Security hardening of the administration portals. The admin front end and back end now sanitize rich content, the password change and reset routes are dedicated and protected, public routes are rate limited, and the OLS API requires authentication for write operations. The platforms run on an up-to-date Node.js, no longer expose infrastructure details (machine name, "running on" banner), and the Docker images are pinned. thingin-api now distinguishes machine-to-machine token access from web cookie access.
More capable and more reliable queries. Users can count the results of a historical query (tcount) and send a free-text query to the search endpoint. Geospatial TGQL queries work for snapshot and slice queries, queries no longer fail on variable names, and result pagination is stable in cluster mode. Several conversion errors in the search (numeric values, relationship IRIs) and in historical queries (tcount of a range slice, order of the MATCH section) are fixed.
Faster ziggy-server. Reading and searching avatars is lighter on ArangoDB and ZooKeeper (no more one query per returned avatar, usage counters off the hot path), and each operation now exposes its ArangoDB query count and a Pyroscope profile label to ease performance analysis. Ontology concepts are resolved consistently at insertion and at reading.
Digital twin view. The network view of thingin-admin gets graph zoom, node highlighting and blinking links.
Operational reliability. federated token validation tolerates small clock differences, access control changes are applied across ziggy-api workers and thingin-histdb-feed gets readable aggregated logs and a faster injection of historized data.
| Component |
Version(s) |
Note |
| thingin-logic |
v0.2.13, v0.2.14, v0.2.15, v0.2.16 |
v0.2.13 (Oct 21), v0.2.14 (Nov 2), v0.2.15 (Nov 6), v0.2.16 (Nov 9) |
| thingin-api |
v2.3.0, v2.3.1 |
v2.3.0 (Oct 22); v2.3.1 aligns on thingin-logic 0.2.16 and ziggy-server 4.2.0 |
| thingin-admin |
v1.23.0 |
|
| ziggy-admin |
v2.22.0 |
|
| ziggy-federator |
v1.6.1 |
|
| federator-admin |
v1.4.0 |
|
| ziggy-api |
v4.2.0 |
|
| ziggy-ols |
v9.5.8 |
|
| ziggy-server |
v4.2.0 |
uses thingin-logic 0.2.16 |
| thingin-histdb-feed |
v4.0.3, v4.0.4 |
v4.0.4: dependency updates, including thingin-logic 0.2.14 |
| ziggy-net-twin |
v1.7.4 |
|
| thingin-dumper |
1.6.0 |
tag without the v prefix, as the previous 1.5.0 |
| ziggy-websocket |
v2.4.7 |
dependency updates only |
| thingin-rules |
v2.4.8 |
dependency updates only |
Compatibility: thingin-api v2.3.1 uses thingin-logic 0.2.16 and server-arangodb 4.2.0 (ziggy-server v4.2.0). ziggy-server v4.2.0 uses thingin-logic 0.2.16. thingin-histdb-feed v4.0.4 uses thingin-logic 0.2.14.
Security
- Sanitize rich content displayed in the admin interface and remove the
innerHTML sinks that rendered arbitrary server content (H6) (#464, #443)
- Use a dedicated
PUT route to change the password of a logged-in user (H7) (#471)
- Fix duplicated HTTP security headers (H3) (#466)
- Pin the Alpine Docker image to avoid a CVE reported by the Trivy analysis (#468)
- Upgrade to Node 22.23.4 (#473)
Bug Fixes
- Fix the sign-up button that stayed disabled (#467)
- Fix ontology source viewing, which failed with a CORS error: the source is now fetched through
ziggy-admin (#472)
Enhancements
- Digital twin: zoom on graph nodes and edges (MR without linked issue) (!192)
- Digital twin: highlight nodes (MR without linked issue) (!191)
- Digital twin: compact node style and blinking links (MR without linked issue) (!190)
Security
- Sanitize rich admin content on the server side (H6) (#622)
- Harden the password change route (H7) (#627)
- Require authentication on the OLS API write routes and add a
GET /api/ols/source proxy to read ontology sources (H7) (#629)
- Apply rate limiting on all public back-end routes used by the front end (#628)
- Remove
phantomjs, an abandoned dependency (P0) (#625)
- Upgrade to Node 22, then to 22.23.4 (#568, #630)
Bug Fixes
- Accept the custom cache header in the dashboard
sdif queries (#626)
Bug Fixes
- Fix the concept resolution between insertion and reading of an avatar: a property such as
type was converted to an ontology IRI at insertion but not at reading, now consistent through the thingin-logic ontology lookup (the old lookup client and core-context.json were removed) (#1328)
- Fix the
tcount result of a RANGE_SLICE query, which did not match tfind (P1) (#1138)
- Preserve the order of the
MATCH section when a TCypher query is converted to Cypher with optional matches (#1139)
- Return a 400 error instead of a 500 error when a date has a wrong format (#1329)
Performance
- Remove the N+1 queries of
avatars/find (two ArangoDB queries per returned avatar) by fetching the relations in the main query (#1320)
- Move the avatar read counter off the ZooKeeper hot path, where a distributed counter was incremented on every request (#1324)
- Stop creating a URL per avatar just to read its URI scheme (#1327)
- Count the ArangoDB queries of each handler operation (#1326)
- Add a Pyroscope operation label to filter profiles per handler operation (#1325)
v2.3.1 only aligns the dependencies on the released thingin-logic 0.2.16 and ziggy-server 4.2.0; the items below were delivered in v2.3.0.
Security
- Distinguish token usage (machine to machine) from cookie usage (web application) on
/auth (#152)
Bug Fixes
- Fix edge conversion when the origin or target IRI is not available (#155)
- Accept
BigDecimal numeric values in the TiQL search, which the ontology type check wrongly rejected (#164)
Enhancements
- Add a
tcount query to get the number of results of a historical query (#128)
- Accept a free-text (
text/plain) query on the /search endpoint (#165)
Bug Fixes
- Fix TGQL geospatial queries for snapshot and slice queries (
SNAPSHOT, LEFT_SLICE, RIGHT_SLICE) and harden the geospatial support (#56)
- Stop the 500 error on a TGQL query whose variable is named
p, by avoiding collisions between internal AQL variable names and user variables (#54)
- Fix the
ClassCastException (BigDecimal to Integer) in SearchUsingTIQL (#53)
- Make TGQL result pagination stable in cluster mode with a default temporal order (#51)
- Fix the GQL search integration test (relationships of a domain) (#40)
Enhancements
- Expose the free-text query detection in a public
SearchInputGuesser component, reused by thingin-api (MR without linked issue) (!114)
Bug Fixes
- Reduce the per-event log volume, replaced by a more readable follow-up (#44)
Enhancements
- Restore aggregated batch logs (processed events, throughput) (#45)
- Improve the injection performance of historized data (#46)
Security
- Stop displaying the machine name in Swagger UI (#43)
Bug Fixes
- Add a tolerance to the
iat claim check of tokens, which caused the "The token is not yet valid" error (#42)
- Restore the version in the
GET /status response (#44)
Security
- Upgrade to Node 22.23.4 (#28)
- Remove the "running on" banner from the main page (#31)
Bug Fixes
- Fix the file name suggested when downloading an ontology (P1) (#167)
- Fix the icon being removed by a
PUT on ontologies/classes/<id>/icon (P2) (#171)
Bug Fixes
- Invalidate the ACL and role cache, across workers, when the default access control is updated (#508)
Bug Fixes
- Fix the occupation summary, which was inconsistent when a reservation exists (#41)
Enhancements
- Upload large ArangoDB backup files to S3 with a multipart upload: on the qualif platform the zip file was too big for a single S3 upload, which failed (#15)
Thing in the future 4.1.0 mainly integrates bugfix and security hardening.
Security
- Remove unnecessary
[innerHTML] usage to reduce XSS attack surface (#462)
- Upgrade Angular framework (security prerequisite) (#461)
- Add HTTP security headers and forward CSP violation reports to ziggy-admin (#457)
- Remove deprecated LiveObjects/Clotilde login integration (#452)
- Remove dead
JwtInterceptor code re-injecting JWT from localStorage (audit finding H-11) (#447)
- Stop logging plaintext password and user payload in signup/auth flows (audit finding H-5) (#442)
- Restrict
postMessage target origin instead of wildcard * (audit finding H-2) (#440)
- Validate
event.origin on window message listener (audit finding H-1) (#439)
Bug Fixes
- Fix incorrect parsing of
xsd:duration values (#48)
- Fix AASQL grammar parsing issues (#46)
- Fix
$phrase operator handling in queries (#42)
Enhancements
- Add temporal operators support to
range_slice (#49)
- Reuse singleton
AModelDao in TiQLQueryParser instead of creating a new instance per request (performance) (#45)
- Add geospatial functions support to TGQL (#41)
- Deliver AASQL prototype parser and transpiler (#37)
- Support domains configured without historization (#29)
Security
- Harden CSP violation report handling against exceptions (#621)
- Add endpoint to receive CSP violation reports (#619)
- Remove deprecated LiveObjects login controller (Sonar finding) (#617)
- Flag SSRF risk in
/api/liveObjects/call endpoint with hardcoded credentials — currently non-exploitable due to an unrelated proxy issue, kept on watch (#616)
- Remove exposed credentials from SmartDemoIndustry (bug bounty finding) (#596)
Bug Fixes
- Fix broken requests in
/explore view (#623)
integrates thingin-logic 0.2.12
Bug Fixes
- Fix DatatypeProperty/ObjectProperty confusion in Turtle export (#1318)
- Return explicit error when updating an avatar with a duplicate relation on a non-multi relationship domain (#1315)
- Fix certificate validation error when loading blobs for batch processing on OINIS platform (#1311)
Enhancements
- Add 3D coordinates support to Arango geo operators (#1314)
- Add support for multi-valued properties (#1313)
Security
- Update Java base Docker image to address security vulnerabilities (#169)
Bug Fixes
- Fix SVG-to-icon conversion (#170)
- Fix gsmot ontology classes incorrectly detected as individuals (#168)
Enhancements
- Remove deprecated Ignite dependency (#161)
integrates thingin-logic 0.2.12
Bug Fixes
- Fix missing ziggy-server log entries in thingin-api logs (#163)
Enhancements
- Move metrics endpoint to a dedicated HTTP server (#162)
- Improve error message clarity for invalid enum values (#86)
Bug Fixes
- Fix batch process unable to use visibility level 1 (#507)
Thing in the future 4.0.4 integrates bugfix and minor enhancements, with security hardening as the dominant theme. Telemetry (prometheus) was added on 3 components. As functional improvement, it is now possible to declare avatar ACL on a domain (applied to all avatars of the domain)
Security
- Fix improper access control on /portalAccount and /users endpoints (YWH-PGM8535-1571, YWH-PGM8535-1589) (#589)
- Fix improper access control on tip API via POST (YWH-PGM8535-1601) (#588)
- Fix improper access control on admin mailing and blacklist endpoints (YWH-PGM8535-1602) (#586)
- Secure XSRF-TOKEN cookie (#600)
- Secure /selfcare endpoint (bug bounty finding) (#594)
- Fix reflected XSS via 'url' GET parameter on /embed (YWH-PGM8535-1594) (#592)
- Fix XSS vulnerability (YWH-PGM8535-1554) (#577)
- Sanitize client-provided headers (YWH-PGM8535-1557) (#576)
- Secure connect.sid session cookie (#572)
- Sanitize user-controlled input used to build database queries (Sonar finding) (#578)
Bug Fixes
- Fix isAuthenticated() never checking token expiry (#609)
- Fix inconsistent pagination in avatar list logs (#595)
- Fix broken .env variable for unsubscribe and password-reset email links (#590)
Enhancements
- Remove deprecated Mongoose calls (entity.remove, Model.update) ahead of Mongo upgrade (#587)
Security
- Add selfcare form component (bug bounty finding YWH-PGM8535-1609) (#437)
- Remove hard-coded credentials in SmartIndustryDemo/app.js (bug bounty finding) (#436)
- Fix open redirect after login via unvalidated 'next' parameter (security audit C-3) (#433)
- Fix client-side open redirect/SSRF via unvalidated iframe.src on /embed (security audit C-2) (#432)
- Enable JavaScript build optimization in production (security audit C-1) (#431)
- Fix production build running with optimizations disabled (security audit C-1) (#426)
Bug Fixes
- Fix broken 'Add portal user' action (#449)
- Fix blocked authorization in embedded Swagger UI (#448)
- Fix blob download issue in visualization view (#435)
- Fix 3D Viewer widget using an expired/unavailable token (#450)
Enhancements
- Warn users when SDT avatar list is inconsistent (#428)
Security
- Critical: POST /search bypassed domain/visibility authorization, exposing 235k+ private avatars (#38)
- Strengthen JWT token validation (#21)
Bug Fixes
- Fix GraphQL queries returning no results for Metro Rennes dataset (#34)
- Fix TiQL expression regression in integration test (#31)
- Fix TiQL $currentTime regression in integration test (#28)
- Fix TiQL expression regression for cross-avatar property access (#27)
- Fix silent OLS connectivity/unknown-ontology errors being cached as false negatives (#26)
Enhancements
- Integrate thingin-backbone as a thingin-logic module (#36)
- Resolve EntityType ambiguity between TwinNode and Relationship (#32)
- Improve error messages for search queries (#30)
integrates thingin-logic 0.2.10
Security
- Fix SSRF via webhook trigger URL (missing destination host validation) (#1305)
- Block file:// scheme in batch process to prevent local file access except for specific deployments (#1308)
Bug Fixes
- Fix orphaned label relations after findAndDelete operation (#1302)
Enhancements
- Add validation check on request creation (#1300)
- Add access control (ACL) on domain resources (#1196)
- Add Pyroscope for performance profiling/supervision (#1310)
- Add telemetry support (#1304)
Security
- Fix erroneous error message (#503)
- Remove the /init endpoint (#500)
- Fix float conversion - from Semgrep security scan (#489)
Enhancements
- Add Prometheus metrics for observability (#506)
- Update parameters naming in avatar ACL (but keep retro compatibility) (#505)
- Add access control (ACL) on domain resources (#504)
integrates thingin-logic 0.2.10
Security
- Harden response headers and enable Secure cookie flag (#157)
- Strengthen JWT token validation (#154)
- Reject empty required strings and catch unhandled service exceptions (audit finding H7) (!131) (MR without linked issue)
- Hide 404 path suggestions from unauthenticated callers to prevent API surface enumeration (audit finding M4) (!130) (MR without linked issue)
Enhancements
- Add telemetry support (#158)
Security
- Update subscriber API access control (#164)
- Require authentication on DELETE /icons/{id} endpoint (pentest finding) (#166)
- Remove GraphQL to remove vulnerable bundled JS and technical debt (#142)
Security
- Restrict access to local addresses (security hardening) (#72)
Enhancements
Security
- Integrate federator security logic using thingin-backbone's new security features (#23)
Security
- Restrict access to local addresses (security hardening) (#241)
Security
- stat endpoint authentication is now mandatory (#23)
Enhancements
Security
- Update selfcare request link (#14)
Thing in the future 4.0.0 is a major update, it integrates a new unified search API, requests traduction has been refactored, and historization is now stored in arango DB (requests via search endpoint). Neo4j is only used to access previous data (requests via tfind endpoint). This version was also heavily focused on security hardening in response to a Bug Bounty program
-
Server (4.0.2) deployed on 2026/07/24
- Fix some GQL queries
- Remove EntityType ambiguity as used both for TwinNode and for Relationship
- Fix Orphan label relation after findAndDelete
- Fix regressions for specific tiql queries
- Fix find request with a fixed value for a label DP not working
-
Server (4.0.1)
- Optimize getting conversion function
- Use thingin-logic TiQL instead of ziggy-server TiQL
- Integrate generic search endpoint
- non root user docker image
-
Api (4.0.2) deployed on 2026/07/24
- Refactor entity type schemas to separate twin node and relationship types
-
Api (4.0.1)
- Change SDTs & platforms access
- Add RBAC for aspects
- Prevent influx leaks and injection: endpoint /ts/metrics removed, endpoint /ts/stats added
- Fix errors (500 then 504) when trying to use a token from an unknown tipod
- Integrate swagger-ui (external docker image not needed anymore)
- Integrate generic search endpoint
- non root user docker image
-
thingin-admin (1.22.0)
- Fix Ontologies: error not displayed when we click on validate
- Use /ts/stats instead of /ts/metrics
- Avoid elevation of privilege (securize user update)
- improve Sonar Coverage
- Securize JWT in CurrentUser object stored in local storage
- Set Secure and HttpOnly Token
- Login: invoke server withCredentials
- Fix Explore time: request with no result display "fetching data"
- Fix Dashboard: font size not working
- Fix Dashboard: cache with no TTL defined result in a 500 error
- Remove Google Maps Drawing Library
- Heatmap like visualization
- Explore: prevent Token stored in blob
- Fix Cannot add a new OpenStreetMap injector
- Support multiple format of lat-long when retrieving injection history
- OINIS: color depending of links occupation
- OINIS: mask GX1 roadm for Infinera
- OINIS: allow to click on summary to reserve frequencies
- OINIS: inverse link deletion side effects
- OINIS : allow to disable node clusterization for multi-site NE
- OINIS: use new endpoint fromDomain
- Specific injector: use openstreetmap instead of google maps
- Dashboard: Prevent token stored in blob
- non root user docker image
-
federator (1.5.7)
- Minor changes on POST /authority/uuid and POST /tipod/uuid/revoke
- When trying to create a tipod with existing url, return existed uuid
- non root user docker image
-
OLS (9.5.5)
- Fix uploadDate sort field not working correctly
- Validate input parameter and escape them to prevent XSS
- Securize ontology import
- Restrict ontology submission to provider from reference tipod
- Validate/escape user input to build elastic queries
- Fix vulnerabilities on robot.jar
- Fix Public S3 access issue
- fix task API is public and contains user e-mail
- non root user docker image
-
ziggy-injectors (1.9.3)
- Validate input parameter and escape them to prevent XSS
- Securize user input url
- Fix OSM: special character issue
- non root user docker image
-
ziggy-admin (2.21.0)
- improve access control to admin functionaities
- Fix core role update not working for role without portal account
- reset password use a fixed URL. New env variable: PORTAL_THINGIN_URL
- Avoid elevation of privilege (securize user update)
- Securize JWT in CurrentUser object stored in local storage
- Set a
token cookie with Secure and HttpOnly attribute
- Mongo Upgrade - remove deprecated instructions
- non root user docker image
-
ziggy-net-twin (1.7.3)
- deactivate actuactor endpoints
- Link tunnel-termination-point to transceiver
- Use TOASTER service file to link circuit to tunnel-termination-point
- non root user docker image
-
Api essentials (2.0.0)
- Cypher versus GQL are not interchangeable
- Add custom AQL interpreter
- Fix Couldn't create database session: com.arangodb.ArangoDBException: Cannot contact any host!
- Test adding MCP client to react app
- non root user docker image
-
thingin-histdb-feed (4.0.0)
- Integrate arangoDB as backend
-
thingin-logic (0.2.3.7)
- Integrate generic search endpoint
- add ThingIn-AQL safe interpreter and module
- Simplify & clean TiQl Integration
- TGQL implementation
- make GQL "write" operations authorized or not through configuration
- Fix Fields origin and target IRIs in relationship are left empty in GQL query responses
-
Server (3.35.0)
- Batch avatar create perf enhancement
- Fix performance issue when updating avatars
- Allow to make asynchronous count queries
- asynchronous queries (find / count): increase guardian
- Remove cluster functionnality
- Fix POST conversion return code inconsistency
-
Api (3.35.0)
- Remove cluster functionnality
- Fix POST conversion return code inconsistency
-
Api essentials (1.7.0)
- Remove cluster functionnality
-
ziggy-net-twin (1.7.0)
- Add an endpoint to get occupation percentage on links
- Add an endpoint to get reserved slots on a domain
- Add link between ROADM even if no OTSI exists
-
ziggy-admin (2.20.0)
- Add async header to ziggy-api requests
- Differentiate internal and external access to OLS API
-
thingin-admin (1.20.0)
- Dashboard: allow cache for widgets that contains variables
- Dashboard: add a refresh button to refresh all widget from current tab
- dashboard: use asynchronous count
- dashboard: allow to use variable in constant value
- Dashboard: allow to move tabs
- Dashboard: add color for threshold on percentage
- Dashboard: add cache for avatar count requests
- Dashboard: store request_uuid for avatar count queries
- Dashboard: show label "updated at" in async widget-value
- Fix Dashboard: variable substitution not working on value
- Fix duplicate dashboard issue
- Fix new dashboard creation issue
- SDT: add platform name in addition to plaform description when creating a SDT
- SDT: new param for SDT
- Fix GET /sdts pagination issue
- Migration of ThinginForm to Angular 21
- Fix Explore wizard classes issue
- Traduce lastSeen property to text
- When submitting an ontology, the location url to follow the task may not be accessible. Extract the task id and call OLS through the portail backend
- Fix Demo OINIS: error 400 when trying to reserve a new frequency
- Demo OINIS: add refresh button in spectral allocation view
- Demo OINIS: Add nb of allowed slot in spectral allocation view
- Accessibility : footer link to update with the audit results page
- Fix Viewers : do not make the call for "focus on node" when thingin_endpoint and thinkin_token are not set
-
**OLS (9.5.4)
- Fix Impossible to get SVG icon
-
SDT (1.12.1)
- Add support for Basic Auth to access platform
- Add template header for getting data
- Improve error handling (more explicit message retourned to ziggy-api)
Release notes 2025
Previous release notes