Release Notes
CoreSpatial 2026-Q1 Release Announcement
NGS is pleased to announce the 2026.1 release of CoreSpatial Server, Map Manager and Portal
The highlight of this release is our CoreSpatial Portal release based on MapStore2 v2025.02.02. This is a large rollup that advances through multiple upstream MapStore2 releases. See full details below.
We also look forward to continued development in the following areas:
- Bulk tile collection projects via Map Manager UI
- Expanded image handling capabilities in Map Manager – georectification of commercial drone imagery using JPEG EXIF
- Desktop GIS integration via QGIS
CoreSpatial Server and Basemaps Release Notes
2026.1.7 (03/31/2026)
- Update GeoServer to 2.28.3
- Update PostgreSQL JDBC jar to 42.7.10
- Update C3P0 Connection Pooling lib 0.12.0
- Improve SBOM/CVE diff automation (new scripts, live image scans, and previous-release SBOM comparisons)
2026.1.6 (03/03/2026)
- Patch five High/Medium CVEs in bundled JARs
- Add support for multiple SBOM formats: SPDX, CycloneDX, and Syft
2026.1.5 – 2026.1.1 (January 2026)
- Successive patches for vulnerabilities discovered in the UBI 9 base image
- Patch gnupg2 High severity vulnerability affecting the Docker container base image
- Patch libpng to remediate High severity vulnerability affecting the Docker container base image
CoreSpatial Map Manager Release Notes
2026.1.9 (03/30/2026)
- Refresh runtime container packages in the final Docker image to clear fixed vulnerabilities in the release container
2026.1.8 (03/25/2026)
- Bump Spring Boot to 3.5.12 to remediate JAR vulnerabilities affecting Tomcat and Spring Web MVC
- Update PostgreSQL JDBC to 42.7.10, Logback to 1.5.32, commons-io to 2.18.0, commons-lang3 to 3.19.0, and commons-compress to 1.27.1
- Separate WMS Scraper into its own versioned release flow
2026.1.5 – 2026.1.1 (January–March 2026)
- Bump react-router and react-router-dom to 6.30.3
- Remove Python from the runtime image so it remains build-time only for GDAL
- Use Iron Bank base image for the container
- Successive base-image vulnerability patches (gnupg2, jaraco-context, libpng)
CoreSpatial Portal Release Notes
2026.1.1 (3/30/2026)
This release is a large rollup that advances the MapStore2 submodule through multiple upstream releases:
New Features & Enhancements
- Cesium ion World Terrain, Added Cesium ion World Terrain support for 3D map view, with graceful fallback to the default ellipsoid when no token is configured
- Manager Page Plugins, Fixed blank manager page by adding UserManager, GroupManager, TagsManager, IPManager, and Footer plugins to the manager configuration
Bug Fixes
- Fixed duplicate file upload attempt that could trigger two concurrent upload requests
- Fixed OSM background layer CORS errors by using explicit HTTPS tile URLs in base configuration
Security & Infrastructure
- Switch to Iron Bank ubi9 base image for the container
- Bump Tomcat to 9.0.108, addressing multiple CVEs across the 9.0.x series
- Multi-format SBOM generation (syft-json, cyclonedx-json, spdx-json, table) now included with all releases
Testing
- Added Playwright end-to-end regression test suite