Release Notes

Added

• Publish Snapcraft snaps tti-lw-stack and tti-lw-cli

Changed

• Optimized storage of recent application uplinks in Application Server.

Fixed

• Validation of OAuth token exchange requests from the CLI.
• Validation of join-request types when using the Crypto Server backend.
• Application Server session recovery functionality for imported devices.
• Fetching AppSKey when the session is rebuilt but the identifier did not change.
• Brew artifacts are now in a publicly accessible location.

Added

• Contextual tooltips to form fields in the Console.
• C-Style uint32_t representation for end device address field.
• Gateway Configuration Server to the cluster package.
  • This introduces a new config option cluster.gateway-configuration-server that needs to be set in multi-instance deployments.
• Uplink storage for integrations in the Application Server. The number of uplinks stored per end device may be configured via the config option as.uplink-storage.limit.
• LoRaCloud GLS multi frame request support.
• LoRaCloud GNSS request support.
• LoRaCloud WiFi request support.

Changed

• Allow the LinkADRReq commands to lower the data rate used by the end devices.

Fixed

• Occasional crashes in the ratelimit middleware.
• Handling of zero EUI CUPS update-info requests.
• Backend validation messages for some forms.
• Gateway downlink message previews not displaying correctly in the event view of the Console.
• Importing end devices from the Console would occasionally ignore some device MAC settings fields.

Security

Added

• Payload formatter testing functionality in the Console.
• Options in the Identity Server to reject passwords that contain the user ID (is.user-registration.password-requirements.reject-user-id) or common passwords (is.user-registration.password-requirements.reject-common).

Changed

• Network Server now takes uplink data rate index for ADR.
• Event streams are now closed when the callers rights are revoked.

Fixed

• It is no longer possible to accidentally create API keys without any rights.
• Application overview page crashing for collaborators without certain rights.
• A bug that crashed the Identity Server when calling certain Tenant RPCs.
• mac_settings.factory_preset_frequencies handling in US-like bands.

Security

• This release fixes an issue that prevented some request messages from being validated correctly, allowing invalid values in certain fields.

Added

• API and CLI commands for listing, searching for and restoring recently deleted applications, OAuth clients, gateways, organizations and users.
• State Description fields for adding context to the (rejected, flagged, suspended) state of Users, OAuth clients and tenants.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added columns.
• Configure retention policy for the Storage Integration database (only supported when using TimescaleDB).
  • You will need to run the ttn-lw-stack storage-db migrate command to apply the new configuration. See the --timescaledb.chunk-time-interval, --timescaledb.enable-retention-policy and --timescaledb.retention-days command-line flags.
• Searching for gateways by EUI.
• Searching for users and OAuth clients by state.
• Gateway Server forwards Tx Acknowlegdment packets to the Network Server for scheduled downlinks. These can be used by the Network Server to forward downlink_ack upstream messages to the Application Server.
• UDP connection error caching. The duration can be configured via the gs.udp.connection-error-expires configuration entry.
• Option to require individual gateways to use authenticated connections.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added columns.
• Login Tokens (magic login links) that can be used for password-less login.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added columns.
  • This feature is disabled by default; use the new is.login-tokens.enabled option to enable it.
• Packet Broker registration, configuration of routing policies, listing home networks and viewing routing policies set by forwarding networks. See ttn-lw-cli packetbroker --help for more information.
• Support LoRa 2.4 GHz with Packet Broker.
• Include gateway identifiers from Packet Broker in metadata.
• Support for claiming gateways through CLI. See ttn-lw-cli gateways claim --help for more information.
• Session and MAC state import functionality. This means that devices can be migrated without rejoin.
• Rate limiting for HTTP endpoints, gRPC endpoints, MQTT, UDP and WebSockets connections.
  • Rate limiting is disabled by default. Refer to the rate-limiting configuration entry to enable.
• Profile settings link to header dropdown menu.

Changed

• Changed the pub/sub channels that the Redis backend of the Events system uses.
• Changed the encoding of events transported by the Redis backend of the Events system.
• All external HTTP calls are now using TLS client configuration. This fixes issues where HTTP calls would fail if custom (e.g. self-signed) CAs were used.
• All external HTTP calls are now using a default timeout. This fixes issues where HTTP calls would stall for a long time.
• All value wrappers now are encoded and decoded as the value being wrapped in JSON. That means, that, e.g. format of mac_settings.rx1_delay is changed from {"value": 2} to just 2.
• Changed the error that is returned when attempting to validate already validated contact info.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added column.
• Update Go to 1.16
• Network Server now performs more strict validation and will disallow creation and updates of invalid devices.
• DevEUI is not required for multicast devices anymore, regarding of LoRaWAN version.
• Pub/Sub provider visibility in console based on disabled status.

Removed

• AWS IoT Integration as pub/sub integration. The integration is only available as application package.
  • This requires a database migration (ttn-lw-stack as-db migrate).

Fixed

• Incorrect documentation url for event details data formats.
• Search functionality for applications, gateways and organizations in the Console.
• Error handling of end device template formats for the application overview page in the Console.
• Payload size limits for AU915 data rates 8 and 9, which are now consistent with Regional Parameters RP002-1.0.2.
• Payload size limit calculation in Network Server.
• Occasional panic in Network Server on downlink with corrupted device states.
• Occasional panic in Identity Server on extracting log fields from invalid requests.
• Print an error message stating that the Storage Integration is not available in the open source edition of The Things Stack when trying to execute ttn-lw-stack storage-db commands.
• Applications without AWS IoT integration displaying configuration of a previously inspected application.

Added

• sentry.environment configuration option to set the environment tag on Sentry reports.
• TR005 QR code format, with ID tr005.
• LoRa Cloud Geolocation Services support for TOA/RSSI end device geolocation.

Changed

• Device Claiming Server can now contact Join Servers outside of the cluster: the source end device’s registered Join Server address is dialed.
• Default value of gs.udp.addr-change-block is now 0, which disables the IP firewall for UDP traffic. Deployments that need to enforce the IP check should set a value greater than 0. Note that the new default value makes UDP connections less secure.
• Prevent flooding logs with “Packet Filtered” messages when UDP gateways exceed the maximum rate limit. Only one message per minute will be printed for each gateway.

Deprecated

• TR005 Draft 2 and 3 QR code formats. Use the final version of the technical recommendation, with ID tr005.

Removed

Fixed

• Downlink queue operations on ABP devices not working under specific circumstances.
• NwkKey handling for end devices in the Console.

Security

Added

• Pagination flags for the users oauth authorizations list and users oauth access-tokens list CLI commands.
• End device ID generation based on DevEUI in The LoRaWAN Device Repository creation form in the Console.
• remote_ip and user_agent metadata on OAuth events.
• created_at and updated_at fields to API Keys.
• Telemetry for Packet Broker Agent.
• User rights check for managing API keys in the Console.

Changed

• When multiple base domains are configured, the middleware uses the longest match to extract the Tenant ID.
• temp field of the UDP stats message is now type float32 (pointer).

Deprecated

Removed

Fixed

• Ocassional race condition in uplink matching with replicated Network Server instances.
• Ocassional race condition when matching pending sessions.
• Application uplink queue handling in Network Server.
• Conflict error when registering an end device via the wizard in the Console.
• Pagination in the List and ListTokens RPCs of the OAuthAuthorizationRegistry.
• Event name on user login.
• Application uplink queue handling in Network Server.
• Application Server session desynchronization with the Network Server. The Application Server will now attempt to synchronize the end device session view on downlink queue operational errors. This fixes the f_cnt_too_low and unknown_session errors reported on downlink queue push and replace.
• Panic while generating SX1301 config for frequency plans without radio configuration.

Security

Added

• Profile settings view to the Account App.
  • Functionality to change basic profile information, such as name, email address and profile picture.
  • Functionality to update the account password.
  • Functionality to delete the account.

Changed

• Improved logging.
• AWS IoT integration is now implemented as package instead of a pub/sub provider.

Deprecated

• Configuration of the AWS IoT Core integration as pub/sub provider. Please use the configuration with the package name aws-iot and update to the latest version of the AWS IoT Integration CloudFormation template. The configuration via pub/sub provider will be removed in later version.
  • To migrate existing pub/sub integrations to packages, migrate the Application Server database (ttn-lw-stack as-db migrate).
• AWS IoT Core publisher of all upstream messages that is configured with as.aws.iot.telemetry.
  • This only affects The Things Stack AWS Launcher customers that use the AWS Marketplace AMI listing.
  • All deployments are now advised to use the AWS IoT Core package that can be configured per application in Application Server.

Removed

Fixed

• Synchronization in Gateway Server scheduler that caused race conditions in scheduling downlink traffic.
• End device claiming when the source device uses derived root keys.
• Console link in Account App for multi-tenant deployments.

Security

Added

Changed

Deprecated

Removed

Fixed

• Packet Broker multi-tenancy with a single tenant The Things Stack configuration.

Security

Added

Changed

Deprecated

Removed

Fixed

• The inability to see individual end devices in the Console due to field mask errors.

Security

Added

• Pub/Sub providers may now be disabled, or marked for deprecation via --as.pubsub.providers.
• Configuration option is.admin-rights.all to grant admins all rights, including _KEYS and _ALL.
• ttn-lw-stack CLI command for creating an API Key with full rights on a user.
• Storage integration panel in the Console.

Changed

• Branding (updated TTS Enterprise logo, colors, etc).
• Packet Broker API version to v3.2.0-tts and routing API to v1.0.2-tts.

Deprecated

• Packet Broker mutual TLS authentication: use OAuth 2.0 client credentials instead; set pba.authentication-mode to oauth2 and configure pba.oauth2.
• Packet Broker forwarder blacklist setting pba.home-network.blacklist-forwarder has become ineffective.

Removed

Fixed

Security

Added

• Support for sending end device uplinks using the CLI (see ttn-lw-cli simulate application-uplink command).
• Clients can now perform custom ADR by modifying ADR parameters in mac-state.desired-parameters of the device.

Changed

• Form field layouts in the Console (field labels are now dispayed above the field).
• Small structural changes to the custom webhook form in the Console.
• Renamed experimental command ttn-lw-cli simulate uplink to ttn-lw-cli simulate gateway-uplink.
• Renamed experimental command ttn-lw-cli simulate join-request to ttn-lw-cli simulate gateway-join-request.

Fixed

• Removed misleading warning message for missing package data when setting up the storage integration package association.

Added

• Configure application activation settings from the CLI (see ttn-lw-cli application activation-settings commands).
• User API keys management to the Console.
• Purge RPC and cli command for entity purge (hard-delete) from the database.
• More password validation rules in the user management form in the Console.
• Support for class B end devices in the Console.
• MAC settings configuration when creating and editing end devices in the Console.
• Support for the LR1110 LTV stream protocol.

Changed

• Branding (updated TTS Open Source logo, colors, etc).

Fixed

• Simulated uplinks visibility in webhook messages.
• Retransmission handling.
• RTT recording for LBS gateways. The maximum round trip delay for RTT calculation is configurable via --gs.basic-station.max-valid-round-trip-delay.
• Memory leak in GS scheduler.

Added

• Configure application activation settings from the CLI (see ttn-lw-cli application activation-settings commands).
• CLI support for federated authentication provider deletion (ttn-lw-stack is-db delete-auth-provider).

Security

• Fixed an issue with authentication on the /debug/pprof, /healthz and /metrics endpoints.

Added

• gRPC middleware to extract proxy headers from trusted proxies. This adds a configuration grpc.trusted-proxies that is similar to the existing http.trusted-proxies option.

Changed

• Log field consistency for HTTP and gRPC request logs.

Fixed

• Uplink frame counter reset handling.
• Uplink retransmission handling in Network Server.
• DevAddr generation for NetID Type 3 and 4, according to errata.
• Packet Broker downlink in multi-tenant clusters.
• HTTP header propagation (such as Request ID) to gRPC services.

Added

• More password validation rules in the user management form in the Console.

Changed

• Limitation of displayed and stored events in the Console to 2000.
• Application Server will unwrap the AppSKey if it can, even if skipping payload crypto is enabled. This is to avoid upstream applications to receive wrapped keys they cannot unwrap. For end-to-end encryption, configure Join Servers with wrap keys unknown to the Application Server.
• More precise payload labels for event previews in the Console.

Fixed

• Next button title in the end device wizard in the Console.
• Navigation to the user edit page after creation in the Console.
• The port number of the http.redirect-to-host option was ignored when http.redirect-to-tls was used. This could lead to situations where the HTTPS server would always redirect to port 443, even if a different one was specified.
  • If the HTTPS server is available on https://thethings.example.com:8443, the following flags (or equivalent environment variables or configuration options) are required: --http.redirect-to-tls --http.redirect-to-host=thethings.example.com:8443.
• Status display on the error view in the Console.
• Event views in the Console freezing after receiving thousands of events.
• Wrong FPort value displayed for downlink attempt events in the Console.
• Network Server sending duplicate application downlink NACKs.
• Network Server now sends downlink NACK when it assumes confirmed downlink is lost.
• Network Server application uplink drainage.