Andrea Aime

@dependabot rebase

The outstanding PR here https://github.com/mapbox/tilejson-spec/pull/36 may confirm the "never completed" hyphotesis

Making requests out is often easy in most modern languages. However, allowing connection to whatever user provided host can be used to mount a [Server Side Request Forgery attack](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery). Adding...

I'm a bit worried about the size of the resulting API document, installations with thousands of layers are not uncommon (the uncommon ones have hundred of thousands of layers), the...

For reference, GeoServer has been using "Extended CQL" as an expression language for a while, in a few places: * Alternative styling languages, like GeoCSS or YSLD * Vector data...

Say one implements an INSPIRE app-schema or CityGML, and wants to sort on an attribute. That would require an xpath which uses colon. This is a problem IMHO, either consider...

As a related note... in a list of filters, matching 1-1 a list of collections, there might be a need to just accept everything from one of the collections, and...

I've tried to follow @joehni suggestion and override the [setupConverters method](https://github.com/aaime/geoserver/blob/86b71d4deedc8136eb26c10cde1f24babe68edfa/src/main/src/main/java/org/geoserver/config/util/SecureXStream.java#L207). Ended up having some small difficulties with the approach: - The InternalBlackList seems something "important", but it's not visible...

@joehni thanks for your feedback. About "knowing which converters I need", it's not actually/fully true, GeoServer is a pluggable application and developers outside of the core ones can create their...

Agreed this would be pretty useful. I have a case where a query needs to extract the bounds of a polygon, minx,miny,maxx,maxy, for r-tree insertion, and it's round tripping 4...