Release Notes

10.1 Release Notes

DSpace 10.1 provides security patches, bug fixes & performance improvements to the 10.x platform. No new features are provided.  As such this release should be an easier upgrade for sites already running 10.x.

10.1 Security Fixes

10.1 Breaking Changes

Some fixes in 10.1 required major code or configuration changes. The following changes may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

10.1 Major Bug Fixes and Improvements

• Fixed an issue with XML encoding in the OAI-PMH interface. #12409 (Donated by Atmire)

• Fixed "Unknown metadata format" errors occurring on OAI-PMH interface due to hard-coded oai_dc prefix. #9770, #10106 (Donated by Acervos Digitais)
• Fixed an issue where Health actuator would return DOWN status for missing SEO configuration. #12672 (Donated by 4Science)
• Fixed bug where “New collection” menu option was not visible to Community Admins. #5856 (Donated by Toni Prieto)
• Fixed several errors that occurred when running the healthcheck command. #10805 (Donated by Nicholas Woodward)
• Fixed bug where DOI was not mapped into DSpace when importing from Pubmed records. #11961 (Donated by D-Consultores)
• Improved the external sources REST endpoints by restricting them to authenticated users only. #12660
• Fixed other small bugs.  See Changes in 10.x for a list of all changes.

10.1 New/Updated Language support

• German (Deutsch) language updates donated by Sascha Szott (saschaszott)

10.1 Acknowledgments

10.0 Release Notes

DSpace 10.0 is a major release of the DSpace platform.  It provides new features and improvements, along with bug fixes.  You should be aware that all major releases may provide some "breaking changes" (major changes that may impact your local customizations).

Security Fixes

• Fix for CVE-2026-49832 (high severity). NOTE: Fix is also included in 9.3, 8.4 and 7.6.7. Remote Code Execution (RCE) possible in Velocity templates used by LDN (Linked Data Notifications) when COAR Notify is enabled.
• Fix for CVE-2026-49833 (moderate severity). NOTE: Fix is also included in 9.3, 8.4 and 7.6.7. Path traversal vulnerability possible in LDN (Linked Data Notifications) message generation when COAR Notify is enabled.
• Fix for CVE-2026-49831 (moderate severity). NOTE: Fix is also included in 9.3, 8.4 and 7.6.7. Path Traversal Vulnerability is possible in Curation Task Reporter output path.
• Fix for CVE-2026-49830 (moderate severity). ORE resource URI does not validate scheme for non-web resources when harvesting OAI content.
• Patch for CVE-2026-27739 in Angular SSR (critical severity). All versions of Angular SSR (Server Side Rendering) contain a critical SSRF (Server-Side Request Forgery) vulnerability.  This SSRF vulnerability may be possible to exploit in DSpace sites that are not running DSpace behind a well-configured proxy (see mailing list announcement).  This release of DSpace updates to a patched version of Angular along with additional protection via the new "ui > baseUrl" setting (see "Breaking Changes" below)
• Patch for CVE-2025-66516 / CVE-2025-54988 in Apache Tika  (critical severity)  NOTE: Fix was already included in 9.2, 8.3 and 7.6.6.  All versions of Apache Tika prior to version 3.2.2 contain a critical XML External Entity (XXE) vulnerability.  This XXE vulnerability may be possible to exploit in DSpace if an attacker has submitter privileges. See #11678 for more details.
  
  • After upgrading, we recommend all sites recreate text extracted files.  This is a safety measure to ensure that none of those text extracted files contain unexpected information because of a prior exploit of this XXE vulnerability.  To recreate your text extracted files, run: 

    # This command will force all current text-extracted files to be deleted and recreated.
    ./dspace filter-media -f -p "Text Extractor"

• Fix for potential XPath Injection in Controlled Vocabulary lookup. NOTE: Fix was already included in 9.2, 8.3 and 7.6.6.  This vulnerability only allows an attacker access to the controlled vocabulary XML file(s), which are already public in source code. So, this vulnerability poses no security risk but it has been patched for future code safety. See #11042 and #11075 (Reported by odaysec. Fixed by odaysec and Mark Wood)
• Fix for CVE-2025-53621 (moderate severity) NOTE: Fix was already included in 9.1, 8.2 and 7.6.4.  XML External Entity (XXE) injection possible in import via Simple Archive Format (SAF) or import from external sources. See security advisory or mailing list “security notice” for details. 
• Fix for  CVE-2025-53622 (moderate severity). NOTE: Fix was already included in 9.1, 8.2 and 7.6.4.  Path traversal vulnerability in Simple Archive Format (SAF) package import via “contents” file. See security advisory or mailing list “security notice” for details.
• Updated LDAPAuthentication to Spring LDAP in order to remove insecure JNDI usage. See #11656 (Reported by Sascha Szott. Fixed by Johnny Mendes do Carmo)
• This release also includes many dependency updates in order to keep all DSpace sites secure. Some of these updates patch vulnerabilities that have been reported by those dependencies. But no exploits of these vulnerabilities have been confirmed in DSpace.

New User Features

• Features ported to DSpace from DSpace-CRIS via the ongoing merger.
  • Edit item in Submission mode.  Items now have a new "Edit" menu which allows you to edit the details of the item using the submission form.  See #11964 and #5145 (Donated by 4Science)
  • Metadata-level security controls. Individual metadata fields can be configured to support security settings (e.g. public/private) via the new "Edit" form. For example you can enable this for Researcher Profiles to allow researchers to control whether their birthday or email address are public/private. Included in #11964 and #5145 (Donated by 4Science)
  • Shared Workspaces. It is possible to enable "Shared workspaces" for individual collections. When enabled, all collection submitters can share their in-progress submissions, allowing for collaborative editing/finalization of submissions to that collection. Included in #11964 and #5145 (Donated by 4Science)
  • Submission form linked to collection via UI. It is possible to select which submission form to use for a collection using a dropdown on the collection edit page; previously only accessible through config. Included in #11964 and #5145 (Donated by 4Science)
  • Custom URLs for Items.  Items can have human-friendly URLs instead of UUID-based paths. When enabled, custom URLs can be manually set by a user or auto-generated from metadata. See #11549 and #4814 for more details. (Donated by 4Science)
  • Share Content via Social Network.  An optional sharing bar can be enabled on the homepage, search results and item pages.  This bar allows users to quickly share DSpace content on social networks, via email, etc.  See #5112  (Ported by PCG Academia, written by 4Science)
  • Basic Content Management System features for Homepage & User Agreement. You can now edit the Homepage header, footer and news section via an Administrative UI form that supports HTML and Markdown.  This includes editing translations of that content to other supported languages via the same form. Similarly the End User Agreement can also be edited via that form. See #5106 (Ported by PCG Academia, written by 4Science)
  • Audit Trails for item changes. The auditing system logs events that modify the state of DSpace objects, and administrators are able to inspect and filter logs.  This feature can be toggled in config via audit.enabled. See #11072 and #4576 for more details.  (Donated by 4Science)
  • Download panel on Item pages.  Optionally, you can enable display of all files at the top of the Item page via a Download box/panel by enabling the new "showDownloadLinkAsAttachment" UI configuration. See #5132 (Donated by 4Science)
  • Author access to their own restricted files.  Optionally, you can allow authors access to download restricted (or embargoed) files that they submitted. See #5132 (Donated by 4Science) 
  • Authority framework enhancements.  Several authority framework enhancements have been migrated to DSpace including management of relationships and virtual metadata via authority (both similar to DSpace-CRIS).  These features allow for optional early migration of DSpace-CRIS entities into DSpace 10.0. See #11718 and #4956 (Donated by 4Science) 
  • Nested metadata for items. It is now possible to group related metadata fields together via "group" or "inline-group" input types in Submission forms.  This can be used to couple author names with their affiliations (or similar), similar to DSpace-CRIS.  See #11945 and #5097 (Donated by 4Science)
  • Sending emails to fixed recipients.  When the relevant email configurations are enabled, all emails are sent to "catchAll" recipients instead of original recipients.  Especially useful for testing or development environments. See #11447 (Donated by 4Science)
• Unified treatment of DOIs. DOIs generated within DSpace are now stored consistently in dc.identifier.doi, and publisher or externally generated DOIs are stored in dc.relation.hasversion. There is also a new doi-migrate command to help migrate DOI metadata between fields and normalize their format, and DOI is shown on publication pages.  See #11545 and #5133 (Donated by The Library Code with the support of Technische Universität Dortmund and Deutsche Forschungsgemeinschaft DFG)
  • Registration of DOIs with Crossref. It is possible to register new DOIs in DSpace with Crossref. See #11962 (Donated by The Library Code with the support of Crossref.)
• Editor relationship. There is a new default entity relationship for editors of a Publication. These can be Persons or OrgUnits. See #11881 (Donated by The Library Code with the support of Technische Universität Dortmund and Deutsche Forschungsgemeinschaft DFG)
• Dataset entity type. There is a new entity model for Dataset, in order to support more institutions using DSpace as a repository for Research Data. See #11969 and #5137 (Donated by Eike Löhden)
• Asynchronous batch deletion. In order to improve performance for large-scale deletions of Communities, Collections, and Items, a deletion process now runs in the background. See #11068 and #4570 (Donated by 4Science)
• New request item strategy. It is now possible to send emails based on bitstream's contact metadata. See #10436 (Donated by Paulo Graça)

Breaking Changes

The following major changes may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

• Upgrade to Angular 20.  This requires removing all standalone: true declarations from custom components (@Component) .  If you forget to make this change, then lint checks fail during your Angular build and let you know what needs to be updated. #4804
• Node v20.19+ is now required. Because of the upgrade to Angular 20, you must use Node v20.19+, v22.x or v24.x to build and run the DSpace frontend (UI).
• JDK 21 is now required on the backend. The DSpace REST API / backend now requires Java/JDK version 21 (at a minimum) to build and run. This has been upgraded from JDK 17 in past releases. #11739
• Frontend's new "baseUrl" setting is required for Server Side Rendering (SSR). The frontend configuration has a newly added "ui > baseUrl" setting which should match the value of "dspace.ui.url" on the backend. This setting is REQUIRED for Server-Side-Rendering (SSR), robots.txt and redirects to function properly.  Along with an update to the latest version of Angular 20, this new setting also helps to patch against the Angular SSR vulnerability CVE-2026-27739.
• Theme configuration has been updated and simplified. You will need to update your existing themes to use the new 10.0 theme configuration. Notes on the upgrade process are available in the "Upgrading from 9.x to 10.x" section of the User Interface Customization page.
• The "Edit this item" menu on an Item page has been renamed "Administer".  While visiting an Item page (while logged in as an Administrator), you'll see the options available have changed. The "Edit" menu now brings you to the new Edit item in Submission mode feature, while the "Administer" menu will bring you to all previously existing Item editing tools.
• Rename "defaultLanguage" configuration to "fallbackLanguage".  This just aligns with the naming convention for the @ngx-translate/core module that we use. See User Interface Configuration
• Replaced "webui.content_disposition_format" with "webui.content_disposition_inline" - In prior versions the "webui.content_disposition_format" setting (in dspace.cfg) listed MIME Types which are not allowed be displayed inline (in a user's browser).  This setting has been replaced by a "webui.content_disposition_inline" setting which lists MIME types which are allowed to be displayed inline. By default PDF, GIF, JPEG, PNG, MPG and MP4 are allowed to be displayed inline.  This improves security of unknown or custom formats by ensuring they don't default to being displayed inline. See https://github.com/DSpace/DSpace/pull/11956
• Migration from SHERPA/RoMEO API to Jisc Open Policy Finder API.  If you are using the SHERPA/RoMEO integration for submission forms, DSpace has been updated to use the new Jisc Open Policy Finder API because the Sherpa API is being retired.  This means that the older "sherpa.romeo.*" settings (in dspace.cfg) have been replaced by "openpolicyfinder.*" settings (in external-providers.cfg).  The sample Authority Control Settings (in authority.cfg) for Publisher and Journal Title have also been updated. #12005
• Must select whether to use traditional DSpace Entity Relationships (with virtual metadata) or new DSpace-CRIS Entity Relationships (using authority framework). See https://github.com/DSpace/DSpace/pull/11718
  • Set item.enable-virtual-metadata = true (default value) to use traditional DSpace Entity Relationships (with virtual metadata). Sites which are upgrading from an older version of DSpace should use this option, as it ensures any existing entities are displayed properly.
  • Set item.enable-virtual-metadata = false to use new DSpace-CRIS Entity Relationships (via authority framework).  Sites which may be migrating from DSpace-CRIS to DSpace 10 should likely use this option, as it ensures any existing DSpace-CRIS entities are displayed properly. NOTE: This will result in traditional DSpace Entity Relationships no longer being displayed in the user interface.
• License and Text extraction bundles/files are now admin-only by default. Previously, license files and extracted text would inherit the permissions of the Item itself.  Specific bundles (LICENSE, TEXT, SWORD) of files are now access-restricted by default.  You can control which bundles are access restricted via the new "core.authorization.restricted-bundle" configuration in dspace.cfg. #12306
  • NOTE: After your upgrade, if you wish to automatically access restrict all TEXT bundles in your DSpace, you can do so by running the "filter-media" script in force mode (-f). This will result in all TEXT bundles and files being recreated with the new access restricted settings. For example: [dspace]/bin/dspace filter-media -f    
• Solr "search" core needs to be cleared and reindexed. In order to resolve an error in Solr 9 (see #11475), we've had to update the Solr schema.xml for the "search" core (see #10526).  This minor update to the schema is unfortunately incompatible with prior "search" core indexes.  In testing, we've found this requires destroying all data in the current index, and reindexing via a process like this:
  • First, destroy all data in the current "search" core by running this command-line tool (using the "-d" flag):  ./dspace index-discovery -d
  • Next, restart Solr
  • Finally, perform a full reindex/rebuild (using the "-b" flag): ./dspace index-discovery -b
  • WARNING: If you skip these steps, you may see errors like this on your next reindex or Item submission:

    • Exception writing document id Item-[uuid] to the index; possible analysis error: 
      cannot change field "admin" from index options=DOCS_AND_FREQS_AND_POSITIONS to inconsistent index options=DOCS

Major Updates and Improvements

• General user enhancements and fixes
  • Fixed bug where item pages would throw an Apache gateway error when too many bitstreams were added to the header. #8943 (Donated by Nicholas Woodward)
  • Structure Builder now allows import beneath a parent community. #2559 (Donated by The Library Code, with support from Deutsches Institut für Urbanistik (DIFU))
  • Fixed an authorization issue where security details in SOLR could go out of sync without a manual reindexing. #2853 (Donated by Toni Prieto)
  • Item pages can now display generic rights information based on license names and links given in metadata. #3338 (Donated by Abel Gómez)
  • HTML tags are now escaped in content injected into the DOM using the innerHTML attribute. #1495 (Donated by Atmire)
  • Fixed bug where bitstreams with embargo lift date in metadata were not appearing on Item Page. #8640 (Donated by Vir Softech)
  • When an Entity's Item Page displays tabbed search, switching tabs no longer retains the query parameters from the prior tab.  #2729   (Donated by Atmire)
  • Fixed issues with downloading bitstreams whose filenames contained non-ASCII characters using the Safari browser. #11191 (Donated by Neki-IT)
  • The language selected in a user's profile is now the default language displayed by DSpace unless a different language is selected via the header. #4241 (Donated by Atmire)
  • Fixed bug where embargo status badge would disappear from Item page if the page was reloaded. #4811 (Donated by Atmire)
  • Fixed bug where the IIIF viewer was not working due to a missing mime.types  file. #11804 (Donated by 4Science) 
  • Fixed an issue where deleted bitstreams returned HTTP 401 unauthorized instead of 404. #11629 (Donated by Jesiel Viana)
  • Fixed bug where metadata export was no longer respecting metadata.hide.* properties #11197 (Donated by Atmire)
  • Fixed bug with the "Show more" functionality of truncatable component for content containing HTML #4948 (Donated by 4Science)

  • Fixed an issue where memory errors would occur when downloading large bitstreams from an S3 remote. #12468 (Donated by 4Science)

  • Fixed bug where hierarchical & advanced search on community and collection pages redirected user to the global search route. #5210 (Donated by Atmire)
  • Fixed various small issues with the display of authors and other metadata on item pages. #5665 (Donated by Atmire)
  • Improved the FileSizePipe to take localization into account when formatting. #5054 (Donated by Sascha Szott)
  • Improved email subscription functionality to include more context, better formatting, and easier template configuration. #9994 (Donated by Atmire, with the support of the International Livestock Research Institute)
  • There is now an "eye" icon in the password field of login to enable toggling password visibility. #4988 (Donated by Arya Khochare)
• Submission / Workflow enhancements and fixes
  • Fixed an issue where loading many mapped collection forms via item-submission  could cause a Fetch error. #10750 (Donated by Paulo Graça)
  • There is now a configurable limit on the number of items that can be added or edited in a single CSV metadata import. #9663 (Donated by Neki-IT)
  • Fixed bug where a Submitter could not deposit items via SWORD when the item had an embargo defined. #10404 (Donated by dataquest)
  • Fixed bug where dynamic tag input field was wrongly splitting values on unexpected characters (like "<").  Now it only splits on pressing Enter or adding a comma. #4664 (Donated by The Library Code)
  • Fixed bug where a newly created Researcher Profile could not be selected as an author of a new Publication Entity. #4648 (Donated by Jesiel Viana)
  • Fixed bug where submission form status icons didn't update properly when type-bind was used with a required field. #2572 and #2742 (Donated by The Library Code)
  • Fixed bug where file uploads would fail if the "assetstore.dir" was set to a location using a symbolic link. #11169 (Donated by 4Science)
  • Fixed memory leak in submission form which could occur if you closed and reopened the form several times in a row. #4645 (Donated by Jukka Lipka)
  • Fixed bug where output of "submission-forms-migrate" script was an invalid submission configuration. #8443 (Donated by Neki-IT)
  • Fixed bug where importing a multi-paragraph abstract from PubMed would result in it being split into many abstracts in DSpace. #10559 (Donated by Atmire)
  • Fixed bug where removing and reordering the entries of a repeatable field in submission form could lead to incorrect values. #4418 (Donated by Jukka Lipka)

  • Fixed an issue where it was not possible to download bitstreams during submission while impersonating a user. #8957 (Donated by Atmire)

  • Fixed an issue where controlled vocabulary lookup was not working for text with accented characters. #12097 (Donated by Istvan Vig)

  • Optionally, you can allow non-admin users to import external entities into a specified collection to which they have submitter privileges. #12279 (Donated by Eike Löhden)

  • ArXiv importer began failing because its configuration didn't use the HTTPS URL. #10996 (Donated by Atmire)
  • Alphabetized all external sources in the import dropdown by source name. #10806
• Integration fixes
  • ORCID iDs are now included in the metadata that gets sent to DataCite from DSpace. #9883 (Donated by Eike Löhden)
  • Fixed bug where ORCID push failed for works that share an ISSN external-id with existing work. #10783 (Donated by The Library Code)
  • ORCID iD icons and links are now displayed according to ORCID's Display guidelines. #4656 (Donated by 4Science with additions by Nicholas Woodward)
  • Fixed bug where import of a Person Entity from ORCID was not working. #11674 (Donated by 4Science)
  • Fixed bug where ORCID Integration would reject a work if it referenced an ISSN that already exists (e.g. an article referencing a journal via SSN). #10738 (Donated by The Library Code)
  • Fixed bug where ORCID queue list would include items that are still in workspace or workflow. #4654 (Donated by Pierre Lasou)
  • Improved mappings between ORCID document type and DSpace's dc.type field #11253 (Donated by Pierre Lasou)
  • Fixed bug occurring during OAI update process when batch size exceeded and items had metadata-level embargoes. #12112 (Donated by Toni Prieto)
  • Fixed bug where OAI-PMH could crash if it encountered forbidden XML characters in metadata. #10721 (Donated by Neki-IT)
  • Fixed OAI-PMH validation errors because of an invalid responseDate. #11129 (Donated by LucasVaroneW)
  • OAI-PMH now serves pre-transformed HTML if the client sends an Accept header requesting text/HTML. #11648 (Donated by The Library Code)
  • Fixed bug where OAI identifier prefix could revert back to un-interpolated value when not defined in config. #12505 (Donated by Atmire)
  • Fixed several failures occurring with the OpenAIRE Search API. #11967 (Donated by dataquest)

  • OpenAIRE crosswalk now supports types Animation, Book chapter, Learning Object, and Presentation. #12171 (Donated by Atmire)

  • Enabled sending a Client-Id header in requests to the ROR (Research Organization Registry) API.  #11653 (Donated by 4Science)
  • Updated to use version 2 of the ROR (Research Organization Registry) API. #11019 (Donated by Jesiel Viana)
  • Import from PubMed now supports adding your PubMed API Key via a new "pubmed.apiKey" configuration in "external-providers.cfg". #10356 (Donated by Atmire)
  • Fixed performance of SWORDv2 servicedocument when you have a large number of collections. #10740 (Donated by fribeiro-fccn)
  • Fixed bug where SWORDv2 read/update/delete actions were failing with a 500 error. #11547 (Donated by Marsa Haoua) 
  • Fixed bug where SWORDv1 submission failed if the user was not an Administrator. #8647
  • Fixed bug where bitstream downloads would fail when using a script blocker on sites with Matomo integration. #4991 (Donated by PCG Academia)
  • Fixed an issue with the IIIF viewer handling of the dspace.iiif.enabled field. #12303 (Donated by Marsa Haoua) 
• Administrative enhancements and fixes
  • Fixed bug where admin privileges not immediately inherited from community to collection on creation #9652 (Donated by Toni Prieto)
  • Fixed an issue where the search function from "Edit" in the sidebar listed items which the user is not allowed to edit. #1331 (Donated by Toni Prieto)
  • Fixed an issue where after creating a new EPerson, the application would become unresponsive. #5000 (Donated by PCG Academia)
  • Fixed an issue where the menu reducer could throw an error when you tried to delete an already deleted menu section. #4539 (Donated by Atmire)
  • Fixed an issue where the checksum checker could fail to complete due to memory constraints in repositories with many bitstreams. #7322 (Donated by Miika Nurminen)
  • Fixed an issue where the curation task CreateMissingIdentifiers would not work for an item without a handle. #11676 (Donated by The Library Code)
  • Enhanced the configuration possibilities for basic duplicate detection  #11349 (Donated by Andreas Mahnke)
  • Fixed several bugs where Community Administrators would see objects they didn't have permissions on when using the "edit" or "new" sidebar menus. #8916, #8917, #8918 (Donated by Vir Softech) 
  • Fixed bug where Item Versioning could fail if special characters were added to the "Summary" field. #4327 (Donated by Jukka Lipka)
  • Fixed bug where creating an EPerson would fail for an email containing uppercase letters. #4338 (Donated by PCG Academia)
  • When creating a new Bundle all custom, non-admin policies are now inherited from the parent Item. #9212 (Donated by The Library Code)
  • Fixed bug where client-side rendering (CSR) of the user interface could fail if the "ui.nameSpace" configuration was customized in "config.*.yml". #4637 (Donated by Milan Majchrak)
  • Fixed bug where backend would fail to startup when "citation-page.enabled_communities" configuration was enabled. #11167 (Donated by Miika Nurminen)
  • Amazon S3 integration has been updated to use AWS SDK v2. #10819 (Donated by Mark Patton)
  • Fixed an issue where S3 connection remained open after HEAD requests on a bitstream download URL or sending files for Request a copy. #12244 (Donated by Atmire)
  • Removed automated checks for the "pgcrypto" plugin in PostgreSQL. As of PostgreSQL v13, this plugin is supported out-of-the-box and no longer needs to be installed separately. #10853 (Donated by Francisco Carvalho)
  • Fixed issue where some Solr 9 queries would throw a "Query contains too many nested clauses" error. #11475 (Donated by Sascha Szott)
  • Fixed bug where community/collection subscription emails were not working as an error occurred when running "./subscription-send" #11001 (Donated by Alan Orth)
  • Deleting a Group now requires confirmation (via a confirmation popup). #4346 (Donated by Jukka Lipka)
  • A strong warning dialog now displays to administrators before permanently deleting an item. #5044 (Donated by eScire)
  • Fixed bug where it was not possible to set the DELETE resource policy. #10741 (Donated by DSquare Technologies)
• Command-line script fixes
  • Fixed bug where "checker" and "bitstore-migrate" command-line scripts would not save updates / current status if the script was interrupted. #10507 and #10489 (Donated by David Steelman)
  • Fixed bug where "subscription-send" command-line script was not sending updates about restricted items when the user has permissions on those restricted items. #10506 (Donated by dataquest)
  • Fixed bug where "filter-media" command-line script did not understand orientation metadata in jpeg images. #10532 (Donated by 4Science)
  • Fixed bug where running "export" command-line script on an Item in workspace or workflow would return an error even though the export succeeds. #11074 (Donated by Martin Walk)
  • Fixed bug where "solr-export-statistics" command-line script was throwing date-based errors. #11192 (Donated by Daniel Coelho)
  • Fixed open connection leak in "import" command-line script. #10886 (Donated by Atmire)
  • Fixed bug where "cleanup" command-line script would fail if a request-for-copy existed in the database for the deleted bitstream. #9674 (Donated by Atmire)
  • Fixed bug where "cleanup" command-line script would fail if deleted bitstreams still had orphaned rows in bundle2bitstream. #11009 (Donated by Atmire and The Library Code)  
• Authentication enhancements and fixes
  • Added a specialgroup configuration for OIDC authentication, similar to those provided by LDAP and Password plugins. #11040 (Donated by Daniel Coelho) 
  • Fixed a bug where authentication methods would not appear if page refreshed before authentication token expired. #4662 (Donated by Atmire)
  • Fixed bug where LDAP authentication would fail with when a user's LDAP entry had no email field. #11292 (Donated by dataquest)
  • Fixed database connection leak that could occur via many unsuccessful logins using password login or ORCID login. #11202 (Donated by Atmire)
  • Fixed issues with correctly populating special groups for several authentication methods. #11633 (Donated by 4Science)
  • Fixed bug in Shibboleth authentication where EPerson metadata was not being updated after login. #11568 (Donated by Neki-IT)
  • Fixed bug where the registration page and forgot password page were accessible to authenticated users. #4592 (Donated by 4Science)
  • Support for X.509 certificate authentication has been removed as it appears to be unused and non-functional. #11334
• Accessibility improvements
  • Fixed serious accessibility issues on submission form by adding aria attributes and live region messages. #1187 (Built by 4Science, funded via the DSpace Development Fund)
  • Fixed an accessibility issue on submission form fields by removing placeholders and replacing them with labels where needed. #4198 (Built by 4Science, funded via the DSpace Development Fund)
  • Added new bitstream metadata in order to include an audio transcript and/or a video description to an audio or video bitstream. #5393 (Built by 4Science, funded via the DSpace Development Fund)
  • Integrated @ng-dynamic-forms library into code base, resolving an accessibility issue related to ngbTypehead #1272 (Built by 4Science, funded via the DSpace Development Fund)

  • Fixed an accessibility bug where visually disabled buttons failed to block interaction via space keypress. #5645 (Donated by Neki-IT)

  • Fixed on scrollable dropdown - selection highlighting, dynamic loading, and keyboard navigation issue #4958 (Donated by Solomon Kahsai)
  • Fixed an ARIA error related to the edit menu on community and item pages. #5488 (Donated by eScire)
• Usability improvements and fixes
  • The New and Edit sidebar search modals now show full hierarchical path instead of only immediate parent, and tooltips are improved. #1602 (Donated by dataquest)
  • Fixed an issue where the Subscribe button on a community or collection did not update after user subscribed. #4195 (Donated by eScire)
  • Fixed an issue where keyword links on item pages were leading unexpectedly to the subject category browse page. #5314 (Donated by eScire)
  • Fixed an issue where edited group details were not immediately reflected in the UI after saving. #5454 (Donated by eScire)
  • The "Back to results" button logic on item pages has been improved to prevent stale navigation when users visit items from different contexts. #5170 (Donated by dataquest)
  • Fixed bugs where the end user agreement would not save until the page was refreshed and stall indefinitely on submit. #5085 (Donated by PCG Academia)
  • Fixed an issue where the status icon of the CC license showed a warning if the section was empty but not required. #4845 (Donated by 4Science)
  • Fixed an issue where the "New process" dropdown would not fully load when browser zoom was adjusted #4577 (Donated by 4Science)
  • Error handling on changing a mapped collection has been improved to display a clear 403 Forbidden when applicable. #5435 (Donated by eScire)

  • Fixed an issue in display of abstracts where words with dots were always treated as links. #2789 (Donated by eScire)

  • Fixed an issue with the "drop files" overlay on the submission form in Firefox. #1268 (Donated by eScire)
  • Pagination controls have been improved to center the active page and make it easier to browse nearby pages. #5494 (Donated by eScire)
• Performance and stability improvements:
  • Improved handling of details in the Event object to improve stability and reduce errors.  #10683 (Donated by 4Science)
  • Improved performance on item pages with many bitstreams by reducing bitstream authorization requests. #5028 (Donated by Tina Schönborn)
  • Improved performance by optimizing the SQL query in the findByEPerson method. #11472 (Donated by Toni Prieto)

  • Improved loading times and cache behavior for the community list page. #9911 (Donated by 4Science)

  • Improved performance on the signposting endpoint by adding a count query. #12305 (Donated by Tina Schönborn)

  • Improved performance for relationship queries by caching the tables that store entity and relationship types. #12511 (Donated by Atmire)

  • DOIOrganiser bulk operations can now scale for hundreds of items due to adding DAO-level pagination. #9622 (Donated by Atmire)
• Browse and search fixes
  • Fixed bug in "Browse by Title" where searching for a title beginning with certain articles (e.g. A, As, O, Os) did not return accurate results. #4166 (Donated by 4Science)
  • Fixed bug on "Browse by" pages where the search box no longer worked after clicking on a value on the page. #2739 (Donated by Atmire)
  • Fixed bug on Browse by Issue Date where the date was treated as a filter rather than a start date for decades. #10055 (Donated by Atmire)
  • Fixed bug where exporting search results didn't work if the search contained quotation marks. #9589 (Donated by Vir Softech)
  • Fixed a bug in hierarchical vocabulary browse where only the first 20 matches to a query were rendered. #4500 (Donated by Atmire)
• Search Engine Optimization (SEO) fixes
  • Fixed bug where private (non-discoverable) item pages were missing the "noindex" meta tag that tells crawlers to avoid indexing the item. #4835 (Donated by Atmire)
  • Added 'rel="nofollow"' to all search facets on the search page to tell well-behaved bots not to follow those links. #4785 (Donated by Alan Orth)
• Statistics enhancements and fixes
  • Add several "usage-statistics.*" configurations to make it easier to quickly customize the statistical reports. #10142 (Donated by Nicholas Woodward)
  • Updated Solr-based internal statistics to only track downloads of bitstreams that are in a bundle listed in the existing "solr-statistics.query.filter.bundles" configuration. This defaults to only tracking downloads of bitstreams in the "ORIGINAL" bundle. #11033 (Donated by Neki-IT)
  • Fixed bug where IRUS statistics event processor used the wrong OAI-PMH url. #8852 (Donated by Neki-IT)
• REST API fixes
  • Fixed bug where patching metadata on unknown field cleared all DSO metadata. #10817 (Donated by Atmire)
  • Fixed a REST API bug where sending a PATCH request for an unknown metadata field could clear all object metadata. (This only impacts REST API and not the UI.) #10817( Donated by Atmire)
  • REST API has been updated to eager load CSRF tokens again, similar to DSpace 7.x. #11154 (Donated by Neki-IT)
• Fixed bug where PM2 was failing in cluster mode for localhost because it defaulted to IPv6 over IPv4. #4960 (Donated by Atmire) 
• Fixed several CSS / style issues found since upgrading to Bootstrap 5. #4538 (Donated by Atmire)
• Fixed bug where Geospatial Map javascript code was loaded even when it was not used. #4447 (Donated by Atmire)
• Added missing Entity-related metadata fields to the Metadata Registry. #3353 (Donated by Tim Donohue)
• Fixed a large number of other small bugs.  See Changes in 10.x for a list of all changes.
• Major dependency updates: Frontend updated to Angular 20. (Donated by Atmire)

New/Updated Language support

• Arabic (العربية) language updates donated by Laith Rastanawi (LaisRast)
• Bengali (বাংলা) language updates donated by Md. Topu Raihan (raihantopu)
• Traditional Chinese (繁體中文) added & donated by eScire
• Czech (Čeština) language updates donated by dataquest
• French (Français) language updates donated by Pierre Lasou (pilasou) and Carolyn Sullivan (Peredwel)
• German (Deutsch) language updates donated by Sascha Szott (saschaszott) and Eike Löhden (EikLoe)
• Gujarati (ગુજરાતી) added & donated by DSquare Technologies
• Hungarian (Magyar) language updates donated by Monguz-Qulto and Nagy Akos (akoscomp)
• Italian (Italiano) language updates donated by 4Science
• Malayalam (മലയാളം) added & donated by DSquare Technologies
• Marathi (मराठी) added & donated by DSquare Technologies
• Odia (ଓଡିଆ) added & donated by DSquare Technologies
• Persian (فارسی) added & donated by Shafi Habibi (sh-habibi)
• Portuguese (Português) language updates donated by Neki-IT, Ricardo Saraiva (rsaraivac), and Alfeu U. Tavares (autavares-dev)
• Russian (Русский) added & donated by Arvo Consultores
• Spanish (Español) language updates donated by Arvo Consultores
• Tamil (தமிழ்) added & donated by DSquare Technologies
• Telugu (తెలుగు) added & donated by DSquare Technologies
• Ukrainian (Yкраї́нська) language updates donated by Olexandr Shaposhnyk (oshaposhnyk)

10.0 Acknowledgments

DSpace 10.0 had 371,282 lines of code changed and 106 unique individuals contributing to either the frontend or backend.

Frontend / User Interface Acknowledgments

The following 68 individuals have contributed directly to the new DSpace (Angular) User Interface in this release (ordered by number of GitHub commits): Francesco Molinaro (FrancescoMolinaro), Alan Orth (alanorth), Tim Donohue (tdonohue), Alexandre Vryghem (alexandrevryghem), Giuseppe Digilio (atarix83), Guillermo Escalante (guillermo-escire), Zoltán Kanász-Nagy (kanasznagyzoltan), Jesiel Viana (jesielviana), Kim Shepherd (kshepherd), Mykhaylo Boychuk (Micheleboychuk), Jukka Lipka (jlipka), Eike Löhden (EikLoe), Jens Vannerum (jensvannerum), Pawel Zlakowski (pzlakowski), Oscar Chacón (oscar-escire), Matus Kasak, Maciej Kleban (Dawnkai), Sascha Szott (saschaszott), Gaurav Patel (GauravD2t), Shafi Habibi (sh-habibi), Yury Bondarenko (ybnd), Nicholas Woodward (nwoodward), Joran De Braekeleer (gingyx), Milan Majchrak (milanmajchrak), Andrea Barbasso (AndreaBarbasso), Andreas Awouters (AAwouters), Sergio Fernández Celorio (sergius02), Toni Prieto (toniprieto), Zahraa Chreim (ZahraaChreim-Atmire), im-shubham-vish, Abhinav Sidharthan (AbhinavS96), Pierre Lasou (pilasou), Bram Maegerman (bram-maegerman), Arya Khochare (Aryakoste), Md. Topu Raihan (raihantopu), Carolyn Sullivan (Peredwel), Amy Pillow (strawburster), Kristof De Langhe (Atmire-Kristof), Daniel Coelho (danielcoelhocgu), Johnny Mendes do Carmo (JohnnyMendesC), Kasinhou, Bram Luyten (bram-atmire), Abel Gómez (abelgomez), Adamo Fapohunda (AdamF42), Art Lowel (artlowel), John Abrahams (jabrah), Laith Rastanawi (LaisRast), Marcin Miłosz (MMilosz), Marsa Haoua (marsaoua), Nima Behfourouz (nimabehforouz), Ricardo Saraiva (rsaraivac), Stefano Maffei (steph-ieffam), Nagy Akos (akoscomp), William Welling (tamu-sad-iii), Alfeu U. Tavares (autavares-dev), Jorge Rojas, Juraj Roka, Mattia Vianelli (Sondissimo), Olexandr Shaposhnyk (oshaposhnyk), Michaela Paurikova (Paurikova2), Roshan Singh (Roshan-Singh-07), Shivani Rupnawar (ShivaniNR), Solomon Kahsai (solomona2003), Tina Schönborn (tinsch), Francesco Bacchelli (frabacche), Lakshmi Sravya Vedantham (LakshmiSravyaVedantham), Mukunda Rao Katta (MukundaKatta), Krzysztof Kubiak (pcg-kk).

The above contributor list was determined based on contributions to the "dspace-angular" project in GitHub between 9.0 (after May 23, 2025) and 10.0 using "git shortlog" on the main branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-05-23

Backend / REST API Acknowledgments

The following 69 individuals have contributed directly to the DSpace backend (REST API, Java API, OAI-PMH, etc) in this release (ordered by number of commits): Tim Donohue (tdonohue), Adamo Fapohunda (AdamF42), Kim Shepherd (kshepherd), Alan Orth (alanorth), Johnny Mendes do Carmo (JohnnyMendesC), Vincenzo Mecca (vins01-4science), Mykhaylo Boychuk (Micheleboychuk), Stefano Maffei (steph-ieffam), Piaget Bouaka Donfack (PiagetBouaka), Quasipoint, Sascha Szott (saschaszott), Abhinav Sidharthan (AbhinavS96), Jesiel Viana (jesielviana), Nicholas Woodward (nwoodward), Miika Nurminen (minurmin), Paulo Graça (paulo-graca), Mark Wood (mwoodiupui), Bram Luyten (bram-atmire), Eike Löhden (EikLoe), Marcin Miłosz (MMilosz), Toni Prieto (toniprieto), Alexandre Vryghem (alexandrevryghem), David Steelman (dsteelma-umd), Mark Patton (markpatton), Yury Bondarenko (ybnd), Max Nuding (max-nuding), Jens Vannerum (jensvannerum), Andreas Mahnke (mahnkong), Daniel Coelho (danielcoelhocgu), Elios Buzo (eliosbz), Joran De Braekeleer (gingyx), Kristof De Langhe (Atmire-Kristof), Lucas Varone (LucasVaroneW), Pierre Lasou (pilasou), Zahraa Chreim (ZahraaChreim-Atmire), Marsa Haoua (marsaoua), Milan Majchrak (milanmajchrak), Nathan Buckingham (ConfusionOrb221), Andreas Czerniak (ACz-UniBi), April Herron (aprilherron), Bram Maegerman (bram-maegerman), Francisco Carvalho (ciscocarvalho), Marie Verdonck (MarieVerdonck), Martin Walk (MW3000), Michaela Paurikova (Paurikova2), fribeiro-fccn, Igor Baptista da Costa (IgorBaptist4), im-shivamb, im-shubham-vish, Istvan Vig (parphis), Pascal-Nicolas Becker (pnbecker), jeonyunhwan, Jukka Lipka (jlipka), Shivam Sharma (shvmsrc), Raúl Soto (soto-raul), Andrea Barbasso (AndreaBarbasso), Alphonse Bendt (abendt), Christian Bethge (ChrisBethgster), Drew Heles (dheles), Francesco Pio Scognamiglio (francescopioscognamiglio), GHX5T-SOL, Jozef Misutka (vidiecan), Mattia Vianelli (Sondissimo), Ondřej Košarko (kosarko), Pablo Picurelli Ortiz (superpegaso2703), Tina Schönborn (tinsch), Aliaksei Sheuchyk (aliaksei), Mohamed Eskander (eskander17), Uğur Tafralı (utafrali).

The above contributor list was determined based on contributions to the "DSpace" project in GitHub between 9.0 (after May 23, 2025) and 10.0 using "git shortlog" on the main branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-05-23

Reviewer Acknowledgments

Thank you to everyone who has contributed by reviewing or testing contributions!  The following 43 individuals have reviewed a pull request in the DSpace Backend or User Interface (ordered by number of pull requests reviewed): Tim Donohue (tdonohue), Nicholas Woodward (nwoodward), Bram Luyten (bram-atmire), Alan Orth (alanorth), Kim Shepherd (kshepherd), Marcin Miłosz (MMilosz), Nathan Lourenço (nathanmlf), Lia Eggleston (lgeggleston), Stefano Maffei (steph-ieffam), Art Lowel (artlowel), Mark Wood (mwoodiupui), Eike Löhden (EikLoe), Gaurav Patel (GauravD2t), Vincenzo Mecca (vins01-4science), Yury Bondarenko (ybnd), Alexandre Vryghem (alexandrevryghem), Toni Prieto (toniprieto), Krzysztof Kubiak (pcg-kk), Kevin Van de Velde (KevinVdV), Ben Bosman (benbosman), Martin Walk (MW3000), Paulo Graça (paulo-graca), Giuseppe Digilio (atarix83), Andrea Barbasso(AndreaBarbasso), Alfeu Tavares (autavares-dev), Mykhaylo Boychuk (Micheleboychuk), Marie Verdonck (MarieVerdonck), Katharina Kaiser (kskaiser), Jen Cwiok (jrcwiok), Marsa Haoua (marsaoua), Francesco Molinaro (FrancescoMolinaro), Tina Schönborn (tinsch), Mark Patton (markpatton), Zhuotong Zhou (jxfzzzt), Philipp Rumpf (philipprumpf), Miika Nurminen (minurmin), Pierre Lasou (pilasou), April Herron (aprilherron), Thiago Rodrigues (t-rodrigues), Jesiel Viana (jesielviana), Nima Behforouz (nimabehforouz).

The above reviewer list was determined based on comments made as part of a review submission on Github, and does not include comments on PRs made outside of that process. One review is counted per reviewer per pull request. For additional details, see the script used to retrieve this list via Github API.

Testathon Acknowledgements

Thank you to everyone who participated in the DSpace 10.0 Testathon! The following 26 individuals reported testing results via the Test Plan: Lara Babic, Igor Baptista, Rafael Bértoli, Sean Carte, Victoria Cruz, Lia Eggleston, Mosqueira Felipe, Nathan Ferreira, Victor Ferreira, Kent Gerber, Aleksandra Gontarz, Fatih Güneş, Marsa Haoua, Sina Haselmann, Marcella Huggard, Matus Kasak, Pierre Lasou, Holger Lenz, Colin Lukens, Johnny Mendes do Carmo, Daniel Pais, Jordan Piščanc, Grazia Quercia, Tina Schönborn, Max Sullivan, Peter Sutton-Long.

Additional Thanks

Additional thanks to our DSpace Leadership Group and DSpace Steering Group for their ongoing DSpace support and advice.

Thanks also to the various developer & community Working Groups who have worked diligently to help make DSpace 10 a reality. These include:

• DSpace Developers Team - This volunteer-based team leads the development of new releases. Anyone is welcome to join the Developer Meetings
• DSpace Community Advisory Team (DCAT) - This team helped organize/lead the DSpace 10.0 Testathon (to bang on the system to find any last bugs), and they also provided us with advice on features, etc.

We apologize to any contributor accidentally left off this list. DSpace has such a large, active development community that we sometimes lose track of all our contributors. Acknowledgments to those left off will be made in future releases.