• cloning a map should adapt layer parents by @yohanboniface in #3282
• add missing semicolon so that nginx is running out of the box with docker by @tpummer in #3280

New Contributors

• @tpummer made their first contribution in #3280

• do not show bottom bar when in noControl mode by @yohanboniface in #3267
• do not crash if parent is missing in layers_tree by @yohanboniface in #3277
• do not open layers by default in browser by @yohanboniface in #3278

• Small fixes in caption rendering by @yohanboniface in #3266
• fix: check debounce property on the right object by @yohanboniface in #3268
• fix: fix saving a not yet loaded layer dragged by @yohanboniface in #3269

New features

• allow to group layers by @yohanboniface in #3151
• allow to use a custom host for OpenRouteService by @yohanboniface in #3262
• add a link to open location in osm.org by @yohanboniface in #3263

Bug fixes

• fix copiable-input duplicated at each share panel redraw by @yohanboniface in #3257
• use natural sort for choices filters by @yohanboniface in #3260
• duplicate value in enum should not break the filters by @yohanboniface in #3259

What changed

• make sure map geojson view honour share_status
• move all views permissions to decorators
• escape strings coming from translators
• sanitize vars in templates when source is untrusted
• always redirect to user_dashboard after map delete
• set CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE to True by default
• use ipaddress to validate private IPs
• proper way to call URLValidator
• remove showcase map/view

Thanks Stefan Vink from Radically Open Security for finding those issues.
Thanks NLnet for funding this security audit work.

• fix limitBounds not honoured at load by @yohanboniface in #3221
• fixed the environment block and added docker.io for podman support by @DiabeticTurtle in #3187
• update logout redirect URL to use settings by @fabriziopicconi in #3071
• enhance admin for managing maps by @yohanboniface in #3223
• make login/logout redirect work in yunohost integration and more by @yohanboniface in #3220
• allow to search maps by user/id/deleted status in cli by @yohanboniface in #3222

New Contributors

• @DiabeticTurtle made their first contribution in #3187
• @fabriziopicconi made their first contribution in #3071

• do not assign Field method to Rule by @yohanboniface in #3181

New features

• do not add features and filters in data browser DOM until user use them by @yohanboniface in #3165
• add management command to search, delete, block and restore maps by @yohanboniface in #3156

Bug fixes

• be more defensive when computing handleLimitBounds by @yohanboniface in #3130
• be more defensive when using "tilelayer" property by @yohanboniface in #3131
• code crash with a geojson > 2.5Mo after a conflict by @yohanboniface in #3141
• do not try to sync datalayer objects by @yohanboniface in #3163
• allow to use choices filter with a number field by @yohanboniface in #3178
• format description in route popup template in #3177

Internal changes

• use ESM version of Leaflet.LocateControl by @yohanboniface in #3137
• reintegrate logic of Leaflet.Loading (unmaintained) by @yohanboniface in #3140
• use ESM version of Leaflet.Photon by @yohanboniface in #3142
• reintegrate hash (leaflet.hash is unmaintained) by @yohanboniface in #3143

This release is mainly making uMap installable in YunoHost as an official app.

• adaptations for YunoHost installation in #3122
• add "how to" deploy with Dokku in documentation in #3115
• improve deployment documentation by @davidbgk in #3125
• do not fail when classified colors are named colors by @yohanboniface in #3124

• fix search by lat/lng