Release notes - GeoServer - 2.28.1
Bug
GEOS-4159 Layer from SQL view feature type details not refreshing after editing sql query (and refreshing attributes there)
GEOS-11921 CVE-2025-21621 Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format (Moderate)
GEOS-11922 CVE-2025-58360 Unauthenticated XXE via WMS GetMap
GEOS-11930 OGC-API extension breaks security REST API
GEOS-11963 BlobStorePage breaks when failing to save a blob store configuration
GEOS-11965 KMZ export incorrectly references remote icon URLs instead of embedding them in the KMZ archive
GEOS-11981 POST /security/authproviders | 400: Unsupported className
GEOS-11983 GSR /query fails with HTTP 500 when where parameter is empty
GEOS-11988 Fix bug: preserve metaTilingThreads=0 in saneConfig()
Improvement
GEOS-11950 WMS cascade: fully respect ‘restrict to layer bounds’ flag on GetMap requests
GEOS-11961 OSEO layer management: Support creation of image mosaics in CRS other than 4326
GEOS-11980 Add support for uploading a single parquet file to GeoServer via REST
New Feature
GEOS-11959 New community module GeoWebCache Google Cloud Storage
Task
GEOS-11898 GeoFence: issues in evaluation of virtual layer services access
GEOS-11962 Run CITE tests against Java 17, 21 and 25
GEOS-11987 ImageN 0.9.1 migration requires renaming of registryFile.jai to registryFile.imagen