Skip to content

v0.15.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 22:45
v0.15.0
8197203
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Breaking Changes

The tenant cache hashes the tenant ID. Sanitizing could merge distinct IDs into one key, so keys now use a SHA-256 hash instead. Tiles cached by previous versions will no longer be found.

Unknown {layer.NAME} placeholders fail startup. A provider referencing a placeholder that isn't in its layer's pattern was previously a warning.

Forwarding headers use the right-most value. TileJSON and the preview page now use the right-most X-Forwarded-Host, X-Forwarded-Proto, X-Forwarded-Port and X-Forwarded-Prefix value instead of the left-most, so clients can't override your proxy. If several proxies append to these headers, set the new server.forwarded.depth or TileJSON baseurls.

Bearer authentication with Redis requires redis.keyPrefix. Without one, any key in the database, such as a cached tile, could act as a token.

Highlights

TLS profiles. A new top-level tls section defines pem, acme and selfsigned profiles once and references them by ID for server certificates, incoming and outgoing mTLS, and upstream certificate validation. pem and acme profiles reload without a restart. The old server.encrypt certificate options are deprecated.

Parameter mapping. paramMap on a layer replaces placeholder values before providers see them.

Automatic cache version. cacheversion: auto hashes a layer's configuration, so changing its provider, pattern, paramMap, bounds or datatype invalidates its cache.

Extension keys. Top-level keys starting with x- are ignored, so they can hold YAML anchors for reuse.

More places for layer placeholders. ref accepts {layer.NAME} in layer, and custom providers can read the values through LayerParams.

Documentation restructure. The configuration reference is now a dedicated module and pages link to related pages.

What's Changed

Features

  • Add TLS profiles for server certificates, mTLS, and upstream certificate validation by @Michad in #1174
  • Add a selfsigned TLS profile for development by @Michad in #1180
  • Warn when the TLS configuration breaks the HTTP to HTTPS redirect by @Michad in #1174
  • Warn when HTTPS_PROXY is combined with mTLS by @Michad in #1192
  • Add paramMap on layers by @Michad in #1187
  • Add cacheversion: auto by @Michad in #1191
  • Ignore top-level x- keys for YAML anchors by @Michad in #1183
  • Support {layer.NAME} in the ref provider's layer by @Michad in #1186
  • Expose layer placeholder values to custom providers through LayerParams by @Michad in #1185
  • Fail startup on a {layer.NAME} placeholder missing from the layer's pattern by @Michad in #1192
  • Add server.forwarded.depth by @Michad in #1205
  • Add redis.allowedType to bearer authentication by @Michad in #1204

Fixes

  • Use the right-most X-Forwarded-* value in TileJSON and the preview page by @Michad in #1205
  • Require redis.keyPrefix for bearer authentication by @Michad in #1204
  • Hash tenant IDs in cache keys by @Michad in #1202
  • Enforce maxlength on upstream responses without a Content-Length header by @Michad in #1203
  • Tighten escaping and validation of placeholder values inserted into URLs by @Michad in #1206
  • Detect reference loops when ref uses {layer.NAME} by @Michad in #1192
  • Match paramValidator and paramMap keys to placeholders regardless of case by @Michad in #1187
  • Allow 0 for z, x and y in the tile health check by @Michad in #1207
  • Fix postgismvt filters when sourceSRID isn't 4326 or 3857, and require table by @Michad in #1208
  • Re-validate in custom authentication once a cached result expires by @Michad in #1209
  • Let empty CGI env values inherit from the tilegroxy process by @Michad in #1210
  • Log deprecation warnings on every reload by @Michad in #1211
  • Remove the unused idletimeout option from the ClickHouse datastore by @Michad in #1213

Documentation

Dependencies

  • security(go): bump github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4 by @dependabot[bot] in #1162
  • security(go): bump github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.12 by @dependabot[bot] in #1179
  • security(go): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.6 by @dependabot[bot] in #1178
  • security(go): bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.50.4 to 1.50.6 by @dependabot[bot] in #1163
  • security(go): bump github.com/lestrrat-go/jwx/v3 from 3.3.0 to 3.4.0 by @dependabot[bot] in #1177
  • security(go): bump go.etcd.io/etcd/client/v3 from 3.7.2 to 3.7.3 by @dependabot[bot] in #1164
  • security(docker): bump alpine from 3.24.2 to 3.24.3 by @dependabot[bot] in #1167
  • security(actions): bump github/codeql-action (init, autobuild, analyze, upload-sarif) from 4.39.0 to 4.39.1 by @dependabot[bot] in #1155, #1157, #1160 and #1181 and @Michad in #1212
  • security(actions): bump securego/gosec from 2.29.0 to 2.30.0 by @dependabot[bot] in #1158
  • security(actions): bump ruby/setup-ruby from 1.331.0 to 1.336.0 by @dependabot[bot] in #1161 and #1182
  • security(actions): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #1184

Full Changelog: v0.14.0...v0.15.0

Contributors

Michad and dependabot
Assets 13
Loading