LoginSign Up
← Back to all sparks
G

GeoServer

DEVOPS
Velocity5.0

Server for sharing and editing geospatial data

geoserver.org ↗

GeoServer's October round is maintenance only: 3.0.2 fixes OGC API conformance and FIPS login.

geospatialogc apisecuritymulti-branch maintenanceopen source
◆Current state
GeoServer released 3.0.2 and 2.27.7 in mid-October. 3.0.2 fixes OGC API conformance URIs, FIPS-mode login, tiled layer creation and blob stores under containerd; 2.27.7 fixes backup deadlocks, tightens SLD URL validation and removes the gwc-sqlite community module. The August round had brought a Keycloak role service and security-aware tile caching to 3.0.1.
◆Where it's heading
The 3.0 line, which split the monolith into extensions, is now in patch mode, and the fixes point at deployment environments such as FIPS and containerd. The 2.x branches keep receiving security-adjacent fixes while modules are trimmed.
◆Prediction
Expect the next coordinated round on 3.0.x and 2.28.x/2.27.x to follow the same pattern; no new 3.x feature work is visible in the latest entries.

◆Recent moves

  1. 7d ago

    GeoServer 2.28.6

    A maintenance release that also carries real features: security-aware tile caching in GeoWebCache (GSIP 241), Azure SAS token auth for COG stores, single-tenant Entra ID login, and OIDC control of the built-in admin account. Fixes include WMTS multidimensional operations that ignored data security and a backup/restore deadlock.

    View source ↗
  2. 22d ago

    GeoServer 2.27.7

    A 2.27 maintenance release fixing backup deadlocks, tightening SLD URL validation and removing the gwc-sqlite community module.

    View source ↗
  3. 24d ago

    GeoServer 3.0.2

    A 3.0 patch fixing OGC API conformance URIs and toggles, FIPS-mode login, tiled layer creation and blob stores under containerd. Routine fixes for the new major.

    View source ↗
  4. 2mo ago

    2.27.6 backports the XXE fix and workspace style persistence

    The oldest maintained branch gets the CVE-2025-23043 XXE fix in features-templating plus workspace styles failing to persist after restore. Pure backport — the smallest share of the three-branch round, as maintenance-only branches should be.

    View source ↗
  5. 2mo ago

    2.28.5 fixes GeoFence spatial filtering and WFS clipping axis order

    The largest of the three: a GeoFence SQL query missing its spatial filter under CLIP-only rules, wrong CRS axis order when clipping WFS 2.0.0 features, and a startup hang when fileLockProvider is set. Access-control correctness fixes rather than new capability, consistent with a branch in maintenance.

    View source ↗
  6. 2mo ago

    3.0.1 adds a Keycloak role service and security-aware tile caching

    The 3.0 line takes the same shared fixes plus the work the older branches do not get: a Keycloak role service, GSIP 241 security-aware GeoWebCache tile caching, and configurable seeder thread pools. It is the first patch after the modularization release and confirms where new work now lands.

    View source ↗