LoginSign Up
← Back to all sparks
G

GeoServer

DEVOPS
Velocity0.0

Server for sharing and editing geospatial data

geoserver.org ↗

GeoServer 3.0 breaks the monolith into extensions and adds DuckDB and GeoParquet paths.

geospatialmodularizationogc-apiextensionsgeoparquetauthentication
◆Current state
GeoServer cut 3.0.0 in June after maintaining 2.27.x and 2.28.x in parallel through the first half of the year. The major release is structural rather than feature-led: KML, WCS 1.0 and 1.1 move out to extensions, arcgrid and worldimage become plugins, WMS 1.1 and 1.3 are split, WMS is made independent of WFS, and H2 is removed from the product and the test suite entirely. New data paths arrive as community modules — a DuckDB datastore and single-file GeoParquet upload via REST — and OIDC is promoted from community module to supported extension.
◆Where it's heading
Two directions are legible. The core is being reduced to what every deployment needs, with everything else pushed to extensions and plugins, which is the standard fix for a server that has accumulated two decades of optional protocol support. Separately, the OGC API surface is where the ongoing functional work is: Processes gained envelope inputs, multiple raw responses, pagination, correct incomplete-execution errors and an Echo process across these releases, while the older WFS/WMS work is mostly bug fixing. The 2.28.x line continues to receive the same fixes, so the branches have not diverged in behaviour yet.
◆Prediction
Expect the DuckDB and GeoParquet modules to be the ones promoted next, following the path OIDC just took from community to extension, and expect 3.0.x to spend its early point releases on fallout from the H2 removal and the extension split. Continued OGC API Processes work is the safest bet in the functional roadmap.

◆Recent moves

  1. 1mo ago

    GeoServer 3.0 splits the core into extensions and drops H2

    ⚡ SPARK

    The release where GeoServer stops shipping everything in one artifact: protocol modules move out to extensions and plugins, H2 leaves the product and the tests, and the new data paths (DuckDB, GeoParquet) arrive as community modules rather than core features. It sets the pattern the 2.x maintenance releases have been holding steady for.

    View source ↗
  2. 2mo ago

    2.28.4 fixes an XXE vulnerability and adds per-version service toggles

    Patches the features-templating XXE (CVE-2025-23043) and fixes workspace styles not persisting after a restore, alongside the ability to disable specific OGC service versions and LDAP TLS pooling fixes. The service-version toggle is a small piece of the same surface-reduction thinking that drives 3.0.

    View source ↗
  3. 5mo ago

    2.28.2 adds STAC security and REST ingestion for VectorMosaic

    Security for the STAC and OpenSearch for EO endpoints, REST ingestion of vector datasets into VectorMosaic, and AWS credential-chain authentication for GeoParquet. The GeoParquet credential work here is the first visible step toward the columnar data paths that land properly in 3.0.

    View source ↗
  4. 5mo ago

    2.27.5 adds custom CRS authorities and MapBox tile metatiling

    A short maintenance release on the older branch: configurable custom CRS authorities and transformations, metatiling for MapBox vector tiles, and better developer logging. Confirms that 2.27.x is still receiving real improvements rather than security-only backports.

    View source ↗
  5. 7mo ago

    2.27.4 clears WFS, KMZ and security REST API bugs

    A bug-led release covering large XML POST bodies failing in WFS, KMZ exports referencing remote icons instead of embedding them, and the OGC-API extension breaking the security REST API. Several of these same issue IDs reappear in 2.28.x and 3.0.0, which is how this project ships fixes across all live branches.

    View source ↗