Merge remote-tracking branch 'origin/v3.36' into release/v3.36.0

Author: happyRip

.github/actions/install-go-and-deps/action.yml

@@ -1,17 +1,12 @@
 name: Install Go and Dependencies
 description: Install Go and Go Dependencies
-inputs:
-  go-version:
-    description: Go Version
-    required: true
-    default: "~1.24"
 runs:
   using: composite
   steps:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: ${{ inputs.go-version }}
+        go-version-file: go.mod
     - name: Download Go dependencies
       shell: bash
       run: |

.github/workflows/go.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Lint code
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1
+          version: v2.9
           only-new-issues: true
           args: --timeout=10m ./pkg/... ./cmd/...
 

CHANGELOG.md

@@ -11,14 +11,21 @@ For details about compatibility between different releases, see the **Commitment
 
 ### Added
 
+- Add tracing for LBS LNS and TTIGW protocol handlers.
+- TTGC LBS Root CUPS claiming support.
+
 ### Changed
 
+- During the process of claiming a managed gateway, create the gateway in the registry before claiming it, not after.
+
 ### Deprecated
 
 ### Removed
 
 ### Fixed
 
+- Mutex locking that caused the rights to be fetched for authorization checks sequentially. This caused gateways to reconnect slowly after Gateway Server restarts and rpcs to timeout that were asserting gateway rights.
+
 ### Security
 
 ## [3.36.0] - 2026-04-03
@@ -27,6 +34,10 @@ For details about compatibility between different releases, see the **Commitment
 
 - The timestamp of the udp packet is now always correct when the 'Schedule downlink late' is enabled for the gateway and downlink scheduling hits the duty cycle limit.
 
+### Security
+
+- HTML-escape gRPC error messages and error detail attributes to prevent reflected XSS in API error responses.
+
 ## [3.35.2] - 2026-01-30
 
 ### Changed

config/messages.json

@@ -4013,6 +4013,24 @@
       "file": "ttjs.go"
     }
   },
+  "error:pkg/deviceclaimingserver/gateways/ttgc:create_api_key": {
+    "translations": {
+      "en": "failed to create API key for gateway"
+    },
+    "description": {
+      "package": "pkg/deviceclaimingserver/gateways/ttgc",
+      "file": "lbscups.go"
+    }
+  },
+  "error:pkg/deviceclaimingserver/gateways/ttgc:delete_api_key": {
+    "translations": {
+      "en": "delete API key"
+    },
+    "description": {
+      "package": "pkg/deviceclaimingserver/gateways/ttgc",
+      "file": "lbscups.go"
+    }
+  },
   "error:pkg/deviceclaimingserver/gateways/ttgc:dial_gateway_server": {
     "translations": {
       "en": "dial Gateway Gerver `{address}`"
@@ -4022,6 +4040,15 @@
       "file": "root_ca.go"
     }
   },
+  "error:pkg/deviceclaimingserver/gateways/ttgc:no_supported_claim_option": {
+    "translations": {
+      "en": "no supported claim option (protocol + auth method) found for gateway"
+    },
+    "description": {
+      "package": "pkg/deviceclaimingserver/gateways/ttgc",
+      "file": "ttgc.go"
+    }
+  },
   "error:pkg/deviceclaimingserver/gateways/ttgc:verify_gateway_server_tls": {
     "translations": {
       "en": "verify TLS server certificate of Gateway Server `{address}`"
@@ -5660,6 +5687,15 @@
       "file": "scheduler.go"
     }
   },
+  "error:pkg/gatewayserver/scheduling:schedule_too_far_ahead": {
+    "translations": {
+      "en": "schedule time is too far in the future"
+    },
+    "description": {
+      "package": "pkg/gatewayserver/scheduling",
+      "file": "sub_band.go"
+    }
+  },
   "error:pkg/gatewayserver/scheduling:sub_band_not_found": {
     "translations": {
       "en": "sub-band not found for frequency `{frequency}` Hz"

data/lorawan-frequency-plans

@@ -1,8 +1,8 @@
 module go.thethings.network/lorawan-stack/v3
 
-go 1.24
+go 1.26
 
-toolchain go1.24.1
+toolchain go1.26.1
 
 // See https://github.com/mitchellh/mapstructure/pull/278
 replace github.com/mitchellh/mapstructure => github.com/TheThingsIndustries/mapstructure v0.0.0-20230413130846-941bcd1deec3
@@ -49,7 +49,7 @@ require (
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0
 	github.com/hellofresh/health-go/v5 v5.5.5
 	github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef
 	github.com/iancoleman/strcase v0.3.0
@@ -100,31 +100,31 @@ require (
 	go.packetbroker.org/api/mapping/v2 v2.3.2
 	go.packetbroker.org/api/routing v1.9.2
 	go.packetbroker.org/api/v3 v3.17.1
-	go.thethings.industries/pkg/api/gen/tti/gateway v0.0.0-20241212200202-1050b2b3ffa6
+	go.thethings.industries/pkg/api/gen/tti/gateway v0.0.0-20260326103632-2a98d7e48bc4
 	go.thethings.industries/pkg/ca v0.0.0-20241212200202-1050b2b3ffa6
 	go.thethings.network/lorawan-application-payload v0.0.0-20220125153912-1198ff1e403e
 	go.thethings.network/lorawan-stack-legacy/v2 v2.1.0
 	go.uber.org/automaxprocs v1.6.0
 	go.uber.org/zap v1.27.0
 	gocloud.dev v0.42.0
 	gocloud.dev/pubsub/natspubsub v0.42.0
-	golang.org/x/crypto v0.40.0
+	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc
-	golang.org/x/net v0.42.0
-	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sync v0.16.0
+	golang.org/x/net v0.48.0
+	golang.org/x/oauth2 v0.35.0
+	golang.org/x/sync v0.19.0
 	google.golang.org/genproto v0.0.0-20250707201910-8d1bb00bc6a7
-	google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7
-	google.golang.org/grpc v1.73.0
-	google.golang.org/protobuf v1.36.6
+	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c
+	google.golang.org/grpc v1.79.1
+	google.golang.org/protobuf v1.36.11
 	gopkg.in/mail.v2 v2.3.1
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250625184727-c923a0c2a132.1 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260209202127-80ab13bee0bf.1 // indirect
 	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go v0.121.3 // indirect
 	cloud.google.com/go/auth v0.16.2 // indirect
@@ -261,9 +261,9 @@ require (
 	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/image v0.29.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/term v0.33.0 // indirect
-	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/api v0.241.0 // indirect