Merge branch 'master' into spring7

Author: axl8713

.clabot

@@ -31,6 +31,7 @@
     "NielsMorck",
     "jve-nordiq",
     "tha-nordiq",
+    "oskarbh7",
     "fni18300",
     "OPGuillaume",
     "Mbayyari",
@@ -40,6 +41,7 @@
     "cmotadev",
     "brynsofz",
     "jlo-arxit",
+    "endorria",
     "huntsmarinho",
     "aseques",
     "jwkaltz",

.github/ISSUE_TEMPLATE/bug.md

@@ -39,3 +39,11 @@ assignees: ''
 
 ## Other useful information
 <!-- error stack trace, screenshot, videos, or link to repository code are welcome -->
+
+## Security vulnerabilities
+
+Do not report security vulnerabilities in public issues.
+
+If you believe you have found a vulnerability in MapStore, please use GitHub private vulnerability reporting or contact the security address listed in `SECURITY.md`.
+
+

.github/ISSUE_TEMPLATE/documentation.md

@@ -16,3 +16,10 @@ assignees: ''
 - [ ] Developer Guide
 
 ## Other useful information
+
+## Security vulnerabilities
+
+Do not report security vulnerabilities in public issues.
+
+If you believe you have found a vulnerability in MapStore, please use GitHub private vulnerability reporting or contact the security address listed in `SECURITY.md`.
+

.github/ISSUE_TEMPLATE/new_feature.md

@@ -18,3 +18,9 @@ assignees: ''
 - [ ] 
 
 ## Other useful information
+
+## Security vulnerabilities
+
+Do not report security vulnerabilities in public issues.
+
+If you believe you have found a vulnerability in MapStore, please use GitHub private vulnerability reporting or contact the security address listed in `SECURITY.md`.

.github/ISSUE_TEMPLATE/other.md

@@ -22,3 +22,10 @@ assignees: ''
 
 
 ## Other useful information
+
+## Security vulnerabilities
+
+Do not report security vulnerabilities in public issues.
+
+If you believe you have found a vulnerability in MapStore, please use GitHub private vulnerability reporting or contact the security address listed in `SECURITY.md`.
+

SECURITY.md

@@ -0,0 +1,72 @@
+# Security Policy
+
+MapStore maintainers take security vulnerabilities seriously.
+Please do not report suspected security vulnerabilities through public GitHub issues, public pull requests, public discussions, mailing lists, or other public channels.
+
+## Supported versions
+
+MapStore security fixes are normally prepared for the currently maintained release lines.
+
+| Version                                           | Supported              |
+| ------------------------------------------------- | ---------------------- |
+| Latest stable release line                        | Supported              |
+| Active maintenance release line, where applicable | Supported              |
+| Older or archived releases                        | Not normally supported |
+
+Users running older MapStore versions are encouraged to upgrade to a supported release. If your organization requires security fixes for an older version, please contact GeoSolutions or your MapStore support provider to discuss feasibility.
+
+## Reporting a vulnerability
+
+Please report suspected vulnerabilities privately using one of the following channels.
+
+### GitHub private vulnerability reporting
+
+Use the repository security page and submit a private vulnerability report:
+
+[https://github.com/geosolutions-it/MapStore2/security/advisories/new](https://github.com/geosolutions-it/MapStore2/security/advisories/new)
+
+This is the preferred channel when available, because it allows maintainers and the reporter to coordinate privately, prepare a fix, request or associate a CVE where appropriate, and publish a GitHub Security Advisory after release.
+
+### Email
+
+If GitHub private vulnerability reporting is unavailable, or if email is more appropriate, contact:
+
+[infosec@geosolutionsgroup.com](mailto:infosec@geosolutionsgroup.com)
+
+Please include as much of the following information as possible:
+
+* affected MapStore version, release line, commit, or deployment profile;
+* affected component, endpoint, plugin, or configuration;
+* steps to reproduce the issue;
+* proof-of-concept details, preferably against a local or test instance;
+* expected and actual behavior;
+* potential impact;
+* whether the issue has already been disclosed to anyone else;
+* whether you would like public credit in the advisory.
+
+Please do not test against third-party systems or production deployments unless you have explicit authorization.
+
+## Coordinated vulnerability disclosure
+
+MapStore follows a coordinated vulnerability disclosure process.
+
+1. The report is received through a private channel.
+2. The maintainers acknowledge receipt, normally within 5 business days.
+3. The maintainers privately verify the vulnerability and assess severity, impact, affected versions, and exploitability.
+4. If the report is valid, the maintainers prepare a fix, regression tests, mitigation guidance where applicable, and backports to supported release lines where feasible.
+5. A GitHub Security Advisory may be used to coordinate the fix, request or associate a CVE, credit the reporter, and prepare public advisory text.
+6. Fixed releases are published before exploit details are disclosed publicly, unless the vulnerability is already public or actively exploited.
+7. The advisory is published with affected versions, fixed versions, severity, mitigation or workaround instructions, and upgrade guidance.
+
+We ask reporters to keep vulnerability details private until a fixed release and advisory are available. If public disclosure
+is required for external reasons, please coordinate the timing with the maintainers whenever possible.
+
+## Scope
+
+This policy covers vulnerabilities in MapStore source code, default configurations, official build artifacts, and official documentation where the documentation causes an insecure deployment pattern.
+
+Issues in third-party dependencies may be reported if they materially affect MapStore users, but they may also need to be coordinated with the upstream dependency maintainers.
+
+## Safe harbor
+
+We will not pursue legal action against security researchers who make a good-faith effort to comply with this policy, avoid privacy violations, avoid service disruption, avoid data destruction, and report vulnerabilities privately.

docs/developer-guide/mapstore-migration-guide.md

@@ -22,6 +22,31 @@ This is a list of things to check if you want to update from a previous version
 
 ## Migration from 2026.01.02 to 2026.02.00
 
+### Custom map resolutions moved from `new.json` to the `CRSSelector` plugin
+
+Custom map resolutions used to be declared in the default map configuration (`new.json`, or the project-level equivalent) under `mapOptions.view.resolutions`. That location was tied to a single projection and was not kept in sync when the CRS was changed at runtime, which could leave saved maps with a projection that did not match the persisted resolutions.
+
+Custom resolutions are declared **per CRS** in the `CRSSelector` plugin configuration in `localConfig.json`, keyed by SRS code:
+
+```json
+{
+  "name": "CRSSelector",
+  "cfg": {
+    "customResolutions": {
+      "EPSG:3003": [2366, 1183, 591, 295, 147, 73, 36, 18, 9, 4, 2, 1, 0.5, 0.28, 0.14, 0.07, 0.035, 0.018],
+      "EPSG:4326": [0.7, 0.35, 0.175, 0.0875, 0.04375, 0.021875, 0.010986, 0.0054931]
+    }
+  }
+}
+```
+
+When the user switches the map CRS, the matching list of resolutions is applied to the map. If a CRS has no entry, the resolutions are computed from the projection extent. In either case the chosen list is saved together with the map so that, on reload, the CRS and the resolutions remain aligned.
+
+#### Migration steps
+
+1. Remove `mapOptions.view.resolutions` from `new.json` (and from any custom default map config used by the project). Any value left there is dropped on the next save.
+2. Add an equivalent `customResolutions` block to the `CRSSelector` plugin entry in `localConfig.json`, keyed by the SRS the resolutions were originally designed for.
+
 ### print-lib updated to 2.3.5
 
 In your project, you should update the `print-lib.version` property from version `2.3.4` to version `2.3.5` in the root `pom.xml`.

package.json

@@ -138,7 +138,7 @@
     "@znemz/cesium-navigation": "4.0.0",
     "ajv": "8.18.0",
     "assert": "2.0.0",
-    "axios": "0.30.3",
+    "axios": "0.32.0",
     "bootstrap": "3.4.1",
     "buffer": "6.0.3",
     "canvas-to-blob": "0.0.0",

utility/build/postInstall.js

@@ -20,6 +20,20 @@ const nodeModules = [
     }
 ];
 
+// Patch for axios-mock-adapter to support null-prototype headers introduced in axios 0.32.0.
+// Remove when https://github.com/ctimmerm/axios-mock-adapter/issues/415 is fixed and released.
+function patchAxiosMockAdapter(nodeModulesPath) {
+    const filePath = path.resolve(nodeModulesPath, 'axios-mock-adapter/src/handle_request.js');
+    if (!fs.existsSync(filePath)) return;
+    const original = 'config.headers.constructor.name === "AxiosHeaders"';
+    const patched  = 'config.headers?.constructor?.name === "AxiosHeaders"';
+    const content = fs.readFileSync(filePath, 'utf8');
+    if (content.includes(original)) {
+        console.log('* patching axios-mock-adapter handle_request.js (null-prototype compat)');
+        fs.writeFileSync(filePath, content.replace(original, patched), 'utf8');
+    }
+}
+
 function removeModules(nodeModulesPath) {
     const removeModulesList = [
         'leaflet-simple-graticule/node_modules'
@@ -45,6 +59,7 @@ function removeModules(nodeModulesPath) {
 nodeModules.forEach((nodeModule) => {
     if (fs.existsSync(nodeModule.path) && nodeModule.valid) {
         console.log('remove in node_modules path', nodeModule.path);
-        removeModules(nodeModule.path) 
+        removeModules(nodeModule.path);
+        patchAxiosMockAdapter(nodeModule.path);
     }
 });

web/client/api/GeoNode.js

@@ -20,6 +20,9 @@ import { getConfigProp } from '../utils/ConfigUtils';
 import { resolveApiPresetParams, paramsSerializer, mergePresetParams } from '../utils/GeoNodeUtils';
 
 export const GEONODE_RESOURCE_TYPE_FILTER = 'filter{resource_type.in}';
+// default sort applied to the catalog resources request when the caller does not provide one
+// (matches the "Most recent" default shown in the catalog toolbar)
+export const GEONODE_DEFAULT_SORT = '-date';
 
 
 export const RESOURCES = 'resources';
@@ -211,7 +214,7 @@ export const getRecords = (url, startPosition, maxRecords, text, options) => {
         baseUrl: url,
         ...(resourceTypes.length && { [GEONODE_RESOURCE_TYPE_FILTER]: resourceTypes }),
         ...options?.options?.filters,
-        sort: options?.options?.sort,
+        sort: options?.options?.sort ?? service?.defaultSort ?? GEONODE_DEFAULT_SORT,
         ...(service?.apiPresetKey && { apiPresetKey: service.apiPresetKey })
     });
 };