geoserver/geoserver-cloud v2.28.5.0

GeoServer Cloud 2.28.5.0

on GitHub

GeoServer Cloud 2.28.5.0 is a maintenance and security release of the release/2.28.x branch, built on GeoServer 2.28.5 and GeoTools 34.5. It brings the pgconfig backend and catalog cache fixes from main to the 2.28 series, along with the control-flow observability work and the GWC catalog integration for the REST API.

Security

This release ships GeoServer 2.28.5 / GeoTools 34.5, which address GHSA-mqjf-5f49-2fjh: a critical-severity, unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers with text or JSON columns. See the upstream announcement for details. All deployments serving data from PostGIS should upgrade.

New features

• Cross-pod ImageMosaic with no shared filesystem (pgconfig) (#888). REST-created ImageMosaic coverage stores with a PostGIS granule index now work on every pod of a pgconfig deployment, with mosaic config files stored in the config database through the configurable geoserver.backend.pgconfig.db-backed-file-patterns whitelist.
• Control-flow throttling metrics, dashboards, and per-service rules (#899). Control-flow figures are now exposed as Micrometer gauges on the Prometheus actuator endpoint: global running/blocked counts plus per-rule limit, running, waiting, active-queues, and rate gauges. The dev compose monitoring stack gains control-flow Grafana dashboards, control-flow rules are now configured per service with relaxed defaults, and the user guide gains a monitoring tutorial and a metrics reference.
• GWC catalog integration in the restconfig service (#916). Creating, renaming, moving, and deleting layers through the REST API now manages the corresponding GWC tile layers (fixes #519). The work also fixes cluster-consistency defects: stale tile-layer name caches after renames and removals on pgconfig, WMTS GetCapabilities breaking on not-yet-replicated layers, and replication windows failing tile layer adds.

Bug fixes

The pgconfig sync from main (#888) brings these fixes to the 2.28 series:

• Resource mtimes are now stamped and read in UTC. On any JVM or database session not running in UTC, resource mtimes drifted by the zone offset, corrupting every mtime comparison. Also fixes the move path, which never bumped the new parent directory's mtime.
• Catalog cache no longer leaks ModificationProxy instances. With catalog caching enabled, GetCapabilities on workspaces with many layers and data security rules failed intermittently with OptionalDataException, and a corrupted cache entry kept failing until evicted. Cached object graphs now hold raw objects only; proxy wrapping happens exclusively per retrieval.
• By-name lookups no longer cached under non-canonical keys. Unqualified getLayerByName/getStyleByName lookups cached an arbitrary pick among same-named objects across workspaces under a key no eviction could reach, producing persistent wrong-workspace or stale answers during bulk publishing.
• Ambiguous unqualified name lookups return the first match (originally #871, thanks @jurgispods, plus an ORDER BY id follow-up for deterministic results). WFS GetFeature against a workspace virtual service with an unqualified typeName threw a ClassCastException when the layer name existed in more than one workspace, diverging from the data dir backend's behavior.

And one fix backported on its own:

• Fixed a startup race on fresh databases that left every request denied with 403 (#894). The access rule DAOs could read their property files before the security/ directory existed, keeping an empty rule set until restart. The resource loader now creates the directory before any rule DAO loads.

Dependency upgrades

• GeoServer 2.28.5 / GeoTools 34.5 (#889, #919), including the security fix above
• Apache Wicket 9.23.0 (via #889)

Tests

• Expanded DiskQuota REST API integration test coverage: XML representation, globalQuota round-trips, method-not-allowed responses, and authentication checks (#863)

Full Changelog: v2.28.4.0...v2.28.5.0