GeoServer releases security update 2.28.5 and 3.0-RC

GeoServer has announced two significant software updates: the maintenance release of version 2.28.5 and the release candidate for version 3.0.

Version 2.28.5 is an urgent maintenance update for production systems. It addresses a high-severity unauthenticated SQL injection vulnerability in the jsonArrayContains filter function against PostGIS layers. This release is developed alongside GeoTools 34.5 and GeoWebCache 1.28.5.

Simultaneously, GeoServer 3.0-RC has been released for public review and feedback. This release candidate introduces a new user interface and supports deployment on Tomcat 11 and Jetty 12. The update also includes GeoServer Cloud 3.0.0-RC, which offers cloud-native microservices deployments via Kubernetes. The 3.0 series aims to provide a seamless upgrade path from the 2.28.x versions.