GratisGIS v0.9.2

Adds a version badge so demo testers know which build they are on: landing page footer, bottom of the user menu, and /api/portal-info. Release builds link to their notes; between-releases builds show the exact describe string. Deploys stamp the version automatically.

GratisGIS v0.9.1

Patch release on the same day as v0.9.0.

The hardened golden-refresh pipeline caught a real gap on its first run: the pre-snapshot purge refuses to act when trash rows arrive without an owner, and the trash endpoint had never serialized one. The trash list now carries the same lean owner projection as the live list, and the purge script requests the API's real page cap.

Full details in CHANGELOG.md.

GratisGIS v0.9.0

GratisGIS v0.9.0 is the first tagged release: a self-hosted geospatial
portal with web maps on PostGIS, forms and an offline field PWA, web
app templates, a visual tool builder, OGC API endpoints, an ArcGIS
Online importer, GeoParquet in and out, and 3D point clouds, terrain,
and analysis, deployed on a single host with Docker Compose. It also
carries a large security and correctness wave from the pre-release
review. From this release forward, installs and deploys track release
tags; see
docs/UPGRADING.md
and
docs/VERSIONING.md.
Until v1.0.0, minor releases may include breaking changes, each called
out in the changelog.

Added

Everything is new in a first release. What ships, briefly:

• The portal: organizations, users, groups, folders, an item catalog,
  and sharing with row, column, and geographic limits, on top of an
  append-only observation-log engine with Cedar geometry-aware
  authorization.
• Web maps authored on PostGIS-backed data layers with vector tile
  rendering, drawings, scratch maps, live PostgreSQL/PostGIS
  connections, and print/PDF layouts.
• Forms and field data collection: form authoring, submissions, and an
  offline-capable field PWA.
• Web apps: viewer, editor, and custom widget apps built in the App
  Builder, with seeded app and print templates.
• Analysis: derived-layer tools, a visual tool builder with OSM as a
  first-class source, an in-browser analyze panel, and a server-side
  analysis workbench (contours, viewshed, steepness, height above
  ground, elevation profiles, SAM-assisted outline capture).
• 3D: COPC point cloud upload, merging, and streaming, plus terrain
  built from lidar elevation layers.
• Interoperability: OGC API Features, Tiles, Styles, and Records under
  /api/public/ogc; GeoParquet import and export; an ArcGIS Online
  content importer and Esri WebMap JSON import/export; an MCP server
  (apps/portal-mcp). A QGIS plugin lives in its own repository.
• Operations: single-host Docker Compose deployment with a one-command
  installer, guided setup, health checks, admin backup and restore,
  five UI languages, and one-click sample data.

Changed

• infra/install.sh and infra/deploy.sh now check out the newest
  release tag by default instead of tracking main. Setting GG_REF
  overrides the choice with a tag, branch, or commit sha.
• Breaking: GET /api/items now returns the narrow item shape by
  default and paginates (default page 500, hard cap 1000). Pass
  full=1 for full data_json payloads and page with limit and
  offset.
• The service worker replays queued field edits through one offline
  queue with Background Sync, trims the runtime tile cache, and purges
  per-user caches on sign-out.
• Observation partition maintenance runs on a schedule inside
  Postgres (the pg_partman background worker), and premade future
  partitions drop from 24 to 4, cutting how many partitions each hot
  query probes.
• Infrastructure hardening: deploys, golden snapshots, restores, and
  the nightly demo reset share one lock; snapshot and restore verify
  their artifacts before any destructive step; dependent services wait
  on a Keycloak healthcheck; container memory budgets are sized to the
  reference 8 GB box.

Fixed

• Ghost features: filtered reads (vector tiles, feature search, the
  geocoder, derived layers, bbox and clip reads, exports) now collapse
  each feature to its latest version before applying filters, so
  deleted and superseded versions no longer resurface.
• Retried feature creates that carry a client-supplied id are
  recognized and deduplicated under an advisory lock instead of
  inserting duplicate features.
• Raster protocols (PMTiles, COG) are re-asserted at map init rather
  than trusted from a cached flag, and production web builds use
  webpack, ending the dual maplibre-instance tile failures.
• OGC API Features paging emits next links again and no longer
  reports a misleading numberMatched.
• Imports: replace-mode truncation runs inside the COPY transaction so
  a failed replace rolls back; stale-job recovery runs periodically;
  cancelled jobs stop reporting phantom inserted rows.
• Point clouds: merge timeouts are configurable, scratch space is
  checked up front, worker output no longer deadlocks on a full pipe,
  and concurrent API writes are no longer clobbered.
• Analysis jobs carry a heartbeat and a reclaim sweep, so a killed
  worker no longer strands jobs as running forever, and queued or
  running jobs can be cancelled.
• Housekeeping gained a reconciliation sweep that removes orphaned
  uploads left in object storage by crashed jobs.
• Feature search and the geocoder can run on per-field trigram indexes
  (admin rebuild action) instead of full scans.
• Folder edits can send an optimistic-concurrency precondition and get
  a 409 instead of silently overwriting a concurrent save.
• Map: terrain rebuilds when a different DEM is picked, drawings
  survive basemap swaps, vector and GeoJSON sources keep their caches
  across style-only changes (no blink on opacity drags), and assorted
  popup, selection, and refetch races are fixed.
• Sessions: a failed token refresh is treated as signed out, so public
  pages fall back to the anonymous view instead of erroring.

Security

• SSRF hardening: server-side fetches of user-supplied URLs
  (thumbnails, geocoding, the ArcGIS Online importer) revalidate every
  redirect hop and block internal address ranges.
• Stored XSS closed: uploaded SVGs are served as attachments, response
  disposition derives from the actually served content type, and
  serves carry nosniff.
• Object storage keys for tile layers and feature attachments are
  pinned to their expected prefixes, and serving reads by key through
  the S3 SDK instead of stored URLs.
• Cross-organization gaps closed in group administration, comment
  editing and deletion, and feature attachments.
• Zip ingestion runs in-process with traversal and symlink rejection,
  decompression and entry caps, and per-entry CRC checks.
• The web proxy rejects dot segments before allowlist matching.
• The Keycloak master realm is blocked at the edge, the materialized
  realm import file is no longer world-readable, and a root
  .dockerignore keeps secrets out of image build contexts.
• Dependency updates for published CVEs: Next.js 16.2.11, next-auth
  4.24.15, sharp, fast-uri, postcss, brace-expansion, tar, and the
  @hono/node-server override.

Full changelog:
CHANGELOG.md

MobileSAM ONNX models v1

MobileSAM exported to ONNX for the GratisGIS magic-outline digitizing tool.

Provenance: exported from the official MobileSAM checkpoint (weights/mobile_sam.pt, Apache-2.0, https://github.com/ChaoningZhang/MobileSAM) using samexporter (encoder) and MobileSAM's own scripts/export_onnx_model.py (decoder, --return-single-mask --gelu-approximate --opset 17, legacy TorchScript exporter). torch 2.10.0+cpu, onnx 1.20.1.

• mobilesam-encoder.onnx: image encoder. Input input_image float32 (1, 3, 1024, 1024), SAM normalization (mean 123.675/116.28/103.53, std 58.395/57.12/57.375). Output image embeddings (1, 256, 64, 64). Runs server-side in the analysis worker.
• mobilesam-decoder.onnx: prompt encoder + mask decoder, single-mask. Runs in the browser via onnxruntime-web.

SHA256SUMS.txt covers both files; the server Dockerfiles pin these hashes. MobileSAM's Apache-2.0 license text is attached.