GeoServer 2.26.4 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance (now archive) release of GeoServer, providing existing installations with minor updates and bug fixes. GeoServer 2.26.4 is made in conjunction with GeoTools 32.4, and GeoWebCache 1.26.4. Please note that this is the final scheduled release in the 2.26.x series - it is time to upgrade to a supported version.

Thanks to Peter Smythe (AfriGIS) for making this release, and to Jody for testing it.

Security Considerations

This release addresses security vulnerabilities and is considered an important update for existing installations.

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Upgrade instructions

Please take note of the Upgrade Instructions, specifically:

  • The global setting Unrestricted XML External Entity Resolution has been replaced with the ENTITY_RESOLUTION_UNRESTRICTED application property.

    This change primarily affects application schema users that have not yet adopted ENTITY_RESOLUTION_ALLOWLIST. See update instructions for details.

  • Due to a user interface change, it is no longer necessary to generate a masterpw.info when upgrading an older data directory.

    If this file is present from an earlier upgrade, it is still considered a security warning and is noted on the welcome page.

Release notes

New Feature:

  • GEOS-11805 Option to disable the management of stored queries
  • GEOS-11911 Application property ROOT_LOGIN_ENABLED

Improvement:

  • GEOS-11867 Improve entity resolution
  • GEOS-11877 Improve CoverageView composition to support noData fill on missing bands/coverages
  • GEOS-11892 Column mentioning user that performed last modification for layers and stores list UI

Bug:

  • GEOS-10728 Cannot download GeoPackage if the source data contains UUID types
  • GEOS-11820 WCS spatial sub-setting does not work when native CRS != declared CRS
  • GEOS-11832 count=0 service exception for some formats
  • GEOS-11866 Prevent requests setting variables that should only be set by GeoServer
  • GEOS-11896 WPS map download flips east/west coordinates
  • GEOS-11900 CRS:XY syntax builds isolated CRSs that do not leverage the EPSG database transformation library

Task:

  • GEOS-11831 OseoDispatcherCallback improvements
  • GEOS-11852 Remove master password info page
  • GEOS-11853 Clarify keystore vs master vs root password
  • GEOS-11854 Generation of security/masterpw.info no longer required
  • GEOS-11869 Replace entity resolution setting with application property

For the complete list see 2.26.4 release notes.

Community Updates

Community module development:

  • GEOS-11829 Features templating ability to override schema
  • GEOS-11830 Smart data loader create store page fails when environment variables are in use
  • GEOS-11839 New Community Module for WPS Download in NetCDF output format for spatiotemporal coverages
  • GEOS-11847 Next link is missing in “Search” OGC API - Features proposal implementation when startIndex is not set
  • GEOS-11871 Allow native execution of group by in DGGS store, when grouping on geometries
  • GEOS-11876 WPS Vertical Longitudinal Profile: Support automatic distance computation
  • GEOS-11878 WFS HITS request returns the whole data records on a GML feature templated layer
  • GEOS-11880 OGC API Maps is not showing up in GeoServer home page

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.26 Series

Additional information on GeoServer 2.26 series:

Release notes: ( 2.26.4 | 2.26.3 | 2.26.2 | 2.26.1 | 2.26.0 | 2.26-M0 )