GeoServer 2.28.5 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance release of GeoServer providing existing installations with minor updates and bug fixes. GeoServer 2.28.5 is made in conjunction with GeoTools 34.5, and GeoWebCache 1.28.5.

Thanks to Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for making this release.

Security Considerations

This release addresses security vulnerabilities and is an urgent update for production systems.

  • GHSA-mqjf-5f49-2fjh Unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (High)

    This releases includes the GeoTools 34.5 resolution of the above SQL Injection vulnerability which affects PostGIS 12 and up. Unfortunately our coordinated vulnerability disclosure policy was not followed in this case. This post will be updated with an official CVE number when one is available.

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

  • GEOS-12080 style edit: check image loads
  • GEOS-12082 CoverageStore - quick fail for incorrect files
  • GEOS-12095 LDAP: conversion from group-member-username to user-search username
  • GEOS-12140 Improve CoverageAccessLimits’s RasterFilter masking on SecureGridCoverage2DReader reading
  • GEOS-12141 WMS nearest match machinery can issue queries that are guaranteed to return an empty result
  • GEOS-12151 Allow caching small images used by ImageMosaic in memory

Bug:

  • GEOS-11373 Geometry type mismatch in WFS 1.1.0
  • GEOS-11571 The geoserver-2.26.0-printing-plugin is missing some dependend libraries
  • GEOS-12138 Improve DescribeDomains expandLimit validation
  • GEOS-12145 Missing spatial filter in GeoFenceAccessManager SQL query when only CLIP is applied
  • GEOS-12146 Wrong CRS axis order used in SecuredFeatureSource when clipping features for WFS 2.0.0 requests
  • GEOS-12149 GeoServer WMTS capabilities put query parameters in the wrong place in generated URLs
  • GEOS-12165 GeoServer does not start when fileLockProvider is set: lock wait times out

Task:

  • GEOS-12137 Update OSHI from 6.8.2 to 7.3.0
  • GEOS-12148 Update GetFeatureInfo to list features (rather than as a table)

Sub-task:

For the complete list see 2.28.5 release notes.

Community Updates

Community module development:

  • GEOS-12129 Longitudinal profile positive altitude includes first elevation as ascent from zero
  • GEOS-12173 Remove the REST module profile from community modules as the module does not exist here

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.28 Series

Additional information on GeoServer 2.28 series:

Release notes: ( 2.28.5 | 2.28.4 | 2.28.3 | 2.28.2 | 2.28.1 | 2.28.0 )