GeoCat Map 2026.1 Release Notes

GeoCat Map 2026.1 is a security release, strongly recommended for all GeoCat Map 2026.0 customers.

General

GeoCat Map 2026.1 release notes:

• GeoCat Map 2026.1 is proudly open source with the latest GeoServer 3.0.2, GeoWebCache 2.0.2, and GeoTools 35.2 technologies.
• GeoCat Map downloads are now provided from the nexus products folder, see GeoCat Map Downloads for details.

Detailed change log:

• GeoServer posts: 3.0.2.

• GeoServer release notes: 3.0.2.

Security considerations:

• GeoCat respects the GeoServer coordinated vulnerability disclosure policy, contact us directly to discuss known security vulnerabilities mitigation and resolution availability.

• The following security vulnerabilities are addressed by this release:

  • GHSA-hgm3-wq4h-8vvq (Critical)
  • GHSA-wc3v-48j7-xf57 (Critical)
  • GHSA-cvw8-9fcf-4wxj (Critical)
  • GHSA-rv5g-g2r9-58rj (Critical)
  • GHSA-9j5h-q8xc-hppq (High)
  • GHSA-8w5h-q76f-7mc7 (High)
  • GHSA-65mr-5frw-93xf (High)
  • GHSA-37mm-jp7f-64jp (High)
  • GHSA-vv34-hm2r-7h59 (High)
  • GHSA-39mw-5chv-jh47 (High)
  • GHSA-3x82-qq72-g4p3 (High)
  • GHSA-5v3x-f56f-2xm8 (High)
  • GHSA-xqwh-vc83-cp7g (High)
  • GHSA-m4x7-gx5p-4jjp (Moderate)
  • GHSA-9vfc-p7x6-xxwh (Moderate)
  • GHSA-rg89-jmrw-x26f (Moderate)

  GeoCat is committed to taking care of our customers and will provide more information as the above vulnerabilities are publicly disclosed. If you have any concerns please contact our help desk.

GeoCat Map Standard

• OGC API Maps 1.0

  The OGC API Maps service now follows the final OGC API - Maps 1.0.0 standard, and is included in GeoCat Map alongside OGC API Features.

• OGC API conformance table improvements

  The conformance tables used to configure OGC API Features and OGC API Maps services have been backported to GeoServer 3.0.2.

  Enabling or disabling a conformance class now updates related classes to reflect their dependencies, and each row shows whether it is enabled by default.

GeoCat Map Premium

• JWT Headers configuration options

  The JWT Headers authentication filter provides new configuration options:

  • Accepted issuers (iss), required when validating the token signature.
  • Allow the header to log in the built-in admin account, unchecked for new filters.
  • Trust a roles header that is not the validated token, for use only when a proxy always removes or overwrites that header.
  • Log sensitive information, used with the new JWT_HEADERS_LOGGING logging profile when troubleshooting.

  New filters validate the token signature and expiry by default. Existing filters keep their stored settings, and the GeoServer log reports any filter that should be reviewed.

  Please contact support for assistance reviewing your JWT Headers configuration.