[pull] main from geoserver:main

.github/workflows/javadoc.yml

@@ -0,0 +1,49 @@
+name: Linux JDK 11 GitHub CI
+
+on:
+  pull_request:
+    paths-ignore:
+      - '**/src/main/resources/GeoServerApplication_*.properties'
+      - '!**/src/main/resources/GeoServerApplication_fr.properties'
+
+env:
+  MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=25 -Dmaven.wagon.http.retryHandler.count=3 -Xmx512m -Dorg.slf4j.simpleLogger.showDateTime=true -Dorg.slf4j.simpleLogger.dateTimeFormat=HH:mm:ss,SSS
+
+jobs:
+  javadoc:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-20.04
+            jdk: 11
+            dist: 'temurin'
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        # 500 commits, set to 0 to get all
+        fetch-depth: 500
+    - name: Set up JDK
+      uses: actions/setup-java@v2
+      with:
+        java-version: ${{ matrix.jdk }}
+        distribution: ${{ matrix.dist }}
+    - name: Set up Maven
+      uses: stCarolas/setup-maven@v4
+      with:
+        maven-version: 3.8.4
+    - name: Maven repository caching
+      uses: actions/cache@v2
+      with:
+        path: ~/.m2/repository
+        key: gs-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          gs-${{ runner.os }}-maven-
+    - name: Build with Maven
+      run: mvn -B -fae -Dspotless.apply.skip=true -f src/pom.xml  clean install -DskipTests
+    - name: Build aggregate javadocs
+      run: mvn -B -fae -Dspotless.apply.skip=true -f src/pom.xml javadoc:aggregate
+    - name: Remove SNAPSHOT jars from repository
+      run: |
+        find ~/.m2/repository -name "*SNAPSHOT*" -type d | xargs rm -rf {}
+

SECURITY.md

@@ -13,18 +13,46 @@ Each GeoServer release is supported with bug fixes for a year, with releases mad
 This approach provides ample time for upgrading ensuring you are always working with a supported GeoServer release.
 
 If your organisation is making use of a GeoServer version that is no longer in use by the community all is not lost.
-You can volunteer on the developer list to make additional releases, or engage with one of our [Commercial Support](http://geoserver.org/support/) providers.
+You can volunteer on the developer list to make additional releases, or engage with one of our
+[Commercial Support](http://geoserver.org/support/) providers.
 
 ## Reporting a Vulnerability
 
 If you encounter a security vulnerability in GeoServer please take care to report in a responsible fashion:
 
-* Keep exploit details out of mailing list and issue tracker
-* Send details to [email protected] which is monitored by volunteers
-* GitHub [security](https://github.com/geoserver/geoserver/security) page for *Private vulnerability reporting*
-* Be prepared to work with Project Steering Committee (PSC) members on a solution
-* Keep in mind PSC members are volunteers and an extensive fix may require fundraising / resources
+1. Keep exploit details out of public mailing lists and issue tracker.
 
-Please send a mail directly to [email protected] (moderated list with no possibility to subscribe, please just send directly to the address, the mail will be evaluated and eventually posted) and provide information about the security issue you might have found there.
+2. There are two options to report a security vulnerability:
+
+   * To report via email:
+
+     Please send an email directly to the volunteers on the private [email protected] mailing list.
+     Provide information about the security vulnerability you might have found in your email.
+
+     This is a moderated list: send directly to the address; your email will be moderated; and eventually shared with volunteers.
+
+   * To report via GitHub:
+
+     Navigate to [security](https://github.com/geoserver/geoserver/security) page, use link for *Private vulnerability reporting*.
+
+     For more information see [GitHub documentation](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+
+3. There is no expected response time. Be prepared to work with geoserver-security email list volunteers on a solution.
+
+4. Keep in mind participants are volunteering their time, an extensive fix may require fundraising/resources.
 
 For more information see [Community Support](http://geoserver.org/comm/).
+
+## Coordinated vulnerability disclosure
+
+Disclosure policy:
+
+1. The reported vulnerability has been verified by working with the geoserver-security list
+2. GitHub [security advisory](https://github.com/geoserver/geoserver/security) is used to reserve a CVE number
+3. A fix or documentation clarification is accepted and backported to both the "stable" and "maintenance" branches
+4. A fix is included for the "stable" and "maintenance" downloads ([released as scheduled](https://github.com/geoserver/geoserver/wiki/Release-Schedule), or issued via emergency update)
+6. The CVE vulnerability is published with mitigation and patch instructions
+
+This represents a balance between transparency and particpation that does not overwhelm particpants. 
+Those seeking greater visibility are encouraged to volunteer with the geoserver-security list;
+or work with one of the [commercial support providers](https://geoserver.org/support/) who participate on behalf of their customers.

build/rename.xml

@@ -6,8 +6,8 @@
     ant -f release.xml -Dcurrent=2.17 -Drelease=2.18
   -->
   <tstamp/>
-  <property name="current" value="2.23"/>
-  <property name="release" value="2.24"/>
+  <property name="current" value="2.24"/>
+  <property name="release" value="2.25"/>
 
   <target name="test">
      <echo>current: ${current}</echo>
@@ -32,8 +32,8 @@
     </replace>
     <replace dir="..">
       <include name="src/pom.xml"/>
-      <replacefilter token="29-SNAPSHOT" value="30-SNAPSHOT"/>
-      <replacefilter token="1.23-SNAPSHOT" value="1.24-SNAPSHOT"/>
+      <replacefilter token="30-SNAPSHOT" value="31-SNAPSHOT"/>
+      <replacefilter token="1.24-SNAPSHOT" value="1.25-SNAPSHOT"/>
     </replace>
   </target>
 

doc/en/build.xml

@@ -37,7 +37,7 @@
       <isset property="build.directory" />
     </condition>
 
-    <condition property="project.version" value="${project.version}" else="2.24-SNAPSHOT">
+    <condition property="project.version" value="${project.version}" else="2.25-SNAPSHOT">
       <isset property="project.version" />
     </condition>
 

doc/en/developer/source/conf.py

@@ -48,17 +48,17 @@
 # other places throughout the built documents.
 #
 # The short X.Y version.
-version = '2.24'
+version = '2.25'
 
 # The full version, including alpha/beta/rc tags.
-release = '2.24-SNAPSHOT'
+release = '2.25-SNAPSHOT'
 
 # Used in build and documentation links
-branch = '2.24.x'
+branch = '2.25.x'
 
 # Users don't need to see the "SNAPSHOT" notation when it's there
 if release.find('SNAPSHOT') != -1:
-   release = '2.24.x'
+   release = '2.25.x'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

doc/en/developer/source/programming-guide/ows-services/hello/pom.xml

@@ -8,7 +8,7 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/ma
 <parent>
     <groupId>org.geoserver</groupId>
     <artifactId>community</artifactId>
-    <version>2.24-SNAPSHOT</version> <!-- change this to the proper GeoServer version -->
+    <version>2.25-SNAPSHOT</version> <!-- change this to the proper GeoServer version -->
 </parent>  
 
 <groupId>org.geoserver</groupId>
@@ -22,7 +22,7 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/ma
     <dependency>
         <groupId>org.geoserver</groupId>
         <artifactId>gs-main</artifactId>
-        <version>2.24-SNAPSHOT</version> <!-- change this to the proper GeoServer version -->
+        <version>2.25-SNAPSHOT</version> <!-- change this to the proper GeoServer version -->
     </dependency>
 </dependencies>
 

doc/en/developer/source/quickstart/checkout.txt

@@ -16,7 +16,7 @@ Choose ``main`` for the latest development.::
 
   % git checkout main
 
-Or chose a stable branch for versions less likely to change often::
+Or choose a stable branch for versions less likely to change often::
 
   % git checkout 2.22.x
 

doc/en/developer/source/quickstart/eclipse.rst

@@ -35,7 +35,7 @@ Import modules into Eclipse
    .. image:: img/eclipse_import1.jpg
       :width: 300
 
-#. Select ``Existing Projects into Workspace`` and click ``Next``
+#. Select ``General``, ``Existing Projects into Workspace`` and click ``Next``.  (Do not make the mistake of importing ``Maven``, ``Existing Maven Projects``!)
 
    .. image:: img/eclipse_import2.jpg
       :width: 400
@@ -76,4 +76,4 @@ Access GeoServer front page
 ---------------------------
 
 * After a few seconds, GeoServer should be accessible at: `<http://localhost:8080/geoserver>`_
-* The default ``admin`` password is ``geoserver``.
+* The default ``admin`` password is ``geoserver``.

doc/en/developer/source/release-guide/index.rst

@@ -216,6 +216,8 @@ Download and try out some of the artifacts from the above location and do a
 quick smoke test that there are no issues. Engage other developers to help
 test on the developer list.
 
+It is important to test the artifacts using the minimum supported version of Java (currently Java 11 in September 2023).
+
 Publish the Release
 -------------------
 

doc/en/docguide/source/conf.py

@@ -48,12 +48,12 @@
 # other places throughout the built documents.
 #
 # The short X.Y version.
-version = '2.24'
+version = '2.25'
 # The full version, including alpha/beta/rc tags.
-release = '2.24-SNAPSHOT'
+release = '2.25-SNAPSHOT'
 # Users don't need to see the "SNAPSHOT" notation when it's there
 if release.find('SNAPSHOT') != -1:
-   release = '2.24.x'
+   release = '2.25.x'
 
 # There are two options for replacing |today|: either, you set today to some
 # non-false value, then it is used:

doc/en/pom.xml

@@ -4,7 +4,7 @@
   <modelVersion>4.0.0</modelVersion>
   <artifactId>gs-docs</artifactId>
   <groupId>org.geoserver.en</groupId>
-  <version>2.24-SNAPSHOT</version>
+  <version>2.25-SNAPSHOT</version>
   <packaging>pom</packaging>
   <name>GeoServer English Documentation</name>
   <description>GeoServer English documentation</description>

doc/en/user/source/community/opensearch-eo/STAC.rst

@@ -46,8 +46,8 @@ in the ``$GEOSERER_DATA_DIR/templates/ogc/stac`` folder:
 
 Specifically for the JSON output:
 
-* `$GEOSERER_DATA_DIR/templates/ogc/stac/collections.json` is the `collections template <https://raw.githubusercontent.com/geoserver/geoserver/main/src/community/oseo/oseo-stac/src/main/resources/org/geoserver/ogcapi/stac/collections.json>`_
-* `$GEOSERER_DATA_DIR/templates/ogc/stac/items.json` is the `items template <https://raw.githubusercontent.com/geoserver/geoserver/main/src/community/oseo/oseo-stac/src/main/resources/org/geoserver/ogcapi/stac/items.json>`_
+* `$GEOSERVER_DATA_DIR/templates/ogc/stac/v1/collections.json` is the `collections template <https://raw.githubusercontent.com/geoserver/geoserver/main/src/community/oseo/oseo-stac/src/main/resources/org/geoserver/ogcapi/v1/stac/collections.json>`_
+* `$GEOSERVER_DATA_DIR/templates/ogc/stac/v1/items.json` is the `items template <https://raw.githubusercontent.com/geoserver/geoserver/main/src/community/oseo/oseo-stac/src/main/resources/org/geoserver/ogcapi/v1/stac/items.json>`_
 
 The JSON templates in the case of STAC also drive database querying, the exposed STAC properties
 are back-mapped into database properties by interpreting the template. It is advised to keep 
@@ -76,3 +76,62 @@ According to the current specification:
 - If only exclude is specified, these attributes are subtracted from the union of the default set of attributes and the include attributes (set difference operation). This will result in an entity that is not a valid Item if any of the excluded attributes are in the default set of attributes, but no error message will be raised by GeoServer.
 - If a attribute is included, e.g. ``properties``, but one or more of the nested attributes is excluded, e.g. ``-properties.datetime``, then the excluded nested attributes will not appear in properties.
 - If an attribute is excluded, e.g. ``-properties.nestedObj``, but one of more of the nested attributes is included, e.g. ``properties.nestedObject.attribute``, then ``nestedObject`` will appear in the output with the included attributes only.
+
+Datacube Extension Support
+--------------------------
+Support for the `STAC Datacube Extension <https://github.com/stac-extensions/datacube>`_ "cube_dimensions" elements is available in HTML and JSON templates via the `eoSummaries` function.  `eoSummaries` supports presenting the following collection-wide summary statistics:
+
+* min - The minimum value of the field in the collection
+* max - The maximum value of the field in the collection
+* distinct - An array of distinct values of the field in the collection
+* bounds - Minimum and maximum dimension values of the spatial bounding box of the collection (either x or y, presented as a two value array)
+
+`eoSummaries` has three arguments:
+
+* aggregate - The type of summary statistic.  One of "min", "max", "distinct", or "bounds".
+* collectionIdentifier - The name of the collection that is being summarized.
+* property - The name of the property being summarized.  
+
+	* Note that for the "bounds" aggregate, this value should either be "x" or "y".
+
+**JSON Template Example**:
+
+.. code-block:: none
+
+	"cube:dimensions"\: {
+     "x": {
+      	"type": "spatial",
+      	"axis": "x",
+      	"extent": "$${eoSummaries('bounds',eop:parentIdentifier,'x')}",
+      	"reference_system": 4326},
+			"y": {
+     		"type": "spatial",
+     		"axis": "y",
+     		"extent": "$${eoSummaries('bounds',eop:parentIdentifier,'y')}",
+     		"reference_system": 4326},
+     		"time": 
+     			{"type": "temporal",
+     			"extent": 
+     				["$${eoSummaries('min',eop:parentIdentifier,'timeStart')}",
+     			"$${eoSummaries('min',eop:parentIdentifier,'timeEnd')}"]
+     			}
+     	}
+
+**HTML/FTL Example**:
+
+.. code-block:: none
+
+	<li><b>Extents</b>:
+	     <ul>
+        <li data-tid='gbounds'>Geographic (WGS84):
+					${model.eoSummaries("bounds",a.name.value,"x")[0]}, 
+					${model.eoSummaries("bounds",a.name.value,"y")[0]}, 
+					${model.eoSummaries("bounds",a.name.value,"x")[1]}, 
+					${model.eoSummaries("bounds",a.name.value,"y")[1]}.
+				</li>
+				<li data-tid='tbounds'>Temporal: 
+					${model.eoSummaries("min",a.name.value,"timeStart")}/
+					${model.eoSummaries("max",a.name.value,"timeEnd")}
+				</li> 
+			</ul>
+	</li>

doc/en/user/source/community/opensearch-eo/configuration.rst

@@ -19,6 +19,9 @@ Follow these steps:
 
 * Go into the "OS-EO" service configuration page and configure the "OpenSearch" store
 
+  * (Optional) You can also configure how long values will be cached for performance purposes for templates that require collection level aggregate statistics by adjusting the cache time to live duration and time units.
+
+
   .. figure:: images/service.png
 
 * Global Queryables (applicable to the STAC API to define queryable fields for all Collections) can be configured

doc/en/user/source/conf.py

@@ -48,7 +48,7 @@
 # other places throughout the built documents.
 #
 # The replacement |version| provides short X.Y version.
-version = '2.24'
+version = '2.25'
 
 # The relacement |release| provides the full version, including alpha/beta/rc tags.
 
@@ -58,7 +58,7 @@
 # check environmental variable to see if ant build.xml passed in project.version
 project_version = os.getenv("project.version")
 if project_version == None: 
-  release = '2.24-SNAPSHOT'
+  release = '2.25-SNAPSHOT'
 else:
   release = project_version
 
@@ -70,7 +70,7 @@
 if release.find('SNAPSHOT') != -1:
    tags.add('snapshot')
    download = version+'.x'
-   release = '2.24.x'
+   release = '2.25.x'
    latest = '-latest'
    download_release = 'https://build.geoserver.org/geoserver/'+branch+'/geoserver-'+version+'.x-latest-%s.zip'
    download_extension = 'https://build.geoserver.org/geoserver/'+branch+'/ext-latest/geoserver-'+version+'-SNAPSHOT-%s-plugin.zip'

doc/en/user/source/extensions/mapml/index.rst

@@ -6,6 +6,7 @@ MapML
 Map Markup Language (MapML) is a text-based format which allows map authors to encode map information as hypertext documents exchanged over the Uniform Interface of the Web. The format definition is still a work-in-progress by the Maps for HTML W3C Community Group, but various tools to work with the format already exist, including a Leaflet-based map viewer. For more information on MapML refer to the `Maps for HTML Community Group <https://maps4html.org/>`.
 
 The MapML module for GeoServer adds new MapML resources to access WMS and WFS services configured in Geoserver. The MapML modules includes support for styles, tiling, querying, sharding, and dimensions options for WMS layers, and also provides a MapML outputFormat for WMS GetFeatureInfo and WFS GetFeatures requests. See below for information on installing and configuring the MapML module.
+    .. warning:: The MapML extension performance is negatively affected by a recent upgrade to Spring in the GeoServer project.  This affects all versions since 2.22.0. To avoid serious performance penalty, please remove "text/.*" from the gzip filter <param-value> in your web.xml servlet configuration.
 
     .. warning:: MapML is an experimental proposed extension of HTML for the Web. The objective of the format is to standardize map, layer and feature semantics in HTML.  As the format progresses towards a Web standard, it may change.  Always use the latest version of this extension, and follow the project's progress at https://maps4html.org.
 

doc/en/user/source/production/config.rst

@@ -10,6 +10,15 @@ Logging may visibly affect the performance of your server. High logging levels a
 
 You can change the logging level in the :ref:`config_globalsettings_log_profile`.  You will want to choose the ``PRODUCTION`` logging configuration, where only problems are written to the log files.
 
+Logging configuration hardening
+-------------------------------
+
+For production systems, it is advised to set ``GEOSERVER_LOG_LOCATION`` parameter during startup. The value may be defined as either an environment variable, java system property, or servlet context parameter.
+
+The location set for ``GEOSERVER_LOG_LOCATION`` has priority, causing the value provided using the Admin Console GUI or REST API to be ignored. This approach establishes a separation of responsibility between those setting up and controlling the actual machine, and those configuring the GeoServer application.
+
+See :ref:`logging` for more information.
+
 Set a service strategy
 ----------------------
 

doc/zhCN/pom.xml

@@ -4,7 +4,7 @@
   <modelVersion>4.0.0</modelVersion>
   <artifactId>gs-docs</artifactId>
   <groupId>org.geoserver.en</groupId>
-  <version>2.24-SNAPSHOT</version>
+  <version>2.25-SNAPSHOT</version>
   <packaging>pom</packaging>
   <name>GeoServer Chinese Simplified Documentation</name>
   <description>GeoServer Chinese Simplified documentation</description>

src/community/app-schema/pom.xml

@@ -12,7 +12,7 @@
     <parent>
         <groupId>org.geoserver</groupId>
         <artifactId>community</artifactId>
-        <version>2.24-SNAPSHOT</version>
+        <version>2.25-SNAPSHOT</version>
     </parent>
 
     <groupId>org.geoserver.community</groupId>

src/community/app-schema/webservice-test/pom.xml

@@ -12,7 +12,7 @@
     <parent>
         <groupId>org.geoserver.community</groupId>
         <artifactId>gs-app-schema-community</artifactId>
-        <version>2.24-SNAPSHOT</version>
+        <version>2.25-SNAPSHOT</version>
     </parent>
 
     <groupId>org.geoserver.community</groupId>