docs(security): document the GDAL 3.12 VRT options and how to remove the expression parameter - #1476
Merged
vincentsarago merged 1 commit intoAug 5, 2026
Conversation
…the expression parameter The GDAL section said new variables 'might be introduced' in 3.12; they shipped, so name them and their defaults, and add the 3.13.2 header_file restriction. Add a band math section showing how to drop the expression parameter via layer_dependency=BidxParams, for applications that only need band selection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two documentation updates to
SECURITY.md, from running TiTiler as an internal sidecar behind an authorizing proxy.GDAL 3.12 VRT options
The page currently says new variables "might be introduced" in GDAL 3.12 and links the PR. They shipped, so this names them and their defaults:
GDAL_VRT_ENABLE_RAWRASTERBAND, defaultYESGDAL_VRT_RAWRASTERBAND_ALLOWED_SOURCE, defaultSIBLING_OR_CHILD_OF_VRT_PATHBoth defaults are verified against the VRT driver docs. This matters for deployments where
GDAL_SKIP=VRTis not an option because VRT datasets are a product feature, which the existing text does not cover.I also added the GDAL 3.13.2 restriction on the
/vsicurl/header_fileoption, verified against the virtual file systems docs.Removing the
expressionparameterThe page documents restricting sources with
path_dependencybut nothing about band math. Applications that only need band selection can drop the parameter entirely withlayer_dependency=BidxParams, which is a stronger guarantee than relying on validation.I ran the example against
titiler.core2.2.1 and confirmedexpressiondisappears from the OpenAPI schema whilebidxis unaffected.Happy to split this into two PRs, drop either half, or move the band math section elsewhere if the security page is not the right home.