3.8.1 - 2026-08-19

• do not crash on permissions change while realtime is on by @yohanboniface in #3471

3.8.0 - 2026-08-18

This release is mainly about preparing the switch from Leaflet to OpenLayers.

New mandatory setting: AJAX_PROXY_CACHE_DIR
(used for caching proxied request, now done in python instead of via Nginx).

Bug fixes

• read OPENROUTESERVICE_HOST from env by @rapenne-s in #3309
• never force panel mode in portrait/mobile screens by @yohanboniface in #3332
• do not crash when datalayer file is missing by @yohanboniface in #3363
• fix crash when tilelayer is an int by @yohanboniface in #3362
• workaround memory leak in GeoDjango/GEOS by @yohanboniface in #3360
• do not crash when map settings are NULL by @yohanboniface in #3361
• reintegrate the proxy in python by @yohanboniface in #3330
• do not crash when tilelayer url is invalid by @yohanboniface in #3463
• do not eat uMap markdown-like syntax in translations by @yohanboniface in #3464
• don't overlay max/minZoom override tilelayer by @yohanboniface in #3466
• fix crash on user list admin page by @yohanboniface in #3451
• align popup content for RTL languages by @ergs0204 in #3432
• fix overlay opacity initial value by @yohanboniface in #3436
• fix conflict between limitBounds and tilelayer minZoom by @yohanboniface in #3440
• also show show/total counter in browser when filtering by bbox
• redraw cluster on moveend, and pass correct zoom arg to flyTo by @yohanboniface in #3427
• do not share loader event between maps by @yohanboniface in #3418
• only show the more button if at least one control is in hidden by @yohanboniface in #3419
• be more defensive for invalid datetime by @yohanboniface in #3420
• do not register a new url on each hash change by @davidbgk in #3422
• use schema to validate a value for a given property by @yohanboniface in #3423

Internal changes

• reduce database queries for map detail view by @davidbgk in #3430
• update deprecated OAuth backends in local.py.sample by @AlexVplle in #3290
• docs: mention data sources in Québec / Canada by @dhdaines in #3285
• docs: update local settings and ASGI docs by @dhdaines in #3283
• docs: minimally document the administration site by @dhdaines in #3297
• fix build and document ors host variable by @rapenne-s in #3310
• allow testing without postgres superuser by @dhdaines in #3295
• more decoupling from Leaflet: introduce MapProxy, remove direct calls umap<=>leafletMap, use our events… in #3343, #3336, #3338, #3339, #3369, #3381, #3334, #3335
• lazy load some modules (importers, share, browser, caption) by @yohanboniface in #3370, #3396, #3398, #3397, #3399, #3400, #3401, #3404, #3405, #3406
• rename SyncEngine to Journal, and deal with async UI actions by @yohanboniface in #3368
• replace Leaflet.Photon by an internal autocomplete class by @yohanboniface in #3377
• set global.JSDOM before actually running the js tests by @yohanboniface in #3403
• upgrade Django to 6.0.x by @yohanboniface in #3411
• rename uMap to App by @yohanboniface in #3407
• use uv for dev and ci by @yohanboniface in #3412
• upgrade python-social-auth and social-auth-app-django by @yohanboniface in #3415
• add routing in the /stats endpoint by @yohanboniface in #3416

New Contributors

• @AlexVplle made their first contribution in #3290
• @dhdaines made their first contribution in #3285
• @rapenne-s made their first contribution in #3309
• @ergs0204 made their first contribution in #3432

3.7.3 - 2026-04-08

• cloning a map should adapt layer parents by @yohanboniface in #3282
• add missing semicolon so that nginx is running out of the box with docker by @tpummer in #3280

New Contributors

• @tpummer made their first contribution in #3280

3.7.2 - 2026-04-07

• do not show bottom bar when in noControl mode by @yohanboniface in #3267
• do not crash if parent is missing in layers_tree by @yohanboniface in #3277
• do not open layers by default in browser by @yohanboniface in #3278

3.7.1 - 2026-04-02

• Small fixes in caption rendering by @yohanboniface in #3266
• fix: check debounce property on the right object by @yohanboniface in #3268
• fix: fix saving a not yet loaded layer dragged by @yohanboniface in #3269

3.7.0 - 2026-04-02

New features

• allow to group layers by @yohanboniface in #3151
• allow to use a custom host for OpenRouteService by @yohanboniface in #3262
• add a link to open location in osm.org by @yohanboniface in #3263

Bug fixes

• fix copiable-input duplicated at each share panel redraw by @yohanboniface in #3257
• use natural sort for choices filters by @yohanboniface in #3260
• duplicate value in enum should not break the filters by @yohanboniface in #3259

3.6.3 - 2026-03-11

What changed

• make sure map geojson view honour share_status
• move all views permissions to decorators
• escape strings coming from translators
• sanitize vars in templates when source is untrusted
• always redirect to user_dashboard after map delete
• set CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE to True by default
• use ipaddress to validate private IPs
• proper way to call URLValidator
• remove showcase map/view

Thanks Stefan Vink from Radically Open Security for finding those issues.
Thanks NLnet for funding this security audit work.

3.6.2 - 2026-02-25

• fix limitBounds not honoured at load by @yohanboniface in #3221
• fixed the environment block and added docker.io for podman support by @DiabeticTurtle in #3187
• update logout redirect URL to use settings by @fabriziopicconi in #3071
• enhance admin for managing maps by @yohanboniface in #3223
• make login/logout redirect work in yunohost integration and more by @yohanboniface in #3220
• allow to search maps by user/id/deleted status in cli by @yohanboniface in #3222

New Contributors

• @DiabeticTurtle made their first contribution in #3187
• @fabriziopicconi made their first contribution in #3071

3.6.1 - 2026-02-02

• do not assign Field method to Rule by @yohanboniface in #3181

3.6.0 - 2026-01-28

New features

• do not add features and filters in data browser DOM until user use them by @yohanboniface in #3165
• add management command to search, delete, block and restore maps by @yohanboniface in #3156

Bug fixes

• be more defensive when computing handleLimitBounds by @yohanboniface in #3130
• be more defensive when using "tilelayer" property by @yohanboniface in #3131
• code crash with a geojson > 2.5Mo after a conflict by @yohanboniface in #3141
• do not try to sync datalayer objects by @yohanboniface in #3163
• allow to use choices filter with a number field by @yohanboniface in #3178
• format description in route popup template in #3177

Internal changes

• use ESM version of Leaflet.LocateControl by @yohanboniface in #3137
• reintegrate logic of Leaflet.Loading (unmaintained) by @yohanboniface in #3140
• use ESM version of Leaflet.Photon by @yohanboniface in #3142
• reintegrate hash (leaflet.hash is unmaintained) by @yohanboniface in #3143