diff --git a/conf.py b/conf.py index b5d60fdf684..8515ac71cc0 100644 --- a/conf.py +++ b/conf.py @@ -94,7 +94,7 @@ def __getattr__(cls, name): # The short X.Y version. version = '8.6' # The full version, including alpha/beta/rc tags. -release = '8.6.4' +release = '8.6.5' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. #language = None diff --git a/en/MIGRATION_GUIDE.txt b/en/MIGRATION_GUIDE.txt index 0b844b3b64e..417f1780659 100644 --- a/en/MIGRATION_GUIDE.txt +++ b/en/MIGRATION_GUIDE.txt @@ -22,6 +22,15 @@ MapServer Migration Guide MapServer 8.4 to 8.6 Migration ============================== +- The 8.6.5 release includes fixes for six vulnerabilities, see the advisories: + + - `OGCAPI Features support `__ advisory + - `WCS support `__ advisory + - `OpenLayers viewer with WMS `__ advisory + - `WMS GetLegendGraphic support `__ advisory + - `MySQL JOIN support `__ advisory + - `PostgreSQL JOIN support `__ advisory + - The 8.6.4 release includes fixes for two vulnerabilities, see the advisories: - `OpenLayers viewer with WMS `__ advisory diff --git a/en/announcements/announcements_archive.txt b/en/announcements/announcements_archive.txt index a427898a0d7..887c95bb955 100644 --- a/en/announcements/announcements_archive.txt +++ b/en/announcements/announcements_archive.txt @@ -4,6 +4,30 @@ MapServer Announcement Archives ***************************************************************************** +**2026-07-10 - MapServer 8.6.5 is released** + +.. important:: + Security release available + +The security release of MapServer 8.6.5 has been issued in order to fix +six vulnerabilities. See the :ref:`changelog ` +for the list of changes. +You may also review the security advisories for this release: + +1. `OGCAPI Features support `__ advisory +2. `WCS support `__ advisory +3. `OpenLayers viewer with WMS `__ advisory +4. `WMS GetLegendGraphic support `__ advisory +5. `MySQL JOIN support `__ advisory +6. `PostgreSQL JOIN support `__ advisory + +You may also review MapServer's `Security Policy `__. +As security for the 7.6 branch has ended, and branches 8.4, 8.2 & 8.0 are not supported, +all users are strongly encouraged to upgrade to the MapServer 8.6.5 release (see the +:ref:`Migration Guide `). + +Head to :ref:`download` to obtain a copy. + **2026-06-01 - MapServer 8.6.4 is released** .. important:: diff --git a/en/development/changelog/changelog-8-6.txt b/en/development/changelog/changelog-8-6.txt index 6b9c566aab6..949ecb80cca 100644 --- a/en/development/changelog/changelog-8-6.txt +++ b/en/development/changelog/changelog-8-6.txt @@ -7,6 +7,31 @@ The summary of major changes for this release can be found in the `HISTORY.md `__ file from the source directory. +.. _changelog-8-6-5: + +Changes from 8.6.4 to 8.6.5 +=========================== + +.. important:: + Security release + +* OGC API Features: validate offset before rendering to fix reflected XSS (GHSA-288j-mhpj-gmmr) ( `#7573 `__ ) (Philip G.) : `47720e8 `__ +* msautotest fix for branch-8-6 ( `#7572 `__ ) (Jeff McKenna) : `9ecef16 `__ +* msSLDParseSLD(): limit depth to 256 ( `#7570 `__ ) (github-actions[bot]) : `df9ab37 `__ +* WMS: GetLegendGraphic: avoid potential write heap buffer overflow via repeated LAYER parameters ( `#7569 `__ ) (github-actions[bot]) : `a7d5eb8 `__ +* WCS Post request: avoid nullptr deref on missing 'crs' attribute in BoundingBox ( `#7568 `__ ) (github-actions[bot]) : `debd347 `__ +* msMySQLJoinNext(): prevent SQL injection ( `#7567 `__ ) (github-actions[bot]) : `f4f9505 `__ +* msPOSTGRESQLJoinNext(): avoid potential SQL injection ( `#7566 `__ ) (github-actions[bot]) : `05babb8 `__ +* reject flatgeobuf feature on property decode error and add bounds test (Naveed) : `c84e116 `__ +* bound property value reads to buffer size in flatgeobuf decode (Naveed) : `972b769 `__ +* Python mapscript: no longer use Python 2 functions whose compatibility layer has been removed in SWIG master 4.5dev (Even Rouault) : `2df008d `__ +* WMS OpenLayers output: escape angle brackets in mapserv_onlineresource (MarkLee131) : `57a5d59 `__ +* bound quadtree shape ids to the shapefile record count (Naveed) : `b93c185 `__ +* bound gif palette index reads to the color table size ( `#7551 `__ ) (github-actions[bot]) : `ca4d255 `__ +* Fix memory leak on param handling ( `#7548 `__ ) (github-actions[bot]) : `55f9081 `__ +* Set OpenLayers resolution on CGI output maps ( `#7536 `__ ) (github-actions[bot]) : `6193da1 `__ +* Fix SLD generation when using string operators such as `le` ( `#7523 `__ ) (github-actions[bot]) : `e23eda2 `__ + .. _changelog-8-6-4: Changes from 8.6.3 to 8.6.4 diff --git a/en/download.txt b/en/download.txt index 78878d83ed3..fb488693651 100644 --- a/en/download.txt +++ b/en/download.txt @@ -18,7 +18,7 @@ Current Release(s) * MapServer - * **2026-06-01** MapServer-8.6.4 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` + * **2026-07-10** MapServer-8.6.5 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2025-09-19** MapServer-8.4.1 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2024-09-02** MapServer-8.2.2 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2024-06-11** MapServer-8.0.2 `tar.gz `__ | :ref:`Changelog ` diff --git a/en/download_archives.txt b/en/download_archives.txt index 76522e0c071..37d10daea4b 100644 --- a/en/download_archives.txt +++ b/en/download_archives.txt @@ -15,6 +15,8 @@ Past Releases .............................................................................. +* **2026-07-10** MapServer-8.6.5 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` + * **2026-06-01** MapServer-8.6.4 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2026-05-07** MapServer-8.6.3 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` diff --git a/en/include/announcements.inc b/en/include/announcements.inc index 3e7df21767a..bc107efc913 100644 --- a/en/include/announcements.inc +++ b/en/include/announcements.inc @@ -1,3 +1,27 @@ +**2026-07-10 - MapServer 8.6.5 is released** + +.. important:: + Security release available + +The security release of MapServer 8.6.5 has been issued in order to fix +six vulnerabilities. See the :ref:`changelog ` +for the list of changes. +You may also review the security advisories for this release: + +1. `OGCAPI Features support `__ advisory +2. `WCS support `__ advisory +3. `OpenLayers viewer with WMS `__ advisory +4. `WMS GetLegendGraphic support `__ advisory +5. `MySQL JOIN support `__ advisory +6. `PostgreSQL JOIN support `__ advisory + +You may also review MapServer's `Security Policy `__. +As security for the 7.6 branch has ended, and branches 8.4, 8.2 & 8.0 are not supported, +all users are strongly encouraged to upgrade to the MapServer 8.6.5 release (see the +:ref:`Migration Guide `). + +Head to :ref:`download` to obtain a copy. + **2026-06-01 - MapServer 8.6.4 is released** .. important:: @@ -124,21 +148,3 @@ the MapCache :ref:`changelog ` and TinyOWS :ref:`changelog `. Head to :ref:`download` to obtain a copy. - -**2024-07-21 - MapServer 8.2.1, 7.6.7 are released** - -Several maintenance releases of MapServer have been issued in order to fix -a security flaw for the tostring() expression function. -See the :ref:`8.2.1 changelog `, -:ref:`7.6.7 changelog ` for the list of changes. You -may also review MapServer's `Security Policy `__. - -Head to :ref:`download` to obtain a copy. - -**2024-07-08 - MapServer 8.2.0 is released** - -The major version MapServer 8.2 has been released. The list of -major changes for this release can be found in the :ref:`8.2 announcement `. -See the :ref:`changelog ` -for the full list of changes and head to :ref:`download` to obtain a copy. - diff --git a/en/spelling_wordlist.dict b/en/spelling_wordlist.dict index a916ea0289f..6d4506a3bf0 100644 --- a/en/spelling_wordlist.dict +++ b/en/spelling_wordlist.dict @@ -97,6 +97,7 @@ dev distro dll dlls +documenters documentroot downsample downsampled @@ -141,6 +142,7 @@ GDAL gdaladdo gdalinfo gdaltindex +gdalwarp generalised geo geobbox @@ -241,6 +243,7 @@ labelLeaderObj labelled labelling labelObj +landsat lat latlon latlong @@ -269,6 +272,7 @@ linter linters linux listserv +LLM localhost logfile lon @@ -293,6 +297,7 @@ mapscripts mapserv mapserver MapServer +mapxy maxfeatures maxscale maxscaledenom @@ -575,6 +580,7 @@ uncommenting uncompress unencrypted unix +unmerged unprojected unreferenced untiled