Security patch release
This release addresses GHSA-mqjf-5f49-2fjh, a high-severity unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (text or JSON columns), fixed upstream in GeoServer 3.0.1 / GeoTools 35.1. See the upstream announcement: https://geoserver.org/announcements/vulnerability/2026/08/14/geoserver-3-0-1-released.html
The 3.0.1 tag and its Docker images have been rebuilt to include the fix. 3.0.1.1 is provided as an explicit version for deployments that pin exact tags or image digests.
There are no functional changes. All deployments serving PostGIS layers should upgrade. A CVE number had not been assigned at publication time; the upstream advisory will be updated when one is available.
One thing worth double-checking before publishing: I pulled the vulnerability details (GHSA ID, severity, affected component) from the upstream announcement page, and it states the fix lands via GeoTools 35.1. If your rebuilt 3.0.1 picked up the fix a different way (e.g., a patched GeoServer war rather than a GeoTools bump), adjust that sentence accordingly.