LoginSign Up
← Back to all sparks
G

GeoServer

DEVOPS
Velocity5.0

Server for sharing and editing geospatial data

geoserver.org ↗

GeoServer patches three branches at once, with the new work reserved for the 3.0 line

geospatialmodularizationaccess-contrologc-apitile-cachingauthentication
◆Current state
Three releases landed within about an hour of each other — 2.27.6, 2.28.5 and 3.0.1 — the coordinated multi-branch pattern this project uses for maintenance. The shared payload is a set of security-adjacent fixes: a GeoFence SQL query missing its spatial filter when only CLIP applies, wrong CRS axis order when clipping WFS 2.0.0 features, and the XXE vulnerability in features-templating backported to the oldest branch. Only 3.0.1 carries new capability: a Keycloak role service and security-aware GeoWebCache tile caching.
◆Where it's heading
The branch split is doing what it is supposed to. The 2.x lines get fixes and nothing else, while the 3.0 line — which broke the monolith into extensions — is where authentication and cache-security work now lands. The recurring theme across all three is access control at the data layer: GeoFence filtering, secured feature sources, and now tile caching that respects security rather than serving from an unaware cache.
◆Prediction
Expect the next coordinated round to follow the same shape, with 3.0.2 taking further security-aware caching and identity-provider work while the 2.x branches receive only the shared fixes.

◆Recent moves

  1. 4d ago

    2.27.6 backports the XXE fix and workspace style persistence

    The oldest maintained branch gets the CVE-2025-23043 XXE fix in features-templating plus workspace styles failing to persist after restore. Pure backport — the smallest share of the three-branch round, as maintenance-only branches should be.

    View source ↗
  2. 4d ago

    2.28.5 fixes GeoFence spatial filtering and WFS clipping axis order

    The largest of the three: a GeoFence SQL query missing its spatial filter under CLIP-only rules, wrong CRS axis order when clipping WFS 2.0.0 features, and a startup hang when fileLockProvider is set. Access-control correctness fixes rather than new capability, consistent with a branch in maintenance.

    View source ↗
  3. 4d ago

    3.0.1 adds a Keycloak role service and security-aware tile caching

    The 3.0 line takes the same shared fixes plus the work the older branches do not get: a Keycloak role service, GSIP 241 security-aware GeoWebCache tile caching, and configurable seeder thread pools. It is the first patch after the modularization release and confirms where new work now lands.

    View source ↗
  4. 2mo ago

    GeoServer 3.0 splits the core into extensions and drops H2

    ⚡ SPARK

    The release where GeoServer stops shipping everything in one artifact: protocol modules move out to extensions and plugins, H2 leaves the product and the tests, and the new data paths (DuckDB, GeoParquet) arrive as community modules rather than core features. It sets the pattern the 2.x maintenance releases have been holding steady for.

    View source ↗
  5. 2mo ago

    2.28.4 fixes an XXE vulnerability and adds per-version service toggles

    The XXE fix in features-templating plus the ability to disable specific OGC service versions and expose the DiskQuota JDBC schema in the UI. Operator-facing control on a branch that otherwise takes only fixes.

    View source ↗
  6. 5mo ago

    2.28.2 adds STAC security and REST ingestion for VectorMosaic

    Security for STAC and OpenSearch for EO responses, plus vector dataset ingestion into VectorMosaic over REST. An earlier point in the same access-control arc the newest round continues.

    View source ↗