GeoServer/GeoTools PMC Meeting at 18:30 CET / 9:30 PDT tomorrow

GeoServer GeoServer Developer
,
1

Reminder that the next PMC meeting is scheduled for tomorrow, August 25, at 18:30 CET.

Cheers,
Torben

2

GeoTools / GeoServer PMC meeting - 2026-08-25

Attending

  • Torben Barsballe
  • Gabriel Roldan
  • Peter Smythe
  • Pierre Mauduit
  • Alessandro Ricchiuti
  • Andrea Aime
  • Nuno Oliveira
  • Jukka Rahkonen
  • Jody Garnett

Actions from prior meetings:

  • Jody: Proposal to adopt maven standard (<major>.<minor>.<incremental>-<qualifier>) in GeoTools and GeoWebCache so projects are aligned.
  • Nuno: Proposal to amend release process

Agenda

  1. Releases management
    1. 2.28.x series maintenance
    2. 3.1.0 and associated announcements
  2. Build warnings and community modules
  3. Chit chat
  4. Hosting for old releases
  5. GeoServer Cloud and releases
  6. FOSS4G community sprint

Actions

  • gabe and jody: write a security / cra blog post
  • torben: propose migrating from SourceForge to downloads.osgeo.org

Releases management

The 0-day was assigned a CVE-2026-76904:

Discussion:

  • 2.28.x series maintenance
  • 3.1.0 and associated announcements?
    • no new features coming in, so not pressing need for this at present
    • energy better spent on on geoserver-security action
      (given recent 0-day action)

Discussion about keeping 2.28.x alive a bit longer since it is big jump to 3.0.x:

  • GeoSolutions offers to take on releases, if PSC can manage the backported of security fixes

Expectation:

  • We should expect to joint releases for a while due geoserver-security wave of AI reports

Build warnings and community modules

Jody noticing warnings and so on on 3.0.1:

  • please do not add repositories to the build in a community module
  • Jody updating repo.osgeo.org to cache apache releases

Chit chat

Seriously, how can we better support the geoserver-security efforts?

  • Jody pursuing some with OSGeo
    • See “geoserver membership program” so that PSC can be proactive, rather than reactive like GS3 project
    • Also “Project Support” committee to coordinate / set standards
  • If you are working on something please add yourself as “remediation developer” :slight_smile:

What is the present expectation for disclosure:

  • Industry moving to 90+30
    (researcher provides 90 days to see movement, extra 30 for release process)
    Although strong frustration to move to 60 or 45+20
  • Jody is annoyed at level of entitlement (these policies assume a vendor relationship)
  • Our present situation is:
    Report comes in, secure resources (hard when only trusted geoserver-security volunteers can see the issue),
    Then 60 days(two months for both stable and maintenance release)

What is happening with https://nlnet.nl/geocommons/ ?

  • Not sure, we need to check with OSGeo
  • It is the hope that this can fund some security process work:
    • GitHub Security Advisories was not able to keep up with CVE numbers (one or more months delays), perhaps OSGeo can provide CZVE Numbering Authority

CRA Reporting September 11th:

  • We would need to report the 0-day within 24 hours or something
  • Any supply chain issue (such as leaking publication credentials)
  • action: Jody and Gabe to discuss, we can write a blog post for GeoServer

Jody: https://github.com/geoserver/geoserver/wiki/GSIP-243 GeoServer Membership Program

  • stalled for now, while OSGeo sorts membership / tax implications

Hosting for old releases

We got an update on https://trac.osgeo.org/osgeo/ticket/3543, with download.osgeo.com offered as a hosting location.

  • Does this work for everyone? Do we want a GSIP (or perhaps an ML list topic to discuss?)
  • Do we want an entry on the index page, or are we fine to just link from our website?

Q: Can we mirror the same structure as SF (so docker and so on can use the new URL location)?
A: Yes

Q: Can we deploy new releases here rather than SF?
A: Yes! Do we need a small GSIP? Yeah, probably.

Q: Do we want to update our release pages + blog posts?
A: Use regex is fun

Q: Would the current SF artifacts be kept?
A: They want us to delete, so … no

GeoServer Cloud and releases

How is going gabe!

FOSS4G community sprint

Foss4g presentation:

  • We need some last moment updates for CVE-2026-76904,
    GeoServer Membership and so on, ..