etj · May 15, 2026 · May 15, 2026 · May 25, 2026 · May 18, 2026 · Apr 20, 2026
diff --git a/.env.sample b/.env.sample
@@ -248,4 +248,7 @@ DEFAULT_MAX_PARALLEL_UPLOADS_PER_USER=5
 # FORCE_READ_ONLY_MODE=False Override the read-only value saved in the configuration
 
 # Enable or not the XLSX / XLS upload
-XLSX_UPLOAD_ENABLED=False
+XLSX_UPLOAD_ENABLED=False
+
+# List of trusted hosts (format: domain:port) allowed to bypass URL safety validation.
+# SAFE_URL_TRUSTED_HOSTS=[]
diff --git a/.env_dev b/.env_dev
@@ -210,4 +210,4 @@ UPSERT_CHUNK_SIZE= 100
 UPSERT_LIMIT_ERROR_LOG=100
 
 # Enable or not the XLSX / XLS upload
-XLSX_UPLOAD_ENABLED=False
+XLSX_UPLOAD_ENABLED=False
diff --git a/SECURITY.md b/SECURITY.md
@@ -2,17 +2,42 @@
 
 ## Supported Versions
 
-GeoNode versions supported with security updates.
+GeoNode [versions](https://github.com/GeoNode/geonode/wiki/Releases) supported with security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 4.0.x   | :white_check_mark: |
+| 5.1.x   | :white_check_mark: |
 | 5.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| < 5   | :x: |
+
+This approach provides ample time for upgrading ensuring you are always working with a supported GeoNode release.
+
+If your organization is making use of a GeoNode version that is no longer in use by the community all is not lost.
+You can volunteer on the developer list to make additional releases, or engage with one of our
+[Commercial Support](https://geonode.org/providers/) providers.
 
 ## Reporting a Vulnerability
 
-- **DO NOT** send a security alert on the public mailing list or any other public channel
-- **SEND** the report to geonode-psc@lists.osgeo.org and be prapred to collaborate with the GeoNode PSC
+1. **DO NOT** report vulnerabilities on the public mailing list or any other public channel
+2. There are **two options** to report a security vulnerability:
+     - Send the report by email to geonode-psc@lists.osgeo.org and be prepared to collaborate with the GeoNode PSC
+     - Navigate to [Private vulnerability reporting](https://github.com/geonode/geonode/security/advisories/new) and create a new vulnerability report. For more information see [GitHub documentation](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+
+3. There is no expected response time.
+4. Keep in mind participants are volunteering their time, an extensive fix may require fundraising/resources.
 
 Thanks for you support and help!
+
+## Coordinated vulnerability disclosure
+
+Disclosure policy:
+
+1. The reported vulnerability has been verified by working with the GeoNode PSC
+2. GitHub [security advisory](https://github.com/geonode/geonode/security) is used to reserve a CVE number by the GeoNode Organization
+3. A fix or documentation clarification is accepted and backported to active branches
+4. A fix is included for the active branches release downloads ([reelases](https://github.com/GeoNode/geonode/releases), or issued via emergency update)
+6. The CVE vulnerability is published by the GeoNode Organization with mitigation and patch instructions
+
+This represents a balance between transparency and participation that does not overwhelm participants. 
+Those seeking greater visibility are encouraged to volunteer with the [geonode-devel](https://lists.osgeo.org/cgi-bin/mailman/listinfo/geonode-devel) list;
+or work with one of the [commercial support providers](https://geonode.org/providers/) who participate on behalf of their customers.
diff --git a/celery-cmd b/celery-cmd
@@ -16,13 +16,14 @@ CELERY__WORKER_CONCURRENCY=${CELERY__WORKER_CONCURRENCY:-"4"}
 
 # Celery beat settings
 CELERY__BEAT_SCHEDULE=${CELERY__BEAT_SCHEDULE:-"celery.beat:PersistentScheduler"}
+CELERY__BEAT_DB=${CELERY__BEAT_DB:-"/mnt/volumes/statics/celerybeat-schedule"}
 CELERY__BEAT_LOG=${CELERY__BEAT_LOG:-"/var/log/celery_beat.log"}
 
 # Harvester settings
 CELERY__HARVESTER_WORKER_NAME=${CELERY__HARVESTER_WORKER_NAME:-"harvesting_worker@%h"}
 CELERY__HARVESTER_CONCURRENCY=${CELERY__HARVESTER_CONCURRENCY:-"10"}
 CELERY__HARVESTER_AUTOSCALE_VALUES=${CELERY__HARVESTER_AUTOSCALE_VALUES:-"15,10"}
-CELERY__HARVESTER_MAX_MEMORY_PER_CHILD=${CELERY__MAX_MEMORY_PER_CHILD:-"500000"}
+CELERY__HARVESTER_MAX_MEMORY_PER_CHILD=${CELERY__HARVESTER_MAX_MEMORY_PER_CHILD:-"500000"}
 
 # --- FIX: Remove stale Beat pidfile before starting beat ---
 BEAT_PIDFILE="/tmp/celerybeat.pid"
@@ -43,6 +44,7 @@ fi
 
 echo "Starting Celery Beat..."
 $CELERY_BIN -A $CELERY_APP beat --scheduler=$CELERY__BEAT_SCHEDULE \
+    --schedule=$CELERY__BEAT_DB \
     --loglevel=$CELERY__LOG_LEVEL -f $CELERY__BEAT_LOG --pidfile=/tmp/celerybeat.pid &
 
 echo "Starting Default Celery Worker..."
@@ -67,4 +69,4 @@ wait -n
 
 # Exit with the status of the process that exited first
 # Docker will restart the container if this is non-zero (i.e., a failure)
-exit $?
+exit $?
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
@@ -52,7 +52,7 @@ services:
 
   # Nginx is serving django static and media files and proxies to django and geonode
   geonode:
-    image: geonode/nginx:1.28.0-v1
+    image: geonode/nginx:1.31.0-latest
     container_name: nginx4${COMPOSE_PROJECT_NAME}
     env_file:
       - .env
@@ -79,7 +79,7 @@ services:
 
   # Geoserver backend
   geoserver:
-    image: geonode/geoserver:2.28.x-latest
+    image: geonode/geoserver:2.28.4-latest
     container_name: geoserver4${COMPOSE_PROJECT_NAME}
     healthcheck:
       test: "curl -m 10 --fail --silent --write-out 'HTTP CODE : %{http_code}\n' --output /dev/null http://geoserver:8080/geoserver/ows"
@@ -105,7 +105,7 @@ services:
         condition: service_healthy
 
   data-dir-conf:
-    image: geonode/geoserver_data:2.28.x-latest
+    image: geonode/geoserver_data:2.28.4-latest
     container_name: gsconf4${COMPOSE_PROJECT_NAME}
     entrypoint: sleep infinity
     volumes:

diff --git a/docker-compose-geoserver-server.yml b/docker-compose-geoserver-server.yml
@@ -2,7 +2,7 @@ version: '2.2'
 services:
 
   data-dir-conf:
-    image: geonode/geoserver_data:2.28.x-latest
+    image: geonode/geoserver_data:2.28.4-latest
     restart: on-failure
     container_name: gsconf4${COMPOSE_PROJECT_NAME}
     labels:
@@ -13,7 +13,7 @@ services:
       - geoserver-data-dir:/geoserver_data/data
 
   geoserver:
-    image: geonode/geoserver:2.28.x-latest
+    image: geonode/geoserver:2.28.4-latest
     restart: unless-stopped
     container_name: geoserver4${COMPOSE_PROJECT_NAME}
     stdin_open: true

diff --git a/docker-compose-test.yml b/docker-compose-test.yml
@@ -40,7 +40,7 @@ services:
 
   # Nginx is serving django static and media files and proxies to django and geonode
   geonode:
-    image: geonode/nginx:1.28.0-v1
+    image: geonode/nginx:1.31.0-latest
     container_name: nginx4${COMPOSE_PROJECT_NAME}
     env_file:
       - .env_test
@@ -80,7 +80,7 @@ services:
 
   # Geoserver backend
   geoserver:
-    image: geonode/geoserver:2.28.x-latest
+    image: geonode/geoserver:2.28.4-latest
     container_name: geoserver4${COMPOSE_PROJECT_NAME}
     healthcheck:
       test: "curl -m 10 --fail --silent --write-out 'HTTP CODE : %{http_code}\n' --output /dev/null http://geoserver:8080/geoserver/ows"
@@ -106,7 +106,7 @@ services:
         condition: service_healthy
 
   data-dir-conf:
-    image: geonode/geoserver_data:2.28.x-latest
+    image: geonode/geoserver_data:2.28.4-latest
     container_name: gsconf4${COMPOSE_PROJECT_NAME}
     entrypoint: sleep infinity
     volumes:

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -65,7 +65,7 @@ services:
 
   # Nginx is serving django static and media files and proxies to django and geonode
   geonode:
-    image: geonode/nginx:1.28.0-v1
+    image: geonode/nginx:1.31.6-latest
     container_name: nginx4${COMPOSE_PROJECT_NAME}
     env_file:
       - .env
@@ -92,7 +92,7 @@ services:
 
   # Geoserver backend
   geoserver:
-    image: geonode/geoserver:2.28.x-latest
+    image: geonode/geoserver:2.28.5-latest
     container_name: geoserver4${COMPOSE_PROJECT_NAME}
     healthcheck:
       test: "curl -m 10 --fail --silent --write-out 'HTTP CODE : %{http_code}\n' --output /dev/null http://geoserver:8080/geoserver/ows"
@@ -118,7 +118,7 @@ services:
         condition: service_healthy
 
   data-dir-conf:
-    image: geonode/geoserver_data:2.28.x-latest
+    image: geonode/geoserver_data:2.28.5-latest
     container_name: gsconf4${COMPOSE_PROJECT_NAME}
     entrypoint: sleep infinity
     volumes:

diff --git a/docker/base/ubuntu/Dockerfile b/docker/base/ubuntu/Dockerfile
@@ -6,6 +6,8 @@ RUN wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-k
 # will install python3.10
 RUN apt-get install lsb-release -y
 RUN echo "deb https://apt.postgresql.org/pub/repos/apt/ `lsb_release -cs`-pgdg main" |tee  /etc/apt/sources.list.d/pgdg.list
+# Keep GDAL from the Ubuntu archive, pgdg ships newer builds that break libgdal-dev / pip GDAL==3.8.4
+RUN printf 'Package: *gdal*\nPin: release o=apt.postgresql.org\nPin-Priority: -1\n' > /etc/apt/preferences.d/pgdg-no-gdal
 
 # Prepraing dependencies
 RUN apt-get install -y \

diff --git a/docs/mkdocs.yml b/docs/mkdocs.yml
@@ -63,12 +63,12 @@ nav:
         - Attributes Table: "user-guide/maps/maps_configuration/attribute_table.md"
         - Timeline: "user-guide/maps/maps_configuration/timeline.md"
         - Other Menu Tools: "user-guide/maps/maps_configuration/options_menu.md"
-    - Documents:
-      - Upload/Add Documents: "user-guide/documents/upload.md"
+    - Documents: "user-guide/documents/upload.md"
     - GeoStories: "user-guide/geostory/geostory.md"
     - Dashboards: "user-guide/dashboard/dashboard.md"
     - Styling: "user-guide/resource_styling.md"
     - Sharing: "user-guide/sharing.md"
+    - Default Language: "user-guide/default-language.md"
     - Metadata: "user-guide/metadata.md"
   - Administration:
     - GeoNode Admins Guide:
@@ -104,7 +104,6 @@ nav:
     - Customize the look and feel:
       - GeoNode Themes: "admin/gnode_theme/geonode_themes.md"
       - Theming your GeoNode Project: "admin/gnode_theme/theme_geonode_project.md"
-    - Changing the Default Language: "admin/default_lang.md"
     - Thesauri: "admin/thesauri/thesauri.md"
   - Developer Guide: 
     - API Usage: "development/api.md"

diff --git a/docs/src/admin/admin_panel/admin_panel_theming.md b/docs/src/admin/admin_panel/admin_panel_theming.md
@@ -30,15 +30,15 @@ Just below the `Description` field, you will find the `Enabled` checkbox, which
 *Theme Name and Description*
 ///
 
-## Jumbotron and Get Started link
-
 !!! Note
     Remember, every time you want to apply some changes to the theme, you **must** save the theme and reload the GeoNode browser tab.
 
     In order to quickly switch back to the Home page, you can just click the `VIEW SITE` link in the top-right corner of the Admin dashboard.
 
     ![](img/theming/view_site.png){ align=center }
 
+## Jumbotron and Get Started link
+
 The next section allows you to define the first important theme properties. This part involves the GeoNode main page sections.
 
 ![](img/theming/theme_properties.png){ align=center }

diff --git a/docs/src/admin/admin_panel/group.md b/docs/src/admin/admin_panel/group.md
@@ -1,7 +1,7 @@
 ## Creating a Group
 
-| In GeoNode is possible to create new groups with set of permissions which will be inherited by all the group members.
-| The creation of a Group can be done both on the GeoNode UI and on the *Admin Panel*, we will explain how in this paragraph.
+In GeoNode is possible to create new groups with set of permissions which will be inherited by all the group members.
+The creation of a Group can be done both on the GeoNode UI and on the *Admin Panel*, we will explain how in this paragraph.
 
 The `Create Groups` link of *About* menu in the navigation bar allows administrators to reach the *Group Creation Page*.
 
@@ -26,9 +26,9 @@ The new created group will be searchable in the *Groups List Page*.
 !!! note "Important notes"
     The `Create a New Group` button on the *Groups List Page* allows to reach the *Group Creation Form*.
 
-| As already mentioned above, groups can also be created from the Django-based *Admin Interface* of GeoNode.
-| The *Groups* link of the *AUTHENTICATION AND AUTHORIZATION* section allows to manage basic Django groups which only care about permissions.
-| To create a GeoNode group you should take a look at the *GROUPS* section.
+As already mentioned above, groups can also be created from the Django-based *Admin Interface* of GeoNode.
+The *Groups* link of the *AUTHENTICATION AND AUTHORIZATION* section allows to manage basic Django groups which only care about permissions.
+To create a GeoNode group you should take a look at the *GROUPS* section.
 
 ![groups_admin_section](img/groups_admin_section.png)
 
@@ -143,8 +143,8 @@ On the *Group Profile Form* page you can insert a logo from your disk by click o
 ![editing_group_logo](img/editing_group_logo.png)
 
 
-| Click on `Update` to apply the changes.
-| Take a look at your group now, you should be able to see that logo.
+Click on `Update` to apply the changes.
+Take a look at your group now, you should be able to see that logo.
 
 ![group_logo](img/group_logo.png)
 
@@ -156,12 +156,12 @@ The `Manage Group Members` link opens the *Group Members Page* which shows *Grou
 **Managers** can edit group details, can delete the group, can see the group activities and can manage memberships.
 Other **Members** can only see the group activities.
 
-| In Public Groups, users can join the group without any approval.
-  Other types of groups require the user to be invited by the group managers.
-| Only group managers can *Add new members*.
-  In the picture below, you can see the manager can search for users by typing their names into the *User Identifiers* search bar.
-  Once found, he can add them to the group by clicking the `Add Group Members` button.
-  The *Assign manager role* flag implies that all the users found will become managers of the group.
+In Public Groups, users can join the group without any approval.
+Other types of groups require the user to be invited by the group managers.
+Only group managers can *Add new members*.
+In the picture below, you can see the manager can search for users by typing their names into the *User Identifiers* search bar.
+Once found, he can add them to the group by clicking the `Add Group Members` button.
+The *Assign manager role* flag implies that all the users found will become managers of the group.
 
 ![add_new_member](img/add_new_member.png)
 
@@ -171,4 +171,4 @@ The following picture shows you the results.
 ![new_members](img/new_members.png)
 
 
-If you want to change the role of group members after adding them, you can use the "promote" button to make a member into a manager, and the "demote" button to make a manager into a regular member.
+If you want to change the role of group members after adding them, you can use the "promote" button to make a member into a manager, and the "demote" button to make a manager into a regular member.
diff --git a/docs/src/admin/admin_panel/oauth.md b/docs/src/admin/admin_panel/oauth.md
@@ -1,11 +1,11 @@
 # OAuth2 Access Tokens
 
 This small section won't cover entirely the GeoNode OAuth2 security integration, this is explained in detail in other sections of the documentation
-(refer to :ref:`oauth2_fixtures_and_migration` and :ref:`oauth2_tokens_and_sessions`).
+(refer to the [Django OAuth Toolkit Admin Setup](../../setup/configuration/components/geonode_security_backend/geonode_security_backend.md#django-oauth-toolkit-admin-setup) and [GeoNode / GeoServer Authentication Mechanism](../../setup/configuration/components/geonode_security_backend/geonode_security_backend.md#geonode-geoserver-authentication-mechanism) sections).
 
-Here we will focus mainly on the :guilabel:`Admin > DJANGO/GEONODE OAUTH TOOLKIT` panel items with a specific attention to the ``Access tokens`` management.
+Here we will focus mainly on the `Admin > DJANGO/GEONODE OAUTH TOOLKIT` panel items with a specific attention to the ``Access tokens`` management.
 
-The :guilabel:`Admin > DJANGO/GEONODE OAUTH TOOLKIT` panel (as shown in the figure below) allows an admin to manage everything related to
+The `Admin > DJANGO/GEONODE OAUTH TOOLKIT` panel (as shown in the figure below) allows an admin to manage everything related to
 GeoNode OAuth2 grants and permissions.
 
 As better explained in other sections of the documentation, this is needed to correctly handle the communication between GeoNode and GeoServer.
@@ -14,24 +14,24 @@ As better explained in other sections of the documentation, this is needed to co
 
 Specifically from this panel an admin can create, delete or extend OAuth2 ``Access tokens``.
 
-The section :ref:`oauth2_tokens_and_sessions` better explains the concepts behind OAuth2 sessions; we want just to refresh the mind here
+The [GeoNode / GeoServer Authentication Mechanism](../../setup/configuration/components/geonode_security_backend/geonode_security_backend.md#geonode-geoserver-authentication-mechanism) section better explains the concepts behind OAuth2 sessions; we want just to refresh the mind here
 about the basic concepts:
 
-* If the `SESSION_EXPIRED_CONTROL_ENABLED <../../basic/settings/index.html#session-expired-control-enabled>`_ setting is set to `True` (by default it is set to `True`)
+* If the `SESSION_EXPIRED_CONTROL_ENABLED` setting is set to `True` (by default it is set to `True`)
   a registered user cannot login to neither GeoNode nor GeoServer without a valid ``Access token``.
 
 * When logging-in into GeoNode through the sign-up form, GeoNode checks if a valid ``Access token`` exists and it creates a new one if not, or extends
   the existing one if expired.
 
-* New ``Access tokens`` expire automatically after `ACCESS_TOKEN_EXPIRE_SECONDS <../../basic/settings/index.html#access-token-expire-seconds>`_ setting (by default 86400)
+* New ``Access tokens`` expire automatically after the [`ACCESS_TOKEN_EXPIRE_SECONDS`](../../setup/configuration/settings.md) setting (by default 86400)
 
 * When an ``Access token`` expires, the user will be kicked out from the session and forced to login again
 
 ## Create a new token or extend an existing one
 
-It is possible from the :guilabel:`Admin > DJANGO/GEONODE OAUTH TOOLKIT` panel to create a new ``Access token`` for a user.
+It is possible from the `Admin > DJANGO/GEONODE OAUTH TOOLKIT` panel to create a new ``Access token`` for a user.
 
-In order to do that, just click on the :guilabel:`Add` button beside ``Access tokens`` topic
+In order to do that, just click on the `Add` button beside ``Access tokens`` topic
 
 ![oauth2-tokens/admin-panel-tokens-0001](img/oauth2-tokens/admin-panel-tokens-0002.png)
 
@@ -58,7 +58,7 @@ select the followings:
 
     ![oauth2-tokens/admin-panel-tokens-0003b](img/oauth2-tokens/admin-panel-tokens-0003c.png)
 
-5. ``Expires``; select an expiration date by using the :guilabel:`date-time` widgets.
+5. ``Expires``; select an expiration date by using the `date-time` widgets.
 
     ![oauth2-tokens/admin-panel-tokens-0003b](img/oauth2-tokens/admin-panel-tokens-0003d.png)
 
@@ -67,7 +67,7 @@ select the followings:
     ![oauth2-tokens/admin-panel-tokens-0003b](img/oauth2-tokens/admin-panel-tokens-0003e.png)
 
 
-Do not forget to :guilabel:`Save`.
+Do not forget to `Save`.
 
 From now on, GeoNode will use this ``Access Token`` to control the user session (notice that the user need to login again if closing the browser session),
 and the user will be able to access the OWS Services by using the new ``Access Token``, e.g.:
@@ -87,4 +87,4 @@ force its session to expire.
 
 Remember that the user could activate another session by logging-in again on GeoNode with its credentials.
 
-In order to be sure the user won't force GeoNode to refresh the token, reset first its password or de-activate it.
+In order to be sure the user won't force GeoNode to refresh the token, reset first its password or de-activate it.