Docs / Release Notes / GeoServer 2.29.0
🔍 ⌘K
Latest Release

GeoServer 2.29.0 Release Notes

📅 January 15, 2025
⏱️ 6 months since 2.28.0
📦 Version 2.29.0
🔨 Build #1203

This release introduces major improvements to vector tile rendering, WFS 3.0 compliance, and performance optimizations for large-scale map rendering. Highlights include new GeoJSON+MVT support, enhanced security defaults, and a rewritten Web Administration Interface.

127
Total Changes
23
New Features
48
Bug Fixes
5
Breaking Changes
📦 Installation 
# Docker
$ docker pull ghcr.io/geoserver/geoserver:2.29.0

# Download WAR
$ wget https://repo.geoserver.org/release/2.29.0/geoserver-2.29.0-war.zip

# System Package
$ apt-get install geoserver=2.29.0
⚠️ Breaking Changes 5
⚠️ Action Required

The following changes may require updates to your configuration or client applications. Please review carefully before upgrading.

  • Default CSRF protection is now enabled for all REST API endpoints. Clients must include X-Geoserver-Request header.
  • Minimum Java version increased from 11 to 17.
  • Default namespace changed from http://www.openplans.org to http://geoserver.org.
CSRF Protection Enabled by Default Breaking
Cross-Site Request Forgery protection is now enabled by default for all WMS and REST API endpoints. Existing clients sending POST requests without the X-Geoserver-Request header will receive 403 Forbidden responses. To disable (not recommended), set CSRF_DISABLED=true in the environment.
🔗 GEOS-11452 👤 @dmazzoni Jan 2, 2025
Java 17 Now Required Breaking
GeoServer 2.29.0 requires Java 17 or higher. Java 11 is no longer supported. This aligns with the industry standard and enables use of modern Java features including sealed classes and pattern matching.
🔗 GEOS-11398 👤 @ian_turton Dec 10, 2024
Default Namespace Updated Breaking
The default namespace URI has changed from http://www.openplans.org to http://geoserver.org. Layers created under the old namespace will still work but will show a migration warning in the admin console.
🔗 GEOS-11501 👤 @acuster Jan 8, 2025
Deprecated mapContext Parameter Removed Breaking
The legacy mapContext parameter in WMS GetMap requests has been removed. Use MAPFILE or STYLES instead. This parameter was deprecated in version 2.24.0.
🔗 GEOS-11389 👤 @dano Nov 22, 2024
WCS 1.0 Endpoint Disabled by Default Breaking
The WCS 1.0 endpoint is now disabled by default due to security vulnerabilities in the protocol. WCS 1.1.1 and 2.0 remain available. Re-enable via Global Settings if required.
🔗 GEOS-11477 👤 @carbog Dec 18, 2024
🔀 Migration Guide from 2.28.x

When upgrading from GeoServer 2.28.x to 2.29.0, follow these steps:

# 1. Backup your data directory
$ cp -r /usr/share/geoserver/data_dir /backup/geoserver_data_2.28

# 2. Update environment variables
$ export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
$ export CSRF_DISABLED=false

# 3. Apply the namespace migration script
$ java -jar geoserver-2.29.0.jar --migrate-namespace

# 4. Restart the service
$ systemctl restart geoserver
✨ New Features 23
Vector Tile MVT Export with GeoJSON Fallback Feature
Full Mapbox Vector Tile (MVT) rendering pipeline with automatic fallback to GeoJSON for clients that don't support Protocol Buffers. Supports tile sizes from 256 to 1024 pixels with configurable zoom levels (0–22).
🔗 GEOS-11510 👤 @emolitor Jan 5, 2025
WFS 3.0 Full Compliance Feature
Complete OGC WFS 3.0 (Web Feature Service 3.0) implementation with landing page, collection enumeration, item query, and native encoding support. Fully backward-compatible with WFS 2.0 clients.
🔗 GEOS-11423 👤 @mbedward Dec 5, 2024
Web Admin Interface Redesign Feature
Completely rewritten Web Admin UI using a modern component framework. Features include dark mode, live search across layers, drag-and-drop style builder, real-time preview, and keyboard navigation support. Legacy UI still available via ?classic=true.
🔗 GEOS-11380 👤 @dibiasi Nov 15, 2024
3D TileSet (3DTILES) Support Feature
Native 3D Tiles streaming for integration with Cesium and other 3D GIS platforms. Supports point cloud, batched 3D models (B3DM), and implicit tiling for massive datasets.
🔗 GEOS-11498 👤 @jsack Dec 22, 2024
Raster Pyramid with Overviews Feature
Automatic pyramid generation for large raster datasets with configurable overview levels. Supports JPEG, PNG, WebP, and Cloud-Optimized GeoTIFF (COG) formats with on-the-fly compression.
🔗 GEOS-11534 👤 @tbengtson Jan 10, 2025
OAuth2 OpenID Connect Authentication Feature
Built-in OAuth2/OIDC provider integration for enterprise SSO. Supports Keycloak, Auth0, Azure AD, and any standard OIDC provider with automatic group synchronization.
🔗 GEOS-11412 👤 @acabassa Dec 1, 2024
Feature Service Versioning Feature
Versioned WFS transactions with VERSION parameter support. Track changes to feature layers with automatic history, rollback, and branching capabilities.
🔗 GEOS-11467 👤 @carog Dec 14, 2024
🐛 Bug Fixes 48
Fixed Memory Leak in WMS GetFeatureInfo Fix
Resolved a persistent memory leak when processing high-volume GetFeatureInfo requests with large bounding boxes. Garbage collection now properly releases temporary geometry objects.
🔗 GEOS-11520 👤 @dmazzoni Jan 3, 2025
Fixed EPSG:3857 Coordinate Precision Fix
Corrected floating-point precision issues in Web Mercator (EPSG:3857) transformations that caused sub-pixel rendering artifacts at high zoom levels (z > 14).
🔗 GEOS-11493 👤 @emolitor Dec 28, 2024
Fixed Concurrent Layer Lock Deadlock Fix
Resolved a deadlock condition in the layer configuration service when multiple admin users edited different layers simultaneously. Implemented fine-grained per-layer locking instead of global lock.
🔗 GEOS-11478 👤 @dano Dec 19, 2024
Fixed PostGIS GEOMETRY Collection WFS Output Fix
Corrected WFS GetFeature responses for PostGIS layers containing GEOMETRYCOLLECTION types. Previously returned malformed GML 3.2 for mixed geometry collections.
🔗 GEOS-11505 👤 @acuster Jan 7, 2025
🚀 Improvements 32
WMS Render Performance +40% for Large Layers Improvement
Rewrote the spatial index lookup path for vector layers with >100K features. New hybrid R-tree + Z-order curve indexing reduces average GetMap response time by 40% and memory usage by 25%.
🔗 GEOS-11440 👤 @jsack Dec 8, 2024
Disk Cache Format Optimized Improvement
New tile cache storage format reduces disk usage by up to 35% for PNG tiles while maintaining identical visual quality. Legacy tiles are automatically migrated on first access.
🔗 GEOS-11455 👤 @mbedward Dec 11, 2024
Startup Time Reduced to 12 Seconds Improvement
Lazy-loaded plugin initialization and parallelized workspace scanning reduced cold start time from ~45 seconds to ~12 seconds on typical deployments with 20+ workspaces.
🔗 GEOS-11395 👤 @ian_turton Nov 28, 2024
REST API Response Compression Improvement
Automatic Brotli and gzip compression for all REST API responses. Average payload sizes reduced by 60–80% for XML/JSON responses.
🔗 GEOS-11471 👤 @dibiasi Dec 16, 2024
📢 Deprecations 3
WMS GetMap format=image/gif Deprecated Deprecation
GIF output format in WMS GetMap is deprecated and will be removed in version 2.31.0. Use image/png or image/webp instead. A deprecation warning is logged to the console.
🔗 GEOS-11518 👤 @carog Jan 6, 2025
GeoServerExtension API Deprecated Deprecation
The legacy GeoServerExtension plugin interface is deprecated. Migrate to the new GeoServerPlugin SPI-based interface for better lifecycle management and DI support.
🔗 GEOS-11487 👤 @dmazzoni Dec 26, 2024
WMS 1.1.1 FORMAT_OPTIONS Deprecated Deprecation
The FORMAT_OPTIONS parameter in WMS 1.1.1 is deprecated. Use the WMS 1.3.0 FORMAT_OPTIONS syntax instead for forward compatibility.
🔗 GEOS-11470 👤 @mbedward Dec 15, 2024
🔒 Security Fixes 4
CVE-2025-0012 — WFS Injection Vulnerability Security
Critical: Fixed an XML External Entity (XXE) injection vulnerability in WFS 2.0 feature type parsing that could allow server-side request forgery. CVE-2025-0012. CVSS Score: 9.1.
🔗 CVE-2025-0012 👤 Security Team Jan 14, 2025
CVE-2025-0013 — WMS GetMap Resource Exhaustion Security
High: Mitigated a resource exhaustion attack via maliciously crafted WMS GetMap requests with extremely small bounding boxes. New rate limiting and request validation prevents the attack vector. CVSS Score: 7.5.
🔗 CVE-2025-0013 👤 Security Team Jan 14, 2025
CVE-2025-0014 — REST API Privilege Escalation Security
Medium: Fixed a privilege escalation issue in the REST API where users with Layer role could modify global security settings via crafted PUT requests to the security config endpoint. CVSS Score: 6.5.
🔗 CVE-2025-0014 👤 Security Team Jan 14, 2025
Dependency: Updated Log4j 2.24.3 Security
Updated Log4j dependency to version 2.24.3 addressing recently disclosed vulnerabilities in the logging framework.
🔗 GEOS-11545 👤 @acuster Jan 12, 2025
👥 Contributors

This release was made possible by 47 contributors. Thank you!

DM
@dmazzoni
IT
@ian_turton
AC
@acuster
MB
@mbedward
CA
@carog
EM
@emolitor
JS
@jsack
DA
@dano
DB
@dibiasi
AK
@acabassa
TK
@tbengtson
MK
@mollyk
+
+35 more
📄 Full Changelog

Complete list of all 127 changes committed for this release, sorted by date.

ID Type Summary Date
GEOS-11545 Security Updated Log4j dependency to 2.24.3 Jan 12
GEOS-11542 Feature STAC Connector plugin added Jan 11
GEOS-11534 Feature Raster pyramid with overviews Jan 10
GEOS-11520 Fix Memory leak in GetFeatureInfo resolved Jan 3
GEOS-11518 Deprecation GIF WMS output deprecated Jan 6
GEOS-11510 Feature MVT vector tile export with GeoJSON fallback Jan 5
... ... 121 more entries ...
View All 127 Changes →
← GeoServer 2.28.2 GeoServer 2.29.1-beta →
On this page
⚠️ Breaking Changes ✨ New Features 🐛 Bug Fixes 🚀 Improvements 📢 Deprecations 🔒 Security Fixes 👥 Contributors 📄 Full Changelog