/HEAD needles off the store lock, and only once by @franchb in https://github.com/seaweedfs/seaweedfs/pull/11487
• s3: require dedicated object-lock permissions for x-amz-object-lock-* headers by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11492
• s3: ignore empty intermediate directories in bucketHasUserObjects (#11490) by @Yi-111-a in https://github.com/seaweedfs/seaweedfs/pull/11491
• s3: keep a listing's start position inside the requested prefix by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11493
• s3: do not promote ?prefix into the object for non-List actions by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11494
• filer: demote client-cancelled directory listing log from error (#11495) by @Yi-111-a in https://github.com/seaweedfs/seaweedfs/pull/11496
• master: make volume capacity reservation timeout configurable (#11426) by @Yi-111-a in https://github.com/seaweedfs/seaweedfs/pull/11497
• volume: reclaim staged EC shard generations left by the 2PC switch by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11501
• filer: keep shared chunk buffers pinned while another stream reads them by @wzrdtales in https://github.com/seaweedfs/seaweedfs/pull/11502
• filer: pin-aware reader cache eviction and stream release by @chrislusf in https://github.com/seaweedfs/seaweedfs/pull/11503

• @davidchrisr made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11316
• @jackusm made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11319
• @banjoh made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11331
• @robfischer1 made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11322
• @nevivurn made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11404
• @jsas made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11435
• @ilidemi made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11449
• @Yi-111-a made their first contribution in https://github.com/seaweedfs/seaweedfs/pull/11464

Full Changelog: https://github.com/seaweedfs/seaweedfs/compare/4.47...4.48

• Fixed CVE-2026-17495, CVE-2026-84375, CVE-2026-85061, CVE-2026-87776, CVE-2026-90711 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/16200
• Fixed CVE-2026-63126, CVE-2026-68497, CVE-2026-75516, CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877, CVE-2026-90560, CVE-2026-90852 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16195

• Fixed Nashorn Global PropertyMap leak on JS script release by @MazurenkoNick in https://github.com/thingsboard/thingsboard/pull/15964

• Keep IoT Hub markdown table columns from overlapping by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16138
• Refresh the installed items count after an install, update or delete by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16139
• Added CARTO as a separate map provider with an optional API key by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/16189

• Fixed LwM2M device profile import failing when bootstrap short server id is non-zero by @nickAS21 in https://github.com/thingsboard/thingsboard/pull/16133

• Do not clear edge activity state when session moved to another node by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/16156

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.3.1.5...v4.3.1.6

• Fixed CVE-2026-17495, CVE-2026-84375, CVE-2026-85061, CVE-2026-87776, CVE-2026-90711 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/16200
• Fixed CVE-2026-63126, CVE-2026-68497, CVE-2026-75516, CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877, CVE-2026-90560, CVE-2026-90852 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/16195

• Fixed Nashorn Global PropertyMap leak on JS script release by @MazurenkoNick in https://github.com/thingsboard/thingsboard/pull/15964

• Keep IoT Hub markdown table columns from overlapping by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16138
• Refresh the installed items count after an install, update or delete by @pinkevmladchy in https://github.com/thingsboard/thingsboard/pull/16139
• Added CARTO as a separate map provider with an optional API key by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/16189

• Do not clear edge activity state when session moved to another node by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/16156

Full Changelog: https://github.com/thingsboard/thingsboard/compare/v4.2.2.5...v4.2.2.6