Release Notes

Added

• Support claiming of The Things Indoor Gateways.
• Configurable log formats with the log.format configuration option.
  • The console format that prints logs as more human-friendly text. This is the new default.
  • The json format that prints logs as JSON. This is the recommended format for production deployments.
  • The old format (deprecated). This can be used if you need to adapt your log analysis tooling before v3.14.
• ttn_lw_gs_ns_uplink_latency_seconds, ttn_lw_ns_as_uplink_latency_seconds and ttn_lw_gtw_as_uplink_latency_seconds metrics to track latency of uplink processing.
• Signing of releases.
• Hard delete option to delete applications, gateways and organizations in the Console.

Changed

• Relaxed the cookie policy for cross-origin requests from Strict to Lax.
• Changed the cookie policy for OAuth state to None.

Deprecated

• The old log format is deprecated and will be removed in v3.14.

Fixed

• Incorrect Storage Integration API URL in Console.
• Permissions issue for reading and writing gateway secrets in the Console.
• Current and future rights selection for organization collaborators in the Console.
• Current and future rights selection for user api keys in the Console.
• Low or no throughput of message handling from Packet Broker when the ingress is high when Packet Broker Agent starts.
• Unset ADR bit in downlink messages to multicast devices.

Added

• More contextual tooltips to end device and gateway form fields in the Console.
• Warnings in the Console when changing or revoking your own access to an entity.

Changed

• Enable LoRa Standard channel for Tabs Hubs gateways.
• UDP gateway traffic is limited by IP address and source port number.
• Do not print error line logs for rate limited gRPC and HTTP API requests.
• The ttn_lw_log_log_messages_total metric was renamed to ttn_lw_log_messages_total and has an additional error_name label.
• Authenticated users now have access to gateway status and location when those are set to public.
• Cookies are no longer allowed in cross-origin requests to the HTTP API. Applications must instead use Bearer tokens in the Authorization header.

Fixed

• Loading event data in (non-historical) event streams.
• Downlink queue eviction on FCnt mismatch.
• End device payload formatter view crashing in the Console.
• End device overview frequently crashing in the Console.
• Panic on empty downlink in zero indexed downlink token.

Added

• Publish Snapcraft snaps tti-lw-stack and tti-lw-cli

Changed

• Optimized storage of recent application uplinks in Application Server.

Fixed

• Validation of OAuth token exchange requests from the CLI.
• Validation of join-request types when using the Crypto Server backend.
• Application Server session recovery functionality for imported devices.
• Fetching AppSKey when the session is rebuilt but the identifier did not change.
• Brew artifacts are now in a publicly accessible location.

Added

• Contextual tooltips to form fields in the Console.
• C-Style uint32_t representation for end device address field.
• Gateway Configuration Server to the cluster package.
  • This introduces a new config option cluster.gateway-configuration-server that needs to be set in multi-instance deployments.
• Uplink storage for integrations in the Application Server. The number of uplinks stored per end device may be configured via the config option as.uplink-storage.limit.
• LoRaCloud GLS multi frame request support.
• LoRaCloud GNSS request support.
• LoRaCloud WiFi request support.

Changed

• Allow the LinkADRReq commands to lower the data rate used by the end devices.

Fixed

• Occasional crashes in the ratelimit middleware.
• Handling of zero EUI CUPS update-info requests.
• Backend validation messages for some forms.
• Gateway downlink message previews not displaying correctly in the event view of the Console.
• Importing end devices from the Console would occasionally ignore some device MAC settings fields.

Added

• Payload formatter testing functionality in the Console.
• Options in the Identity Server to reject passwords that contain the user ID (is.user-registration.password-requirements.reject-user-id) or common passwords (is.user-registration.password-requirements.reject-common).

Changed

• Network Server now takes uplink data rate index for ADR.
• Event streams are now closed when the callers rights are revoked.

Fixed

• It is no longer possible to accidentally create API keys without any rights.
• Application overview page crashing for collaborators without certain rights.
• A bug that crashed the Identity Server when calling certain Tenant RPCs.
• mac_settings.factory_preset_frequencies handling in US-like bands.

Security

• This release fixes an issue that prevented some request messages from being validated correctly, allowing invalid values in certain fields.

Added

• API and CLI commands for listing, searching for and restoring recently deleted applications, OAuth clients, gateways, organizations and users.
• State Description fields for adding context to the (rejected, flagged, suspended) state of Users, OAuth clients and tenants.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added columns.
• Configure retention policy for the Storage Integration database (only supported when using TimescaleDB).
  • You will need to run the ttn-lw-stack storage-db migrate command to apply the new configuration. See the --timescaledb.chunk-time-interval, --timescaledb.enable-retention-policy and --timescaledb.retention-days command-line flags.
• Searching for gateways by EUI.
• Searching for users and OAuth clients by state.
• Gateway Server forwards Tx Acknowlegdment packets to the Network Server for scheduled downlinks. These can be used by the Network Server to forward downlink_ack upstream messages to the Application Server.
• UDP connection error caching. The duration can be configured via the gs.udp.connection-error-expires configuration entry.
• Option to require individual gateways to use authenticated connections.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added columns.
• Login Tokens (magic login links) that can be used for password-less login.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added columns.
  • This feature is disabled by default; use the new is.login-tokens.enabled option to enable it.
• Packet Broker registration, configuration of routing policies, listing home networks and viewing routing policies set by forwarding networks. See ttn-lw-cli packetbroker --help for more information.
• Support LoRa 2.4 GHz with Packet Broker.
• Include gateway identifiers from Packet Broker in metadata.
• Support for claiming gateways through CLI. See ttn-lw-cli gateways claim --help for more information.
• Session and MAC state import functionality. This means that devices can be migrated without rejoin.
• Rate limiting for HTTP endpoints, gRPC endpoints, MQTT, UDP and WebSockets connections.
  • Rate limiting is disabled by default. Refer to the rate-limiting configuration entry to enable.
• Profile settings link to header dropdown menu.

Changed

• Changed the pub/sub channels that the Redis backend of the Events system uses.
• Changed the encoding of events transported by the Redis backend of the Events system.
• All external HTTP calls are now using TLS client configuration. This fixes issues where HTTP calls would fail if custom (e.g. self-signed) CAs were used.
• All external HTTP calls are now using a default timeout. This fixes issues where HTTP calls would stall for a long time.
• All value wrappers now are encoded and decoded as the value being wrapped in JSON. That means, that, e.g. format of mac_settings.rx1_delay is changed from {"value": 2} to just 2.
• Changed the error that is returned when attempting to validate already validated contact info.
  • This requires a database schema migration (ttn-lw-stack is-db migrate) because of the added column.
• Update Go to 1.16
• Network Server now performs more strict validation and will disallow creation and updates of invalid devices.
• DevEUI is not required for multicast devices anymore, regarding of LoRaWAN version.
• Pub/Sub provider visibility in console based on disabled status.

Removed

• AWS IoT Integration as pub/sub integration. The integration is only available as application package.
  • This requires a database migration (ttn-lw-stack as-db migrate).

Fixed

• Incorrect documentation url for event details data formats.
• Search functionality for applications, gateways and organizations in the Console.
• Error handling of end device template formats for the application overview page in the Console.
• Payload size limits for AU915 data rates 8 and 9, which are now consistent with Regional Parameters RP002-1.0.2.
• Payload size limit calculation in Network Server.
• Occasional panic in Network Server on downlink with corrupted device states.
• Occasional panic in Identity Server on extracting log fields from invalid requests.
• Print an error message stating that the Storage Integration is not available in the open source edition of The Things Stack when trying to execute ttn-lw-stack storage-db commands.
• Applications without AWS IoT integration displaying configuration of a previously inspected application.

Added

• sentry.environment configuration option to set the environment tag on Sentry reports.
• TR005 QR code format, with ID tr005.
• LoRa Cloud Geolocation Services support for TOA/RSSI end device geolocation.

Changed

• Device Claiming Server can now contact Join Servers outside of the cluster: the source end device’s registered Join Server address is dialed.
• Default value of gs.udp.addr-change-block is now 0, which disables the IP firewall for UDP traffic. Deployments that need to enforce the IP check should set a value greater than 0. Note that the new default value makes UDP connections less secure.
• Prevent flooding logs with “Packet Filtered” messages when UDP gateways exceed the maximum rate limit. Only one message per minute will be printed for each gateway.

Deprecated

• TR005 Draft 2 and 3 QR code formats. Use the final version of the technical recommendation, with ID tr005.

Fixed

• Downlink queue operations on ABP devices not working under specific circumstances.
• NwkKey handling for end devices in the Console.

Added

• Pagination flags for the users oauth authorizations list and users oauth access-tokens list CLI commands.
• End device ID generation based on DevEUI in The LoRaWAN Device Repository creation form in the Console.
• remote_ip and user_agent metadata on OAuth events.
• created_at and updated_at fields to API Keys.
• Telemetry for Packet Broker Agent.
• User rights check for managing API keys in the Console.

Changed

• When multiple base domains are configured, the middleware uses the longest match to extract the Tenant ID.
• temp field of the UDP stats message is now type float32 (pointer).

Fixed

• Ocassional race condition in uplink matching with replicated Network Server instances.
• Ocassional race condition when matching pending sessions.
• Application uplink queue handling in Network Server.
• Conflict error when registering an end device via the wizard in the Console.
• Pagination in the List and ListTokens RPCs of the OAuthAuthorizationRegistry.
• Event name on user login.
• Application uplink queue handling in Network Server.
• Application Server session desynchronization with the Network Server. The Application Server will now attempt to synchronize the end device session view on downlink queue operational errors. This fixes the f_cnt_too_low and unknown_session errors reported on downlink queue push and replace.
• Panic while generating SX1301 config for frequency plans without radio configuration.

Added

• Profile settings view to the Account App.
  • Functionality to change basic profile information, such as name, email address and profile picture.
  • Functionality to update the account password.
  • Functionality to delete the account.

Changed

• Improved logging.
• AWS IoT integration is now implemented as package instead of a pub/sub provider.

Deprecated

• Configuration of the AWS IoT Core integration as pub/sub provider. Please use the configuration with the package name aws-iot and update to the latest version of the AWS IoT Integration CloudFormation template. The configuration via pub/sub provider will be removed in later version.
  • To migrate existing pub/sub integrations to packages, migrate the Application Server database (ttn-lw-stack as-db migrate).
• AWS IoT Core publisher of all upstream messages that is configured with as.aws.iot.telemetry.
  • This only affects The Things Stack AWS Launcher customers that use the AWS Marketplace AMI listing.
  • All deployments are now advised to use the AWS IoT Core package that can be configured per application in Application Server.

Fixed

• Synchronization in Gateway Server scheduler that caused race conditions in scheduling downlink traffic.
• End device claiming when the source device uses derived root keys.
• Console link in Account App for multi-tenant deployments.

Fixed

• Packet Broker multi-tenancy with a single tenant The Things Stack configuration.

Fixed

• The inability to see individual end devices in the Console due to field mask errors.

Added

• Pub/Sub providers may now be disabled, or marked for deprecation via --as.pubsub.providers.
• Configuration option is.admin-rights.all to grant admins all rights, including _KEYS and _ALL.
• ttn-lw-stack CLI command for creating an API Key with full rights on a user.
• Storage integration panel in the Console.

Changed

• Branding (updated TTS Enterprise logo, colors, etc).
• Packet Broker API version to v3.2.0-tts and routing API to v1.0.2-tts.

Deprecated

• Packet Broker mutual TLS authentication: use OAuth 2.0 client credentials instead; set pba.authentication-mode to oauth2 and configure pba.oauth2.
• Packet Broker forwarder blacklist setting pba.home-network.blacklist-forwarder has become ineffective.

Added

• Support for sending end device uplinks using the CLI (see ttn-lw-cli simulate application-uplink command).
• Clients can now perform custom ADR by modifying ADR parameters in mac-state.desired-parameters of the device.

Changed

• Form field layouts in the Console (field labels are now dispayed above the field).
• Small structural changes to the custom webhook form in the Console.
• Renamed experimental command ttn-lw-cli simulate uplink to ttn-lw-cli simulate gateway-uplink.
• Renamed experimental command ttn-lw-cli simulate join-request to ttn-lw-cli simulate gateway-join-request.

Fixed

• Removed misleading warning message for missing package data when setting up the storage integration package association.

Added

• Configure application activation settings from the CLI (see ttn-lw-cli application activation-settings commands).
• User API keys management to the Console.
• Purge RPC and cli command for entity purge (hard-delete) from the database.
• More password validation rules in the user management form in the Console.
• Support for class B end devices in the Console.
• MAC settings configuration when creating and editing end devices in the Console.
• Support for the LR1110 LTV stream protocol.

Changed

• Branding (updated TTS Open Source logo, colors, etc).

Fixed

• Simulated uplinks visibility in webhook messages.
• Retransmission handling.
• RTT recording for LBS gateways. The maximum round trip delay for RTT calculation is configurable via --gs.basic-station.max-valid-round-trip-delay.
• Memory leak in GS scheduler.

Added

• Configure application activation settings from the CLI (see ttn-lw-cli application activation-settings commands).
• CLI support for federated authentication provider deletion (ttn-lw-stack is-db delete-auth-provider).

Security

• Fixed an issue with authentication on the /debug/pprof, /healthz and /metrics endpoints.

Added

• gRPC middleware to extract proxy headers from trusted proxies. This adds a configuration grpc.trusted-proxies that is similar to the existing http.trusted-proxies option.

Changed

• Log field consistency for HTTP and gRPC request logs.

Fixed

• Uplink frame counter reset handling.
• Uplink retransmission handling in Network Server.
• DevAddr generation for NetID Type 3 and 4, according to errata.
• Packet Broker downlink in multi-tenant clusters.
• HTTP header propagation (such as Request ID) to gRPC services.

Added

• More password validation rules in the user management form in the Console.

Changed

• Limitation of displayed and stored events in the Console to 2000.
• Application Server will unwrap the AppSKey if it can, even if skipping payload crypto is enabled. This is to avoid upstream applications to receive wrapped keys they cannot unwrap. For end-to-end encryption, configure Join Servers with wrap keys unknown to the Application Server.
• More precise payload labels for event previews in the Console.

Fixed

• Next button title in the end device wizard in the Console.
• Navigation to the user edit page after creation in the Console.
• The port number of the http.redirect-to-host option was ignored when http.redirect-to-tls was used. This could lead to situations where the HTTPS server would always redirect to port 443, even if a different one was specified.
  • If the HTTPS server is available on https://thethings.example.com:8443, the following flags (or equivalent environment variables or configuration options) are required: --http.redirect-to-tls --http.redirect-to-host=thethings.example.com:8443.
• Status display on the error view in the Console.
• Event views in the Console freezing after receiving thousands of events.
• Wrong FPort value displayed for downlink attempt events in the Console.
• Network Server sending duplicate application downlink NACKs.
• Network Server now sends downlink NACK when it assumes confirmed downlink is lost.
• Network Server application uplink drainage.