We are happy to announce the release of GeoServer 2.8-beta. Downloads are available (zip, war, dmg and exe) along with docs and extensions.

GeoServer 2.8 has a wide range of new features, behind the scenes changes, and a several of important security updates. This is beta release of GeoServer made in conjunction with GeoTools 14-beta.

This beta release is made available for collaboration with our user list (and is not intended for production). The beta release marks the of a feature freeze, we appreciate any and all testing during this period as we prepare for a September release.

New capabilities:

• Read/write PostGIS curve support

• ContrastEnhancement can now be refined with choice of algorithm

• New vendor options to sort spatial data with respect z-order (within a layer or across multiple layers)

• Return of a popular feature from GeoServer 1.0 - the ability to filter a vector layer contents prior to publication (great for layers such as point-of-interest that have several kinds of content in one table)

• REST API for security access control (a popular request for those configuring GeoServer remotely)

• Importer REST API can include processing steps (using gdalwarp/gdal_translate/gdaladdo transformations to prepare data for publication, with a number of ready to use examples)

• Import REST API available to allows a granules to be added to an existing mosaic

• Application Schema configuration files can now be managed via REST API

• GetMap support for by layer interpolation methods

• When creating a new style (or importing new data) you can choose to generate a new SLD or CSS style

• New shape symbol (extshape://arrow) with parameters dynamically controlling proportions

• Target maps using multiple scripts by specifying more than one font in the SLD, the fonts will be tested in turn to see which one can display a particular label, or portion of label (e.g., for multiscript labels, mix of latin/arabic/chinese/…)

• New map projections supported: sinusoidal, gnomonic, meteosat second generation, general oblique, added new custom AUTO codes for gnomonic and stereographic

• When JAI-EXT is enabled, the image mosaic can support images with different color models (.e.g, gray, paletted and color in the same mosaic)

Fixes and improvements:

• Significant increase in GML 3.X encoding speed

• Pretty print option for style REST API

• Allow environment variables to be used in freemarker template files

• GeoWebCache parameter filters can now be set via GUI

• INSPIRE metadata entry is now more forgiving and can be entered on a layer by layer basis

• Fix for XXE security vulnerability has been revised and now functions in a JBoss environment

• Faster startup for installations with large number of Oracle layers

• The CSV output format can now handle WFS GetFeature join results (will transparently flatten the joined features)

Internal changes:

• JAI-Ext integration for geospatial specific image processing operations, adding direct support for NODATA in raster sources. Disabled by default, needs to be enabled using a system variable.

• Replacement of vecmath with EJML matrix library

• Due to license restrictions the oracle extension no longer includes an Oracle JDBC driver, see the user guide for manual install instructions.

Community update:

• We would like to welcome Stefano Costa (GeoSolutions) as a new committer!

• Developers guide refresh covering release cycle, updating PSC members, and fixing tutorials

• Responsible disclosure expectations covered on the website and user guide

See release notes for more information.

Thanks to Jody (Boundless) for publishing this beta, and the entire GeoServer team for an enormous effort bringing this release together.

About GeoServer 2.8

GeoServer 2.8 is scheduled for September release. For more information:

• XEE Vunerability (GeoServer)

• Z ordering features within and across feature types and layers (User Manual)

• JAI-Ext, the Open Source replacement for Oracle JAI (GeoSolutions)

• Customizable arrow in GeoServer (GeoSolutions)

• PostGIS Curve Support (GeoSolutions)

• Improved NetCDF/GRIB support in GeoServer (GeoSolutions)

For additional details see the 2.8-beta and 2.8-M0 release notes.

New Community Modules

In addition to the formal GeoServer 2.8 release our code base has a community area for ideas an experimentation:

• WCS and WPS output formats based on gdal_translate to provide a greater range of output formats

• Embedded GeoFence server, REST API and GUI is the result of a productive collaboration between GeoSolutions and Boundless offering greater rule-based control of GeoServer security

• MongoDB DataStore enabling GeoServer to publish from this popular JSON based document database (no zip packaging, needs volunteer)

Community modules should be considered a work-in-progress and are subject to quality assurance, documentation IP checks and a maintainer before being considered ready for release.

The GeoServer team is happy to announce the release of GeoServer 2.7.2. Download bundles are provided (zip, war, dmg and exe)  along with documentation and extensions.

GeoServer 2.7.2 is a stable release of GeoServer recommended for production deployment. Thanks to everyone taking part, submitting fixes and new functionality including:

• Importer raster improvements, added support for GDAL based file optimization when importing rasters, also, it is now possible to add add granules to a mosaic (and optimize them with GDAL in the process)

• Importer vector improvements, now one can import data into non JDBC data stores too

• Some improvements in the documentation on using GDAL based data sources in Windows

• More tweaks on the XXE vulnerability fixes (we left it open just enough not to break OGC compliance)

• Properly rendering GeoTiff files with flipped Y axis

• Making sure WPS really stops answering requests when not enabled

• Improvements in NetCDF handling of reprojected requests

• For a full list, see the release notes.

Also, as a heads up for Oracle users, the Oracle store does not ship anymore with the JDBC driver (due to redistribution limitations imposed by Oracle). For details see the updated the oracle installation instructions here.

Thanks to Andrea (GeoSolutions) and Kevin (Boundless) for this release.

GeoServer has encountered an XML External Entity (XEE) vulnerability permitting an unauthenticated read access to server files.

This vulnerability GEOS-7032 is addressed in the following releases and we strongly encourage all users to upgrade:

• GeoServer 2.7.1.1 (bin, war, dmg and exe) - stable release

• GeoServer 2.6.4 (bin, war, dmg and exe) - maintenance release

• GeoServer 2.5.5.1 (bin, war, and exe)

Thanks to Ben Caradoc-Davies (Transient Software) for the maintenance release along with Jody Garnett (Boundless) and Andrea Aime (GeoSolutions) for the unscheduled patch releases provided above.

If you are running an earlier version of GeoServer and would like to generate a patch release please contact one of our commercial support providers, or join us on geoserver-devel to volunteer.

About XEE

For more information on XEE see owasp articles on XML External Entity Processing and XML External Entity Attack provided to geoserver-devel by Johannes Kröger.

Responsible Disclosure

If you encounter a security vulnerability in GeoServer, or any other open source software, please take care to report the issue in a responsible fashion:

• Keep exploit details out of issue report (send to developer/PSC privately - just like you would do for sensitive sample data)

• Be prepared to work with Project Steering Committee (PSC) members on a solution

• Keep in mind PSC members are volunteers and an extensive fix may require fundraising / resources

If you are not in position to communicate in public (or make use of the issue tracker) please consider commercial support, contacting a PSC member privately or contacting us via the Open Source Geospatial Foundation at info@osgeo.org.

We will be revising the GeoServer Developers Guide to clarify in the coming days.

The GeoServer team is pleased to announce the release of GeoServer 2.6.4. Download bundles are provided (bin, war, dmg and exe) along with documentation and extensions.

GeoServer 2.6.4 is a maintenance release of GeoServer recommended for production deployment. This release contains IMPORTANT SECURITY FIXES so please upgrade.

Thanks to everyone who took part by contributing fixes, new functionality, and documentation. Notable changes:

• SECURITY: Fixed a serious vulnerability that allowed arbitrary files on the server to be read by crafting a malicious WFS request

• SECURITY: Fixed a defect that permitted WPS service to continue to respond even when disabled

• Oracle JDBC driver (ojdbc14.jar) is no longer included with the Oracle plugin; ojdbc6.jar or ojdbc7.jar must be obtained from Oracle

• Vendor parameter to specify WMS GetMap interpolation method

• Dynamic raster styling with CQL expression support for color map entries

• User-defined variables in Freemarker templates

• Check the release notes for more details

• This release is made in conjunction with GeoTools 12.4 and GeoWebCache 1.6.2

Thanks to Ben Caradoc-Davies (Transient Software Limited) for this release. Thanks also to Kevin Smith (Boundless) for releasing GeoWebCache 1.6.2 and to Jody Garnett (Boundless) for building the GeoServer 2.6.4 DMG.

About GeoServer 2.6

Articles and resources for GeoServer 2.6 series:

• GeoServer at FOSS4G

  • State of GeoServer and GeoTools 2014 (slides)

• Raster Views in GeoServer via the CoverageView concept (GeoSolutions)

• Advanced Raster Projection in GeoServer (GeoSolutions)

• Supporting Wind Barbs In GeoServer and GeoTools (GeoSolutions)

• GeoServer now supports Vector Footprints for ImageMosaic (GeoSolutions)

• 2.6.3 announcement and change log

• 2.6.2 announcement

• 2.6.1 announcement

• 2.6.0 announcement

• 2.6-RC1 announcement

• 2.6-beta announcement

We are happy to announce the release of GeoServer 2.8-M0. Downloads are available (zip, war, dmg and exe) along with docs and extensions.

This is milestone release of GeoServer made in conjunction with GeoTools 14-M0.

We have both new features and a number of key “under the hood” changes to GeoServer. This technology preview is made available for your evaluation and feedback and is not intended for production.

Highlights from the release notes:

• JAI-Ext integration for geospatial specific image processing operations  (github), adding direct support for NODATA in raster sources

• Replacement of vecmath with EJML matrix library

• Importer improvements, dalwarp/gdal_translate/gdaladdo transformations and ability to add a granule to a mosaic

• Read/write PostGIS curve support

• GetMap support for by layer interpolation methods

• Stop shipping old Oracle JDBC driver

• Pretty print option for style REST API

• Allow environment variables to be used in freemarker template files

Also, looking at the GeoTools 14-M0 release notes, we have:

• Significant increase in GML 3.X encoding speed

• New projections supported: sinusoidal, gnomonic

• New extshape://arrow with parameters controlling its proportions

Thanks to Jody (Boundless) for pulling this release together.

About GeoServer 2.8

GeoServer 2.8 is scheduled for September release. For more information:

• JAI-Ext, the Open Source replacement for Oracle JAI (GeoSolutions)

We will add additional blog posts to this section as news is made available.