CoreSpatial 2026-Q3 Release Announcement

NGS is pleased to announce the 2026.3 release of CoreSpatial Server, Basemaps, Map Manager and Portal.

This is a big one for CoreSpatial Server. We moved to GeoServer 3.0, which is a Jakarta EE application, so the servlet container moved from Jetty 9.4 to Jetty 12.1 along with it. Server 2026.3.3 is also the first release built from our FIPS 140-3 GeoServer fork using the Bouncy Castle FIPS provider, which we committed to making generally available last year. Upgrading from 2026.2.x requires a one time config file migration, and the Admin Guide walks through it.

Map Manager 2026.3.2 delivers tile collection projects. You draw an area of interest, pick an imagery provider, and Map Manager collects the tiles and shows the AOIs, tile grid and image footprints on the map as it goes. Maxar/Vantor is built in, and you can add any other WMS or WFS source (Terrestris OSM, the USGS National Map, NASA GIBS, or your own servers) as a custom API from the UI.

Portal 2026.3.1 is the first generally available Portal release since 2026.1. It focuses on security, with a Tomcat update and patched bundled libraries across MapStore2 and GeoStore.

We also look forward to continued development in the following areas:

• Expanded image handling capabilities in Map Manager: georectification of commercial drone imagery using JPEG EXIF
• Direct drone imagery upload to CoreSpatial Portal via Cesium Ion
• Upgrading Portal to the Spring 6 and Jakarta based MapStore2 line
• Desktop GIS integration via QGIS

CoreSpatial Server and Basemaps Release Notes

2026.3.3 (10/14/2026)

• Update OSM database to 9/28/2026 build
• Build CoreSpatial Server from the NGS FIPS 140-3 GeoServer fork (3.0.1 on Jetty 12), replacing stock Bouncy Castle with the bc-fips provider
• Add Keycloak single sign-on for the GeoServer admin UI through the OIDC plugin, with automated realm, truststore and filter setup
• Reduce the container's attack surface by removing unused packages and stripping the setuid bit from mount and umount to mitigate CVE-2026-53613
• Patch Spring Framework to 7.0.9 to remediate Critical GHSA-pc63-qcmh-9cmg in spring-webmvc
• Patch bc-fips to 2.1.3 to remediate GHSA-9pwp-9qqc-pr26, GHSA-v6w3-qrh8-qccc, GHSA-qp49-qgx5-5m26, and GHSA-98j2-6v39-78w8
• Update Jackson Core/Databind to 2.21.7, 2.22.3, 3.1.7, and 3.2.3 and bcprov-lts8on to 2.73.12
• Align Spring Security on 7.1.1 to match the bundled 7.1.x OAuth2 and access modules
• Upgrade all RHEL 9 runtime packages in the final Docker image, clearing fixed vulnerabilities in openssl, curl, glib2, sqlite-libs, java-17-openjdk-headless, and other base packages

2026.3.2 (08/16/2026)

• Update the C3P0 connection pool to 0.14.1 and mchange-commons-java to 0.6.1

2026.3.1 (08/15/2026)

• Update GeoServer to 3.0.1
• Patch bundled GeoServer 3.0 dependencies: Jackson Core/Databind 2.22.1, Apache HttpClient 5.6.3 and HttpCore 5.4.3, Log4j 2.26.1, and Spring Security 7.0.6

2026.3.0 (08/12/2026)

• Upgrade GeoServer from 2.28.4 to 3.0.0 (GeoTools 35, GeoWebCache 2.0). Upgrading from 2026.2.x requires the config file migration described in the Admin Guide
• Migrate the servlet container from Jetty 9.4 to Jetty 12.1 (Jakarta EE 11, Servlet 6.1)
• Continued 2.28.x maintenance ships from a separate branch for customers not yet ready to move to 3.0
• Add a data independent OWS/REST smoke test to the release pipeline

2026.2.3 (07/24/2026)

• Update GeoServer to 2.28.4, PostgreSQL JDBC to 42.7.12, and Jackson Core/Databind to 2.21.5
• Refresh RHEL 9 runtime packages in the final Docker image to clear fixed operating system vulnerabilities

CoreSpatial Map Manager Release Notes

2026.3.2 (10/14/2026)

• Tile collection projects: collect imagery tiles for an area of interest from WMS/WFS imagery providers directly from the Map Manager UI, with AOIs, the collected tile grid and image footprints shown as map overlays. Ships with the Maxar/Vantor provider; other WMS/WFS sources can be added as custom APIs
• Add, edit and delete your own WMS and WFS imagery APIs from the Tile Collections drawer, with layers picked from the API's GetCapabilities
• New tile zoom level widget filters the collected tile grid by zoom level
• Reference Helm chart and Admin Guide instructions for putting Map Manager behind Keycloak sign in
• Downloading a completed tile collection job returns its results as a zip
• Upgrade note: Map Manager now requires an MM_SECRET_KEY, which encrypts the API keys saved with user added WMS/WFS APIs. RPM installs generate it automatically; Docker and Kubernetes deployments must supply it. See the MM_SECRET_KEY section of the Admin Guide
• Upgrade note: the built in Terrestris OSM, USGS National Map and NASA GIBS providers were removed. Re-add any you use as custom APIs. The default Maxar endpoints moved to pro.gegd.com, and custom APIs on internal hosts must now be listed in MM_CAPABILITIES_ALLOWED_HOSTS
• Upgrade note: delete scraper job logs written before this release and rotate any Maxar key or EVWHS CONNECTID whose logs were shared or backed up
• Bump Spring Boot to 3.5.16 and pin tomcat-embed-core to 10.1.60 to remediate Critical Tomcat vulnerabilities GHSA-9xv2-5v5q-p794, GHSA-gcx9-497g-6cp6, and GHSA-h3x4-894j-xpx5
• Update Jackson to 2.22.3 and Log4j API to 2.25.5, and build the bundled WMS scraper with Go 1.26.9
• Block server side request forgery from custom WMS/WFS endpoints and redact API keys from scraper job logs
• Refresh runtime container packages in the final Docker image to clear recent fixed Ubuntu vulnerabilities

2026.3.1 (08/11/2026)

• Bump Spring Boot to 3.5.15 to update Spring Framework to 6.2.19, Spring Data Commons to 3.5.12, and Micrometer Core to 1.15.12

2026.2.7 (07/24/2026)

• Update Jackson to 2.22.1, PostgreSQL JDBC to 42.7.12, and Logback to 1.5.34
• Refresh runtime container packages in the final Docker image to clear recent fixed Ubuntu vulnerabilities

CoreSpatial Portal Release Notes

2026.3.1 (10/14/2026)

• Update Tomcat to 9.0.122 to remediate Critical GHSA-r29c-68gh-xp6x and four High severity vulnerabilities in tomcat-coyote
• Patch bundled MapStore2 and GeoStore libraries: Bouncy Castle 1.85, Jackson 2.18.11, Apache CXF 3.6.12, Commons BeanUtils 1.11.0, Commons FileUpload 1.6.0, aircompressor 2.0.3, and PostgreSQL JDBC 42.7.12
• Install the headless Java 11 runtime and upgrade all RHEL 9 runtime packages, removing unused desktop libraries from the image
• Build the bundled database migration tool with Go 1.26.9
• Document the remaining findings that require the Spring 6 MapStore2 line, with a code path review for each, in the Portal release notes