Older tags are not actively maintained. Please upgrade to a supported version before reporting a vulnerability.

Preferred: Use GitHub Private Vulnerability Reporting to report confidentially. We aim to acknowledge reports within 5 business days.

Fallback: Send an email to info@wps.de with subject [SECURITY] WPS/geoserver – <short description>.

Please do not open a public GitHub issue for security vulnerabilities.

In scope: vulnerabilities in the Alpine base packages (apk packages) or the Java runtime (eclipse-temurin) included in this image.

Out of scope: GeoServer application CVEs (JAR-level). These are version-bound — they are fixed by upgrading GeoServer, not by changing the base image. Report those upstream to the GeoServer project.

Every build is scanned with Trivy. Results are published to the Security tab and attached as CycloneDX SBOM artifacts on each CI run.