update for 8.6.5 release [build_translations]

conf.py

@@ -94,7 +94,7 @@ def __getattr__(cls, name):
 # The short X.Y version.
 version = '8.6'
 # The full version, including alpha/beta/rc tags.
-release = '8.6.4'
+release = '8.6.5'
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
 #language = None

en/MIGRATION_GUIDE.txt

@@ -22,6 +22,15 @@ MapServer Migration Guide
 MapServer 8.4 to 8.6 Migration
 ==============================
 
+- The 8.6.5 release includes fixes for six vulnerabilities, see the advisories:
+
+  - `OGCAPI Features support <https://github.com/MapServer/MapServer/security/advisories/GHSA-288j-mhpj-gmmr>`__ advisory
+  - `WCS support <https://github.com/MapServer/MapServer/security/advisories/GHSA-35qh-49hm-5rcx>`__ advisory
+  - `OpenLayers viewer with WMS <https://github.com/MapServer/MapServer/security/advisories/GHSA-52rr-p4x5-2x6x>`__ advisory
+  - `WMS GetLegendGraphic support <https://github.com/MapServer/MapServer/security/advisories/GHSA-4mwc-qc95-5959>`__ advisory
+  - `MySQL JOIN support <https://github.com/MapServer/MapServer/security/advisories/GHSA-7624-4mwh-9cxr>`__ advisory
+  - `PostgreSQL JOIN support <https://github.com/MapServer/MapServer/security/advisories/GHSA-m3xh-ccmh-x8rw>`__ advisory
+
 - The 8.6.4 release includes fixes for two vulnerabilities, see the advisories:
 
   - `OpenLayers viewer with WMS <https://github.com/MapServer/MapServer/security/advisories/GHSA-xqj6-vjqr-33vv>`__ advisory

en/announcements/announcements_archive.txt

@@ -4,6 +4,30 @@
  MapServer Announcement Archives
 *****************************************************************************
 
+**2026-07-10 - MapServer 8.6.5 is released**
+
+.. important::  
+   Security release available
+
+The security release of MapServer 8.6.5 has been issued in order to fix
+six vulnerabilities. See the :ref:`changelog <changelog-8-6-5>` 
+for the list of changes. 
+You may also review the security advisories for this release:
+
+1. `OGCAPI Features support <https://github.com/MapServer/MapServer/security/advisories/GHSA-288j-mhpj-gmmr>`__ advisory
+2. `WCS support <https://github.com/MapServer/MapServer/security/advisories/GHSA-35qh-49hm-5rcx>`__ advisory
+3. `OpenLayers viewer with WMS <https://github.com/MapServer/MapServer/security/advisories/GHSA-52rr-p4x5-2x6x>`__ advisory
+4. `WMS GetLegendGraphic support <https://github.com/MapServer/MapServer/security/advisories/GHSA-4mwc-qc95-5959>`__ advisory
+5. `MySQL JOIN support <https://github.com/MapServer/MapServer/security/advisories/GHSA-7624-4mwh-9cxr>`__ advisory
+6. `PostgreSQL JOIN support <https://github.com/MapServer/MapServer/security/advisories/GHSA-m3xh-ccmh-x8rw>`__ advisory
+
+You may also review MapServer's `Security Policy <https://github.com/MapServer/MapServer/blob/main/SECURITY.md>`__.
+As security for the 7.6 branch has ended, and branches 8.4, 8.2 & 8.0 are not supported, 
+all users are strongly encouraged to upgrade to the MapServer 8.6.5 release (see the 
+:ref:`Migration Guide <migration>`).
+
+Head to :ref:`download` to obtain a copy.
+
 **2026-06-01 - MapServer 8.6.4 is released**
 
 .. important::  

en/development/changelog/changelog-8-6.txt

@@ -7,6 +7,31 @@
 The summary of major changes for this release can be found in the `HISTORY.md <https://github.com/MapServer/MapServer/blob/branch-8-6/HISTORY.md>`__
 file from the source directory.
 
+.. _changelog-8-6-5:
+
+Changes from 8.6.4 to 8.6.5
+===========================
+
+.. important::  
+   Security release
+
+* OGC API Features: validate offset before rendering to fix reflected XSS (GHSA-288j-mhpj-gmmr) ( `#7573 <https://github.com/mapserver/mapserver/issues/7573>`__ ) (Philip G.) : `47720e8 <https://github.com/mapserver/mapserver/commit/47720e835de4d80a602210461d3b52c9f3d5c34c>`__
+* msautotest fix for branch-8-6 ( `#7572 <https://github.com/mapserver/mapserver/issues/7572>`__ ) (Jeff McKenna) : `9ecef16 <https://github.com/mapserver/mapserver/commit/9ecef167ebeafbee9a875cf912b39c0f570c96cd>`__
+* msSLDParseSLD(): limit depth to 256 ( `#7570 <https://github.com/mapserver/mapserver/issues/7570>`__ ) (github-actions[bot]) : `df9ab37 <https://github.com/mapserver/mapserver/commit/df9ab37ca376c4b2ffb0402ac081a9b7504e4517>`__
+* WMS: GetLegendGraphic: avoid potential write heap buffer overflow via repeated LAYER parameters ( `#7569 <https://github.com/mapserver/mapserver/issues/7569>`__ ) (github-actions[bot]) : `a7d5eb8 <https://github.com/mapserver/mapserver/commit/a7d5eb844a59ea076b7972a018753242f18e6f7b>`__
+* WCS Post request: avoid nullptr deref on missing 'crs' attribute in BoundingBox ( `#7568 <https://github.com/mapserver/mapserver/issues/7568>`__ ) (github-actions[bot]) : `debd347 <https://github.com/mapserver/mapserver/commit/debd347ae53caa4969f87fd9dae5ff73a42d48a0>`__
+* msMySQLJoinNext(): prevent SQL injection ( `#7567 <https://github.com/mapserver/mapserver/issues/7567>`__ ) (github-actions[bot]) : `f4f9505 <https://github.com/mapserver/mapserver/commit/f4f95059e2610d431e0b46d75d713cd52b84f64c>`__
+* msPOSTGRESQLJoinNext(): avoid potential SQL injection ( `#7566 <https://github.com/mapserver/mapserver/issues/7566>`__ ) (github-actions[bot]) : `05babb8 <https://github.com/mapserver/mapserver/commit/05babb88314b8f022eb47a3ab1a00eb37f92085f>`__
+* reject flatgeobuf feature on property decode error and add bounds test (Naveed) : `c84e116 <https://github.com/mapserver/mapserver/commit/c84e1160412377dd7b06ec864f8e2eacf74d1e35>`__
+* bound property value reads to buffer size in flatgeobuf decode (Naveed) : `972b769 <https://github.com/mapserver/mapserver/commit/972b769b799ae81216511a785e94192e66227726>`__
+* Python mapscript: no longer use Python 2 functions whose compatibility layer has been removed in SWIG master 4.5dev (Even Rouault) : `2df008d <https://github.com/mapserver/mapserver/commit/2df008de8d4962612528c0f75cba3463f97558f5>`__
+* WMS OpenLayers output: escape angle brackets in mapserv_onlineresource (MarkLee131) : `57a5d59 <https://github.com/mapserver/mapserver/commit/57a5d592a4270137c20f33459d59d370b5374426>`__
+* bound quadtree shape ids to the shapefile record count (Naveed) : `b93c185 <https://github.com/mapserver/mapserver/commit/b93c1859f3b8ebd3fae9477be32a73b191a314b9>`__
+* bound gif palette index reads to the color table size ( `#7551 <https://github.com/mapserver/mapserver/issues/7551>`__ ) (github-actions[bot]) : `ca4d255 <https://github.com/mapserver/mapserver/commit/ca4d255846f4f52ae79fec94bcbc34c7f545925a>`__
+* Fix memory leak on param handling ( `#7548 <https://github.com/mapserver/mapserver/issues/7548>`__ ) (github-actions[bot]) : `55f9081 <https://github.com/mapserver/mapserver/commit/55f908143926484635c680af38fa4b8c9e58070f>`__
+* Set OpenLayers resolution on CGI output maps ( `#7536 <https://github.com/mapserver/mapserver/issues/7536>`__ ) (github-actions[bot]) : `6193da1 <https://github.com/mapserver/mapserver/commit/6193da12b321f335f8d3a59e8f409c866209b80a>`__
+* Fix SLD generation when using string operators such as `le` ( `#7523 <https://github.com/mapserver/mapserver/issues/7523>`__ ) (github-actions[bot]) : `e23eda2 <https://github.com/mapserver/mapserver/commit/e23eda203e850e4d6acd0ef5f14e3e720ac7a62a>`__
+
 .. _changelog-8-6-4:
 
 Changes from 8.6.3 to 8.6.4

en/download.txt

@@ -18,7 +18,7 @@ Current Release(s)
 
 * MapServer
 
-  * **2026-06-01** MapServer-8.6.4 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.6.4.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.6.4.zip>`__ | :ref:`Changelog <changelog-8-6>`
+  * **2026-07-10** MapServer-8.6.5 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.6.5.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.6.5.zip>`__ | :ref:`Changelog <changelog-8-6>`
   * **2025-09-19** MapServer-8.4.1 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.4.1.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.4.1.zip>`__ | :ref:`Changelog <changelog-8-4>`
   * **2024-09-02** MapServer-8.2.2 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.2.2.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.2.2.zip>`__ | :ref:`Changelog <changelog-8-2>`
   * **2024-06-11** MapServer-8.0.2 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.0.2.tar.gz>`__ | :ref:`Changelog <changelog-8-0>`

en/download_archives.txt

@@ -15,6 +15,8 @@
 Past Releases
 ..............................................................................
 
+* **2026-07-10** MapServer-8.6.5 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.6.5.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.6.5.zip>`__ | :ref:`Changelog <changelog-8-6>`
+
 * **2026-06-01** MapServer-8.6.4 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.6.4.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.6.4.zip>`__ | :ref:`Changelog <changelog-8-6>`
 
 * **2026-05-07** MapServer-8.6.3 `tar.gz <https://download.osgeo.org/mapserver/mapserver-8.6.3.tar.gz>`__ | `.zip <https://download.osgeo.org/mapserver/mapserver-8.6.3.zip>`__ | :ref:`Changelog <changelog-8-6>`

en/include/announcements.inc

@@ -1,3 +1,27 @@
+**2026-07-10 - MapServer 8.6.5 is released**
+
+.. important::  
+   Security release available
+
+The security release of MapServer 8.6.5 has been issued in order to fix
+six vulnerabilities. See the :ref:`changelog <changelog-8-6-5>` 
+for the list of changes. 
+You may also review the security advisories for this release:
+
+1. `OGCAPI Features support <https://github.com/MapServer/MapServer/security/advisories/GHSA-288j-mhpj-gmmr>`__ advisory
+2. `WCS support <https://github.com/MapServer/MapServer/security/advisories/GHSA-35qh-49hm-5rcx>`__ advisory
+3. `OpenLayers viewer with WMS <https://github.com/MapServer/MapServer/security/advisories/GHSA-52rr-p4x5-2x6x>`__ advisory
+4. `WMS GetLegendGraphic support <https://github.com/MapServer/MapServer/security/advisories/GHSA-4mwc-qc95-5959>`__ advisory
+5. `MySQL JOIN support <https://github.com/MapServer/MapServer/security/advisories/GHSA-7624-4mwh-9cxr>`__ advisory
+6. `PostgreSQL JOIN support <https://github.com/MapServer/MapServer/security/advisories/GHSA-m3xh-ccmh-x8rw>`__ advisory
+
+You may also review MapServer's `Security Policy <https://github.com/MapServer/MapServer/blob/main/SECURITY.md>`__.
+As security for the 7.6 branch has ended, and branches 8.4, 8.2 & 8.0 are not supported, 
+all users are strongly encouraged to upgrade to the MapServer 8.6.5 release (see the 
+:ref:`Migration Guide <migration>`).
+
+Head to :ref:`download` to obtain a copy.
+
 **2026-06-01 - MapServer 8.6.4 is released**
 
 .. important::  
@@ -124,21 +148,3 @@ the MapCache :ref:`changelog <changelog-mapcache-1-14>` and TinyOWS
 :ref:`changelog <changelog-tinyows-1-2>`.
 
 Head to :ref:`download` to obtain a copy.
-
-**2024-07-21 - MapServer 8.2.1, 7.6.7 are released**
-
-Several maintenance releases of MapServer have been issued in order to fix
-a security flaw for the tostring() expression function.
-See the :ref:`8.2.1 changelog <changelog-8-2-1>`,
-:ref:`7.6.7 changelog <changelog-7-6-7>` for the list of changes. You 
-may also review MapServer's `Security Policy <https://github.com/MapServer/MapServer/blob/main/SECURITY.md>`__.
-
-Head to :ref:`download` to obtain a copy.
-
-**2024-07-08 - MapServer 8.2.0 is released**
-
-The major version MapServer 8.2 has been released. The list of
-major changes for this release can be found in the :ref:`8.2 announcement <announce-8-2>`.
-See the :ref:`changelog <changelog-8-2>`
-for the full list of changes and head to :ref:`download` to obtain a copy.
-

en/spelling_wordlist.dict

@@ -97,6 +97,7 @@ dev
 distro
 dll
 dlls
+documenters
 documentroot
 downsample
 downsampled
@@ -141,6 +142,7 @@ GDAL
 gdaladdo
 gdalinfo
 gdaltindex
+gdalwarp
 generalised
 geo
 geobbox
@@ -241,6 +243,7 @@ labelLeaderObj
 labelled
 labelling
 labelObj
+landsat
 lat
 latlon
 latlong
@@ -269,6 +272,7 @@ linter
 linters
 linux
 listserv
+LLM
 localhost
 logfile
 lon
@@ -293,6 +297,7 @@ mapscripts
 mapserv
 mapserver
 MapServer
+mapxy
 maxfeatures
 maxscale
 maxscaledenom
@@ -575,6 +580,7 @@ uncommenting
 uncompress
 unencrypted
 unix
+unmerged
 unprojected
 unreferenced
 untiled