diff --git a/conf.py b/conf.py index 8515ac71cc0..250e91bd38a 100644 --- a/conf.py +++ b/conf.py @@ -94,7 +94,7 @@ def __getattr__(cls, name): # The short X.Y version. version = '8.6' # The full version, including alpha/beta/rc tags. -release = '8.6.5' +release = '8.6.6' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. #language = None diff --git a/en/MIGRATION_GUIDE.txt b/en/MIGRATION_GUIDE.txt index 336f31b3906..f90ffd2e2b1 100644 --- a/en/MIGRATION_GUIDE.txt +++ b/en/MIGRATION_GUIDE.txt @@ -6,7 +6,7 @@ MapServer Migration Guide ***************************************************************************** -:Last Updated: 2026-07-15 +:Last Updated: 2026-09-06 .. contents:: Table of Contents :depth: 2 @@ -22,6 +22,19 @@ MapServer Migration Guide MapServer 8.4 to 8.6 Migration ============================== +- The 8.6.6 release includes fixes for six vulnerabilities, see the advisories: + + - `WCS 2.0 support `__ advisory + - `CGI/FastCGI with SMOOTHSIA `__ advisory + - `WMS Filter `__ advisory + - `WMS with interpolation layers `__ advisory + - `FlatGeobuf support `__ advisory + - `WMS error image `__ advisory + + .. note:: + For those leveraging an older `librsvg` version, the 8.6.6 release fixes a problem + of SVG scaling that had existed since the 8.6.0 release (see `#7583 `__). + - The 8.6.5 release includes fixes for six vulnerabilities, see the advisories: - `OGCAPI Features support `__ advisory diff --git a/en/announcements/announcements_archive.txt b/en/announcements/announcements_archive.txt index 887c95bb955..c312837aa09 100644 --- a/en/announcements/announcements_archive.txt +++ b/en/announcements/announcements_archive.txt @@ -4,6 +4,30 @@ MapServer Announcement Archives ***************************************************************************** +**2026-09-06 - MapServer 8.6.6 is released** + +.. important:: + Security release available + +The security release of MapServer 8.6.6 has been issued in order to fix +six vulnerabilities. See the :ref:`changelog ` +for the list of changes. +You may also review the security advisories for this release: + +1. `WCS 2.0 support `__ advisory +2. `CGI/FastCGI with SMOOTHSIA `__ advisory +3. `WMS Filter `__ advisory +4. `WMS with interpolation layers `__ advisory +5. `FlatGeobuf support `__ advisory +6. `WMS error image `__ advisory + +You may also review MapServer's `Security Policy `__. +As security for the 7.6 branch has ended, and branches 8.4, 8.2 & 8.0 are not supported, +all users are strongly encouraged to upgrade to the MapServer 8.6.6 release (see the +:ref:`Migration Guide `). + +Head to :ref:`download` to obtain a copy. + **2026-07-10 - MapServer 8.6.5 is released** .. important:: diff --git a/en/development/changelog/changelog-8-6.txt b/en/development/changelog/changelog-8-6.txt index 949ecb80cca..6a05ff8472c 100644 --- a/en/development/changelog/changelog-8-6.txt +++ b/en/development/changelog/changelog-8-6.txt @@ -7,6 +7,43 @@ The summary of major changes for this release can be found in the `HISTORY.md `__ file from the source directory. +.. _changelog-8-6-6: + +Changes from 8.6.5 to 8.6.6 +=========================== + +.. important:: + Security release + +* mapcontext: fix out-of-bounds read on short BoundingBox SRS ( `#7644 `__ ) (github-actions[bot]) : `548180a `__ +* maperror: size the error image within MAXSIZE (GHSA-qcjf-q672-q63w) ( `#7643 `__ ) (github-actions[bot]) : `bf71dcf `__ +* kml: use snprintf when formatting coordinates, extents and widths ( `#7639 `__ ) (github-actions[bot]) : `c150388 `__ +* CI: upgrade PCRE2 to 10.48 release ( `#7641 `__ ) (github-actions[bot]) : `33e9610 `__ +* Fix memleak in mapogcsld ( `#7638 `__ ) (github-actions[bot]) : `a3c3f68 `__ +* mappool.c: only raise connectionMax after a successful realloc (fixes `#7614 `__ ) ( `#7634 `__ ) (github-actions[bot]) : `e5b4335 `__ +* Handle NaN coordinates in WFS geometry filters ( `#7633 `__ ) (github-actions[bot]) : `2c7dd03 `__ +* Restore the missing first line of the licence grant in four headers ( `#7632 `__ ) (github-actions[bot]) : `a04a50e `__ +* msDBFOpenVirtualFile(): validate field extents against record length ( `#7629 `__ ) (github-actions[bot]) : `0f2c4d8 `__ +* mapogcfilter: limit filter operation count ( `#7621 `__ ) (github-actions[bot]) : `509ad65 `__ +* Fix heap out-of-bounds write in interpolation layers (GHSA-59gr-4vvx-5f56) ( `#7620 `__ ) (github-actions[bot]) : `c3e81ac `__ +* bound WKB point reads to the Z/M byte stride in mappostgis ( `#7619 `__ ) (github-actions[bot]) : `988fbf0 `__ +* Fix integer overflows in WCS parsing ( `#7628 `__ ) (github-actions[bot]) : `f1a9091 `__ +* Update FlatGeobuf from upstream ( `#7627 `__ ) (github-actions[bot]) : `3ffa8c1 `__ +* mapproject.c: check msProjectCreateReprojector() result in msProjectRect() (fixes `#7613 `__ ) ( `#7626 `__ ) (github-actions[bot]) : `b437b13 `__ +* mapobject.c: clear cached reprojectors in msRemoveLayer() (fixes `#7611 `__ ) ( `#7618 `__ ) (github-actions[bot]) : `0368328 `__ +* Add guard against empty lines to fix oss-fuzzer 551099259 ( `#7617 `__ ) (github-actions[bot]) : `c6954a3 `__ +* Fix integer overflow oss-fuzz 4545217852932096 ( `#7610 `__ ) (github-actions[bot]) : `30831d6 `__ +* Fix memory leak in mapows and mapwcs ( `#7601 `__ ) (github-actions[bot]) : `df90df7 `__ +* fix out-of-bounds read in SLD arithmetic operator parsing ( `#7598 `__ ) (github-actions[bot]) : `8ef661d `__ +* mapcairo.c: avoid double scaling of SVG symbols (fixes: `#7430 `__ ) ( `#7595 `__ ) (github-actions[bot]) : `fb438a8 `__ +* bound wms exception response copy to result_size ( `#7592 `__ ) (github-actions[bot]) : `18171bd `__ +* Fix WCS 2.0 GetCoverage DoS from non-positive RESOLUTION (GHSA-6jr5-rc9c-p3cj) ( `#7589 `__ ) (github-actions[bot]) : `244b6b1 `__ +* size msClipPolygonRect buffer for 3 emitted points per edge ( `#7588 `__ ) (github-actions[bot]) : `3d6ef77 `__ +* Fix SMOOTHSIA point-shape DoS in CGI query path (GHSA-33h3-f4q2-pq5q) ( `#7576 `__ ) (Zhen Yan) : `5f314cf `__ +* Remove any tolerance set on a layer for feature queries ( `#7587 `__ ) (Seth G) : `a6e6fe9 `__ +* Apply runtime substitutions before applying SLD files ( `#7586 `__ ) (github-actions[bot]) : `2ae56a0 `__ +* Build fixes for CMake 4.4 ( `#7580 `__ ) (github-actions[bot]) : `1358bf3 `__ + .. _changelog-8-6-5: Changes from 8.6.4 to 8.6.5 diff --git a/en/download.txt b/en/download.txt index fb488693651..d26733fce5a 100644 --- a/en/download.txt +++ b/en/download.txt @@ -18,7 +18,7 @@ Current Release(s) * MapServer - * **2026-07-10** MapServer-8.6.5 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` + * **2026-09-06** MapServer-8.6.6 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2025-09-19** MapServer-8.4.1 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2024-09-02** MapServer-8.2.2 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2024-06-11** MapServer-8.0.2 `tar.gz `__ | :ref:`Changelog ` diff --git a/en/download_archives.txt b/en/download_archives.txt index 37d10daea4b..61a58bf187e 100644 --- a/en/download_archives.txt +++ b/en/download_archives.txt @@ -15,6 +15,8 @@ Past Releases .............................................................................. +* **2026-09-06** MapServer-8.6.6 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` + * **2026-07-10** MapServer-8.6.5 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` * **2026-06-01** MapServer-8.6.4 `tar.gz `__ | `.zip `__ | :ref:`Changelog ` diff --git a/en/include/announcements.inc b/en/include/announcements.inc index bc107efc913..e5d4ade6ecf 100644 --- a/en/include/announcements.inc +++ b/en/include/announcements.inc @@ -1,3 +1,27 @@ +**2026-09-06 - MapServer 8.6.6 is released** + +.. important:: + Security release available + +The security release of MapServer 8.6.6 has been issued in order to fix +six vulnerabilities. See the :ref:`changelog ` +for the list of changes. +You may also review the security advisories for this release: + +1. `WCS 2.0 support `__ advisory +2. `CGI/FastCGI with SMOOTHSIA `__ advisory +3. `WMS Filter `__ advisory +4. `WMS with interpolation layers `__ advisory +5. `FlatGeobuf support `__ advisory +6. `WMS error image `__ advisory + +You may also review MapServer's `Security Policy `__. +As security for the 7.6 branch has ended, and branches 8.4, 8.2 & 8.0 are not supported, +all users are strongly encouraged to upgrade to the MapServer 8.6.6 release (see the +:ref:`Migration Guide `). + +Head to :ref:`download` to obtain a copy. + **2026-07-10 - MapServer 8.6.5 is released** .. important:: diff --git a/en/spelling_wordlist.dict b/en/spelling_wordlist.dict index 6d4506a3bf0..baadb83f04a 100644 --- a/en/spelling_wordlist.dict +++ b/en/spelling_wordlist.dict @@ -238,6 +238,7 @@ kml KML kmz KMZ +kriging labelCacheObj labelLeaderObj labelled @@ -521,6 +522,7 @@ srid srs SRS ssl +stabilises stderr stdin stdout @@ -583,6 +585,7 @@ unix unmerged unprojected unreferenced +unsampled untiled uom uri