Release Notes

8.5 Release Notes

DSpace 8.5 provides security patches, bug fixes & performance improvements to the 8.x platform. No new features are provided.  As such this release should be an easier upgrade for sites already running 8.x.

8.5 Security Fixes

8.5 Breaking Changes

Some fixes in 8.5 required major code or configuration changes. The following changes may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

• Migration from SHERPA/RoMEO API to Jisc Open Policy Finder API.  If you are using the SHERPA/RoMEO integration for submission forms, DSpace has been updated to use the new Jisc Open Policy Finder API because the Sherpa API is being retired.  This means that the older "sherpa.romeo.*" settings (in dspace.cfg) have been replaced by "openpolicyfinder.*" settings (in external-providers.cfg).  The sample Authority Control Settings (in authority.cfg) for Publisher and Journal Title have also been updated. #12005

8.5 Major Bug Fixes and Improvements

• Fixed an issue with XML encoding in the OAI-PMH interface. #12409 (Donated by Atmire)
• Fixed "Unknown metadata format" errors occurring on OAI-PMH interface due to hard-coded oai_dc prefix. #9770, #10106 (Donated by Acervos Digitais)
• Fixed an issue where Health actuator would return DOWN status for missing SEO configuration. #12672 (Donated by 4Science)
• Improved the external sources REST endpoints by restricting them to authenticated users only. #12660
• Fixed other small bugs.  See Changes in 8.x for a list of all changes.

8.5 New/Updated Language support

8.5 Acknowledgments

8.4 Release Notes

DSpace 8.4 provides security patches, bug fixes & performance improvements to the 8.x platform. No new features are provided. As such this release should be an easier upgrade for sites already running 8.x.

8.4 Security Fixes

• Fix for CVE-2026-49832 (high severity). NOTE: Fix is also included in 9.3, 8.4 and 7.6.7. Remote Code Execution (RCE) possible in Velocity templates used by LDN (Linked Data Notifications) when COAR Notify is enabled.
• Fix for CVE-2026-49833 (moderate severity). NOTE: Fix is also included in 9.3, 8.4 and 7.6.7. Path traversal vulnerability possible in LDN (Linked Data Notifications) message generation when COAR Notify is enabled.
• Fix for CVE-2026-49831 (moderate severity). NOTE: Fix is also included in 9.3, 8.4 and 7.6.7. Path Traversal Vulnerability is possible in Curation Task Reporter output path.
• Fix for CVE-2026-49830 (moderate severity). ORE resource URI does not validate scheme for non-web resources when harvesting OAI content.

• Patch for CVE-2026-27739 in Angular SSR (critical severity). All versions of Angular SSR (Server Side Rendering) contain a critical SSRF (Server-Side Request Forgery) vulnerability.  This SSRF vulnerability may be possible to exploit in DSpace sites that are not running DSpace behind a well-configured proxy (see mailing list announcement).  This release of DSpace provides additional protection via the new "ui > baseUrl" setting (see "Breaking Changes" below)

• Updated LDAPAuthentication to Spring LDAP in order to remove insecure JNDI usage. See #11656 (Reported by Sascha Szott. Fixed by Johnny Mendes do Carmo)
• This release also contains many dependency updates in order to keep all DSpace sites secure. Some of these updates patch vulnerabilities that have been reported by those dependencies. But no exploits of these vulnerabilities have been confirmed in DSpace.

8.4 Breaking Changes

Some fixes in 8.4 required major code or configuration changes. The following changes may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

• Frontend's new "baseUrl" setting is required for robots.txt and redirects.  The frontend configuration has a newly added "ui > baseUrl" setting which should match the value of "dspace.ui.url" on the backend. This setting is REQUIRED for Server-Side-Rendering (SSR), robots.txt and redirects to function properly.  This new setting also helps to patch against the Angular SSR vulnerability CVE-2026-27739.
• Replaced "webui.content_disposition_format" with "webui.content_disposition_inline" - In prior versions the "webui.content_disposition_format" setting (in dspace.cfg) listed MIME Types which are not allowed be displayed inline (in a user's browser).  This setting has been replaced by a "webui.content_disposition_inline" setting which lists MIME types which are allowed to be displayed inline. By default PDF, GIF, JPEG, PNG, MPG and MP4 are allowed to be displayed inline.  This improves security of unknown or custom formats by ensuring they don't default to being displayed inline. See https://github.com/DSpace/DSpace/pull/11956

8.4 Major Bug Fixes and Improvements

• General user enhancements and fixes
  • Fixed bug on Browse by Issue Date where the date was treated as a filter rather than a start date for decades. #10055 (Donated by Atmire)
  • Fixed a bug where the IIIF viewer was not working due to a missing mime.types file. #11804 (Donated by 4Science)
  • Fixed a bug where authentication methods would not appear if page refreshed before authentication token expired. #4662 (Donated by Atmire)
  • Fixed a bug in hierarchical vocabulary browse where only the first 20 matches to a query were rendered. #4500 (Donated by Atmire)
  • Fixed an issue where deleted bitstreams returned HTTP 401 unauthorized instead of 404. #11629 (Donated by Jesiel Viana)
  • Fixed bug where LDAP authentication would fail with when a user's LDAP entry had no email field. #11292 (Donated by dataquest)
  • Fixed bug where metadata export was no longer respecting metadata.hide.* properties #11197 (Donated by Atmire)
  • Fixed bug with the "Show more" functionality of truncatable component for content containing HTML #4948 (Donated by 4Science)
  • Fixed an issue where memory errors would occur when downloading large bitstreams from an S3 remote. #12468 (Donated by 4Science)
  • Fixed bug where hierarchical & advanced search on community and collection pages redirected user to the global search route. #5210 (Donated by Atmire)
• Submission / Workflow enhancements and fixes
  • Fixed an issue where loading many mapped collection forms via item-submission  could cause a Fetch error. #10750 (Donated by Paulo Graça)
  • Fixed bug where a Submitter could not deposit items via SWORD when the item had an embargo defined. #10404 (Donated by dataquest)
  • There is now a configurable limit on the number of items that can be added or edited in a single CSV metadata import. #9663 (Donated by Neki-IT)
  • Fixed an issue where controlled vocabulary lookup was not working for text with accented characters. #12097 (Donated by Istvan Vig)
• Administrative enhancements and fixes
  • Fixed an issue where the curation task CreateMissingIdentifiers would not work for an item without a handle. #11676 (Donated by The Library Code)
  • Fixed bug where "cleanup" command-line script would fail if deleted bitstreams still had orphaned rows in bundle2bitstream. #11009 (Donated by Atmire and The Library Code)  
  • Fixed an issue where the checksum checker could fail to complete due to memory constraints in repositories with many bitstreams. #7322 (Donated by Miika Nurminen)
  • Fixed bug where creating an EPerson would fail for an email containing uppercase letters. #4338 (Donated by PCG Academia)
  • Fixed an issue where the menu reducer could throw an error when you tried to delete an already deleted menu section. #4539 (Donated by Atmire)
  • Fixed bug where it was not possible to set the DELETE resource policy. #10741 (Donated by DSquare Technologies)
  • Fixed an issue where S3 connection remained open after HEAD requests on a bitstream download URL or sending files for Request a copy. #12244 (Donated by Atmire)
• Integration fixes
  • Fixed bug occurring during OAI update process when batch size exceeded and items had metadata-level embargoes. #12112 (Donated by Toni Prieto)
  • Fixed several failures occurring with the OpenAIRE Search API. #11967 (Donated by dataquest)
  • OAI-PMH now serves pre-transformed HTML if the client sends an Accept header requesting text/HTML. #11648 (Donated by The Library Code)
  • Fixed bug where OAI identifier prefix could revert back to un-interpolated value when not defined in config. #12505 (Donated by Atmire)
  • ORCID iDs are now included in the metadata that gets sent to DataCite from DSpace. #9883 (Donated by Eike Löhden)
  • ORCID iD icons and links are now displayed according to ORCID's Display guidelines. #4656 (Donated by 4Science with additions by Nicholas Woodward)
  • Enabled sending a Client-Id header in requests to the ROR (Research Organization Registry) API.  #11653 (Donated by 4Science)
• Accessibility improvements:
  • Fixed serious accessibility issues on submission form by adding aria attributes and live region messages. #1187 (Built by 4Science, funded via the DSpace Development Fund)
  • Fixed an accessibility issue on submission form fields by removing placeholders and replacing them with labels where needed. #4198 (Built by 4Science, funded via the DSpace Development Fund)
  • Fixed an accessibility bug where visually disabled buttons failed to block interaction via space keypress. #5645 (Donated by Neki-IT)
• Usability improvements and fixes:
  • Fixed bugs where the end user agreement would not save until the page was refreshed and stall indefinitely on submit. #5085 (Donated by PCG Academia)
  • Fixed an issue where the status icon of the CC license showed a warning if the section was empty but not required. #4845 (Donated by 4Science)
  • Fixed an issue where the "New process" dropdown would not fully load when browser zoom was adjusted #4577 (Donated by 4Science)
  • Fixed an issue in display of abstracts where words with dots were always treated as links. #2789 (Donated by eScire)
  • Fixed an issue with the "drop files" overlay on the submission form in Firefox. #1268 (Donated by eScire)
• Performance improvements
  • Improved performance by optimizing the SQL query in the findByEPerson method. #11472 (Donated by Toni Prieto)
  • Improved performance on the signposting endpoint by adding a count query. #12305 (Donated by Tina Schönborn)
  • Improved loading times and cache behavior for the community list page. #9911 (Donated by 4Science)
  • Improved performance for relationship queries by caching the tables that store entity and relationship types. #12511 (Donated by Atmire)
• Fixed bug where PM2 was failing in cluster mode for localhost because it defaulted to IPv6 over IPv4. #4960 (Donated by Atmire) 
• Added missing Entity-related metadata fields to the Metadata Registry. #3353 (Donated by Tim Donohue)
• Fixed a large number of other small bugs.  See Changes in 8.x for a list of all changes.

8.4 New/Updated Language support

• German (Deutsch) language updates donated by Sascha Szott (saschaszott)
• Italian (Italiano) language updates donated by 4Science

8.4 Acknowledgments

The DSpace application would not exist without the hard work and support of its community. Thank you to the many developers who have worked very hard to deliver all the bug fixes and improvements. This release was  entirely volunteer driven!

Development Acknowledgments

A total of 51 unique individuals contributed to 8.4.

Frontend / User Interface Acknowledgments 

The following 28 individuals have contributed directly to the new DSpace (Angular) User Interface in this release (ordered by number of GitHub commits): Tim Donohue (tdonohue), Francesco Molinaro (FrancescoMolinaro), Oscar Chacón (oscar-escire), Toni Prieto (toniprieto), Zahraa Chreim (ZahraaChreim-Atmire), Zoltán Kanász-Nagy (kanasznagyzoltan), Sascha Szott (saschaszott), Bram Luyten (bram-atmire), Gaurav Patel (GauravD2t), Guillermo Escalante (guillermo-escire), Alan Orth (alanorth), Alexandre Vryghem (alexandrevryghem), Andrea Barbasso (AndreaBarbasso), Art Lowel (artlowel), Nicholas Woodward (nwoodward), Pawel Zlakowski (pzlakowski), Arya Khochare (Aryakoste), Bram Maegerman (bram-maegerman), Jesiel Viana (jesielviana), Johnny Mendes do Carmo (JohnnyMendesC), Juraj Roka, Marcin Miłosz (MMilosz), Mattia Vianelli (Sondissimo), Rowan McKereghan (Rowan-McKereghan), Shivani Rupnawar (ShivaniNR), Yury Bondarenko (ybnd), Mukunda Rao Katta (MukundaKatta), Krzysztof Kubiak (pcg-kk).

The above contributor list was determined based on contributions to the "dspace-angular" project in GitHub between 8.3 (after December 17, 2025) and 8.4 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-12-17

Backend / REST API Acknowledgments 

The following 34 individuals have contributed directly to the DSpace backend (REST API, Java API, OAI-PMH, etc.) in this release (ordered by number of GitHub commits): Kim Shepherd (kshepherd), Tim Donohue (tdonohue), Abhinav Sidharthan (AbhinavS96), Johnny Mendes do Carmo (JohnnyMendesC), Toni Prieto (toniprieto), Alan Orth (alanorth), Bram Luyten (bram-atmire), Michaela Paurikova (Paurikova2), Bram Maegerman (bram-maegerman), Istvan Vig (parphis), Pascal-Nicolas Becker (pnbecker), Paulo Graça (paulo-graca), Vincenzo Mecca (vins01-4science), Eike Löhden (EikLoe), Milan Majchrak (milanmajchrak), Jesiel Viana (jesielviana), Marcin Miłosz (MMilosz), Mark Patton (markpatton), Quasipoint, Raúl Soto (soto-raul), Andrea Barbasso (AndreaBarbasso), Drew Heles (dheles), Francesco Pio Scognamiglio (francescopioscognamiglio), GHX5T-SOL, Jozef Misutka (vidiecan), Marie Verdonck (MarieVerdonck), Mark Wood (mwoodiupui), Mattia Vianelli (Sondissimo), Matus Kasak, Nathan Buckingham (ConfusionOrb221), Piaget Bouaka Donfack (PiagetBouaka), Stefano Maffei (steph-ieffam), Tina Schönborn (tinsch), Yury Bondarenko (ybnd).

The above contributor list was determined based on contributions to the "DSpace" project in GitHub between 8.3 (after December 17, 2025) and 8.4 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-12-17

8.3 Release Notes

DSpace 8.3 provides security patches, bug fixes & performance improvements to the 8.x platform. No new features are provided. As such this release should be an easier upgrade for sites already running 8.x.

8.3 Security Fixes

• Patch for CVE-2025-66516 / CVE-2025-54988 in Apache Tika (critical severity). All versions of Apache Tika prior to version 3.2.2 contain a critical XML External Entity (XXE) vulnerability.  This XXE vulnerability may be possible to exploit in DSpace if an attacker has submitter privileges. See #11678 for more details.
  • After upgrading, we recommend all sites recreate text extracted files.  This is a safety measure to ensure that none of those text extracted files contain unexpected information because of a prior exploit of this XXE vulnerability.  To recreate your text extracted files, run:

    # This command will force all current text-extracted files to be deleted and recreated.
    ./dspace filter-media -f -p "Text Extractor"

• Fix for potential XPath Injection in Controlled Vocabulary lookup. This vulnerability only allows an attacker access to the controlled vocabulary XML file(s), which are already public in source code. So, this vulnerability poses no security risk but it has been patched for future code safety. See #11042 and #11075 (Reported by odaysec. Fixed by odaysec and Mark Wood)
• This release also includes many dependency updates in order to keep all DSpace sites secure. Some of these updates patch vulnerabilities that have been reported by those dependencies. But no exploits of these vulnerabilities have been confirmed in DSpace.

8.3 Major Bug Fixes and Improvements

• General user enhancements and fixes
  • Fixed bug where HTML tags in some metadata fields were wrongly evaluated in administrative workflow and search results. #1495 (Donated by Atmire)
  • Fixed bug where bitstreams with embargo lift date in metadata were not appearing on Item Page. #8640 (Donated by Vir Softech)
  • Fixed bug where Item Page could throw an error when signposting is enabled and the item has a large number of bitstreams. #8943 (Donated by Nicholas Woodward)
  • Fixed bug in "Browse by Title" where searching for a title beginning with certain articles (e.g. A, As, O, Os) did not return accurate results. #4166 (Donated by 4Science)
  • Fixed bug on "Browse by" pages where the search box no longer worked after clicking on a value on the page. #2739 (Donated by Atmire)
  • Fixed bug where exporting search results didn't work if the search contained quotation marks. #9589 (Donated by Vir Softech)
  • Fixed issues with downloading bitstreams whose filenames contained non-ASCII characters using the Safari browser. #11191 (Donated by Neki-IT)
  • The language selected in a user's profile is now the default language displayed by DSpace unless a different language is selected via the header. #4241 (Donated by Atmire)
• Submission / Workflow enhancements and fixes
  
  • Fixed bug where dynamic tag input field was wrongly splitting values on unexpected characters (like "<").  Now it only splits on pressing Enter or adding a comma. #4664 (Donated by The Library Code)
  • Fixed bug where a newly created Researcher Profile could not be selected as an author of a new Publication Entity. #4648 (Donated by Jesiel Viana)
  • Fixed bug where submission form status icons didn't update properly when type-bind was used with a required field. #2572 and #2742 (Donated by The Library Code)
  • Fixed bug where file uploads would fail if the "assetstore.dir" was set to a location using a symbolic link. #11169 (Donated by 4Science)
  • Fixed memory leak in submission form which could occur if you closed and reopened the form several times in a row. #4645 (Donated by Jukka Lipka)
  • Fixed bug where output of "submission-forms-migrate" script was an invalid submission configuration. #8443 (Donated by Neki-IT)
• Statistics enhancements and fixes
  • Add several "usage-statistics.*" configurations to make it easier to quickly customize the statistical reports. #10142 (Donated by Nicholas Woodward)
  • Updated Solr-based internal statistics to only track downloads of bitstreams that are in a bundle listed in the existing "solr-statistics.query.filter.bundles" configuration. This defaults to only tracking downloads of bitstreams in the "ORIGINAL" bundle. #11033 (Donated by Neki-IT)
  • Fixed bug where IRUS statistics event processor used the wrong OAI-PMH url. #8852 (Donated by Neki-IT)
• Authentication fixes
  • Fixed database connection leak that could occur via many unsuccessful logins using password login or ORCID login. #11202 (Donated by Atmire)
  • Fixed issues with correctly populating special groups for several authentication methods. #11633 (Donated by 4Science)
  • Fixed bug in Shibboleth authentication where EPerson metadata was not being updated after login. #11568 (Donated by Neki-IT)
  • Fixed bug where the registration page and forgot password page were accessible to authenticated users. #4592 (Donated by 4Science)
  • Support for X.509 certificate authentication has been removed as it appears to be unused and non-functional. #11334
• Integration fixes
  • Fixed bug where import of a Person Entity from ORCID was not working. #11674 (Donated by 4Science)
  • Fixed bug where ORCID Integration would reject a work if it referenced an ISSN that already exists (e.g. an article referencing a journal via SSN). #10738 (Donated by The Library Code)
  • Fixed bug where ORCID queue list would include items that are still in workspace or workflow. #4654 (Donated by Pierre Lasou)
  • Improved mappings between ORCID document type and DSpace's dc.type field #11253 (Donated by Pierre Lasou)
  • Import from PubMed now supports adding your PubMed API Key via a new "pubmed.apiKey" configuration in "external-providers.cfg". #10356 (Donated by Atmire)
  • Fixed bug where OAI-PMH could crash if it encountered forbidden XML characters in metadata. #10721 (Donated by Neki-IT)
  • Updated to use version 2 of the ROR (Research Organization Registry) API. #11019 (Donated by Jesiel Viana) 
  • Fixed performance of SWORDv2 servicedocument when you have a large number of collections. #10740 (Donated by fribeiro-fccn)
  • Fixed bug where SWORDv2 read/update/delete actions were failing with a 500 error. #11547 (Donated by Marsa Haoua) 
  • Fixed bug where SWORDv1 submission failed if the user was not an Administrator. #8647
  • REST API has been updated to eager load CSRF tokens again, similar to DSpace 7.x. #11154 (Donated by Neki-IT)
• Search Engine Optimization (SEO) fixes
  • Fixed bug where private (non-discoverable) item pages were missing the "noindex" meta tag that tells crawlers to avoid indexing the item. #4835 (Donated by Atmire)
  • Added 'rel="nofollow"' to all search facets on the search page to tell well-behaved bots not to follow those links. #4785 (Donated by Alan Orth)
• Administrative enhancements and fixes
  • Fixed several bugs where Community Administrators would see objects they didn't have permissions on when using the "edit" or "new" sidebar menus. #8916, #8917, #8918 (Donated by Vir Softech)
  • Fixed bug where Item Versioning could fail if special characters were added to the "Summary" field. #4327 (Donated by Jukka Lipka)
  • When creating a new Bundle all custom, non-admin policies are now inherited from the parent Item. #9212 (Donated by The Library Code)
  • Fixed bug where client-side rendering (CSR) of the user interface could fail if the "ui.nameSpace" configuration was customized in "config.*.yml". #4637 (Donated by Milan Majchrak)
  • Fixed bug where backend would fail to startup when "citation-page.enabled_communities" configuration was enabled. #11167 (Donated by Miika Nurminen)
  • Fixed bug where "checker" and "bitstore-migrate" command-line scripts would not save updates / current status if the script was interrupted. #10507 and #10489 (Donated by David Steelman)
  • Fixed bug where "subscription-send" command-line script was not sending updates about restricted items when the user has permissions on those restricted items. #10506 (Donated by dataquest)
  • Fixed bug where "filter-media" command-line script did not understand orientation metadata in jpeg images. #10534 (Donated by 4Science)
  • Fixed bug where running "export" command-line script on an Item in workspace or workflow would return an error even though the export succeeds. #11074 (Donated by Martin Walk)
  • Fixed open connection leak in "import" command-line script. #10886 (Donated by Atmire)
  • Fixed bug where "cleanup" command-line script would fail if a request-for-copy existed in the database for the deleted bitstream. #9674 (Donated by Atmire)
  • Amazon S3 integration has been updated to use AWS SDK v2. #10819 (Donated by Mark Patton)
• Fixed a large number of other small bugs.  See Changes in 8.x for a list of all changes.

8.3 New/Updated Language support

• French (Français) language updates donated by Nima Behforouz (nimabehforouz)
• Ukrainian (Yкраї́нська) language updates donated by Olexandr Shaposhnyk (oshaposhnyk)

8.3 Acknowledgments

The DSpace application would not exist without the hard work and support of its community. Thank you to the many developers who have worked very hard to deliver all the bug fixes and improvements. This release was entirely volunteer driven!

Development Acknowledgments

A total of 41 unique individuals contributed to 8.3.

Frontend / User Interface Acknowledgments 

The following 16 individuals have contributed directly to the new DSpace (Angular) User Interface in this release (ordered by number of GitHub commits): Alan Orth (alanorth), Jesiel Viana (jesielviana), Kim Shepherd (kshepherd), Tim Donohue (tdonohue), Francesco Molinaro (FrancescoMolinaro), Jukka Lipka (jlipka), Abhinav Sidharthan (AbhinavS96),  Daniel Coelho (danielcoelhocgu), Nima Behforouz (nimabehforouz), Toni Prieto (toniprieto),  Zahraa Chreim (ZahraaChreim-Atmire), Bram Maegerman (bram-maegerman), im-shubham-vish, Milan Majchrak (milanmajcrak), Nicholas Woodward (nwoodward), Olexandr Shaposhnyk (oshaposhnyk).

The above contributor list was determined based on contributions to the "dspace-angular" project in GitHub between 8.2 (after July 14, 2025) and 8.3 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-07-14

Backend / REST API Acknowledgments 

The following 35 individuals have contributed directly to the DSpace backend (REST API, Java API, OAI-PMH, etc.) in this release (ordered by number of GitHub commits): Tim Donohue (tdonohue), Johnny Mendes do Carmo (JohnnyMendesC), Jesiel Viana (jesielviana), Vincenzo Mecca (vins01-4science), Nicholas Woodward (nwoodward), Alan Orth (alanorth), Kim Shepherd (kshepherd), Miika Nurminen (minurmin), Alexandre Vryghem (alexandrevryghem), David Steelman (dsteelma-umd), Mark Wood (mwoodiupui), Michele Boychuk (Micheleboychuk), Sascha Szott (saschaszott), Elios Buzo (eliosbz), Joran De Braekeleer (gingyx), Kristof De Langhe (Atmire-Kristof), Pierre Lasou (pilasou), Zahraa Chreim (ZahraaChreim-Atmire), Abhinav Sidharthan (AbhinavS96), Andreas Czerniak (ACz-UniBi), Daniel Coelho (danielcoelhocgu), Marie Verdonck (MarieVerdonck), Mark Patton (markpatton), Marsa Haoua (marsaoua), Martin Walk (MW3000), Nathan Buckingham (ConfusionOrb221), Paulo Graça (paulo-graca), Stefano Maffei (steph-ieffam), Toni Prieto (toniprieto), Zeroday BYTE (odaysec), fribeiro-fccn, Igor Baptista da Costa (IgorBaptist4), im-shivamb, im-shubham-vish, Jozef Misutka (vidiecan).

The above contributor list was determined based on contributions to the "DSpace" project in GitHub between 8.2 (after July 14, 2025) and 8.3 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-07-14

8.2 Release Notes

DSpace 8.2 provides bug fixes, accessibility & performance improvements to the 8.x platform. No new features are provided. As such this release should be an easier upgrade for sites already running 8.x.

8.2 Security Fixes

• Fix for CVE-2025-53621 (moderate severity). XML External Entity (XXE) injection possible in import via Simple Archive Format (SAF) or import from external sources. See security advisory or mailing list “security notice” for details.
• Fix for CVE-2025-53622 (moderate severity). Path traversal vulnerability in Simple Archive Format (SAF) package import via “contents” file. See security advisory or mailing list “security notice” for details.
• Fix possible "Zip Slip" in SWORDv2 ingest process. This potential issue was found via an automated code scan and no exploit has been confirmed. See #10725
• This release also includes many dependency updates in order to keep all DSpace sites secure. Some of these updates patch vulnerabilities that have been reported by those dependencies. But no exploits of these vulnerabilities have been confirmed in DSpace.

8.2 Breaking Changes

Some fixes in 8.2 required major code or configuration changes. The following changes may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

• Frontend configuration "ssr > paths" has been replaced by "ssr > excludePathPatterns".  In DSpace 7.6.3 and 8.1, it was possible to only enable SSR (server-side rendering) for specific User Interface paths (configured by the "ssr > paths" configuration in your "config.*.yml" file.  This setting has been replaced by the inverse configuration, which allows you to exclude specific paths from SSR.  See "excludePathPatterns" in the "ssr" section of the User Interface Configuration and #4227 (Donated by 4Science)
  • This change was necessary to fix an SEO bug where error pages and Handle redirects would return "200 OK" responses when the prior configuration ("ssr > paths") was used.  See #4132 and #4042
• OAI-PMH templating has moved from using JTwig to Thymeleaf. This also fixes errors thrown by the root page (/server/oai) since 8.0. This change to Thymeleaf is unlikely to impact sites unless you've modified the visual display of the OAI-PMH interface (i.e. the display of OAI-PMH when viewed from a web browser). See #10563 (Donated by Kim Shepherd)

8.2 Major Bug Fixes and Improvements

• General user enhancements and fixes
  
  • The default tab on Community/Collection pages is now configurable. By default, as in 8.0 and 8.1, it will still be the "Search" tab, but it can be modified using the new "defaultBrowseTab" setting under the "community" or "collection" configurations in your config.*.yml. See also #4436 (Donated by Abel Gomez, backported by Nick Woodward)
    • This minor enhancement allows sites to revert to using "Subcommunities and Collections" as the default tab like in version 7.x.
  • Fixed search bug where stale data could sometimes be returned. #3888 (Donated by Atmire)
  • Fixed bug where access-restricted thumbnails were not shown to users who have proper access rights. #4165 (Donated by Atmire)
  • Fixed statistics bug where "view" events could be sent twice when using scoped themes. #4099 (Donated by Atmire)
  • Fixed bug where sorting in descending order on Browse by Author may result in an error. #10618 (Donated by Toni Prieto)
  • Fixed bug where navigation bar buttons (search, language, login) could wrap on small screens. #3512 (Donated by 4Science)
• Submission / Workflow enhancements and fixes
  
  • Fixed caching issues that could occur on MyDspace page when switching between views. #4205 (Donated by 4Science)
  • Fixed issue where search filters could disappear from MyDSpace page. #4097 (Donated by Arvo Consultores)
  • Fixed infinite loading issue that could occur on submission forms. #4388 (Donated by Atmire)
  • Fixed bug where an admin could not upload a bitstream to an item in workflow when impersonating a user. #4308 (Donated by 4Science)
  • Fixed bug where fields of type "name" in submission forms could not be deleted properly. #4073 (Donated by Atmire)
  • Fixed bug where the "preloadLevel" for a controlled vocabulary was being ignored.  This setting should let sites decide how many levels to automatically open in any hierarchical vocabulary. #3820 (Donated by Atmire)
  • ArXiv importer began failing because its configuration didn't use the HTTPS URL. #10999 (Donated by Atmire)
  • CrossRef importer wasn't mapping to default DSpace document types. #9900 (Donated by Paulo Graça)
  • Web of Science importer was enhanced to provide better error handling. #10692 (Donated by 4Science)
  • Improved proxy support for all external sources/APIs. All external connections should now use the DSpace Proxy Configuration. See also #10639 and #10723 (Donated by 4Science)
  • Alphabetized all external sources in the import dropdown by source name. #10806
• Administrative enhancements and fixes
  
  • Health page now includes an "SEO" validation check. A basic check of your DSpace site's Search Engine Optimization is now available on your Health page (/health) in the Admin sidebar.  This SEO report checks that your sitemap is visible, your robots.txt is visible and that you have SSR (Server Side Rendering) enabled.  See #10485 (Donated by Atmire)
    • This minor enhancement helps sites to find and resolve SEO issues which are frequently reported by Google Scholar (and similar search engines).
  • Fixed bug where list of bitstreams on "Edit Item > Bitstreams" tab would be duplicated when using pagination. #4015 (Donated by Atmire)
  • Fixed bug where editing a bitstream and changing its file format would still display the old (cached) format. #4137 (Donated by Jesiel Viana)
  • COAR Notify was not fully adhering to the "Request Endorsement" pattern supported by PCI (https://peercommunityin.org/). #10053 (Donated by Agustina Martinez)
  • Fixed issued where Collection Admins could not add new policies to bitstreams. #10951 (Donated by 4Science, backported by Max Nuding)
  • Fixed issued where Collection Admins could not view metadata of withdrawn items. #10682 (Donated by 4Science)
  • Fixed issue where, when impersonating another users, an Administrator could not upload files to items in workflow approval. #4288 (Donated by 4Science)
  • Fixed pagination issue with Bulk Access Control script/page which could cause duplicate policies to be created. #10699 (Donated by 4Science)
  • Fixed issue where Handles were not stored for communities & collections when `VersionedHandleIdentifierProviderWithCanonicalHandles` provider was enabled. #10240 (Donated by Atmire)
  • Fixed issue where "Content Reports" were accidentally missing from Admin Sidebar even when enabled. #3976 (Donated by Université Laval)
  • Fixed issue where emails were not handling empty values and would display "${param}" code in the email text. #10581 (Donated by Mark Wood)
• Performance/stability improvements:
  • Limited the number of Items that can be exported at once to 500.  This limit is configurable on backend via "bulkedit.export.max.items" #10030 (Donated by Atmire)
  • Fixed issue where login endpoints to REST API didn't always close their database connection after login action was completed. #10598 (Donated by Atmire)
  • OpenSearch now limits its results per page to 100, though it is configurable via "websvc.opensearch.max_num_of_items_per_request" setting. #10644 (Donated by Sascha Szott)
  • Indexing improvements to the "index-discovery" script when your site has a larger number of relationships (between entities). #10352 (Donated by Atmire)
  • Fixed bug when DSpace could fail to startup when ORCID connections failed (if ORCID is enabled). #10552 (Donated by The Library Code)
  • Fixed bug where, when enabled, PDF CoverPages would throw an error if the PDF was opened in the browser. #9989 and #9665 (Donated by The Library Code, backported by Miika Nurminen)
• Accessibility improvements:
  • Accessibility Settings can be customized by users. Basic accessibility settings like Notification (popup) timeouts and ARIA Live Region timeouts can now be customized by each user of your site via the "Accessibility Settings" link in the footer.  This allows users more control over how long confirmation and error messages are displayed. #3614 (Built by Atmire, funded via the DSpace Development Fund)
  • Truncated abstracts now use ellipsis for truncation instead of fading out. #4343 (Built by 4Science, funded via the DSpace Development Fund)
  • Improved screen reader accessibility for header and recent submissions. #4335 (Donated by Atmire)
  • Enhanced keyboard navigation on several pages. #4313 (Donated by eScire)
• OpenAIRE v4 compliance improvements to both the OpenAIRE submission forms and the OAI-PMH "oai_openaire" metadata format. #10175 (Built by Atmire, funded from Ireland's National Open Research Forum (NORF) under the 2022 Open Research Fund)
• Fixed a REST API bug where sending a PATCH request for an unknown metadata field could clear all object metadata. (This only impacts REST API and not the UI.) #10961 (Donated by Atmire)
• Fixed a large number of other small bugs.  See Changes in 8.x for a list of all changes.

8.2 New/Updated Language support

• French (Français) language updates donated by Pierre Lasou (pilasou) and Carolyn Sullivan (Peredwel) and Nima Behforouz (nimabehforouz)
• German (Deutsch) language updates donated by The Library Code and Sascha Szott (saschaszott)
• Hungarian (Magyar) language updates donated by Zoltán Kanász-Nagy (kanasznagyzoltan)

8.2 Acknowledgments

The DSpace application would not exist without the hard work and support of its community. Thank you to the many developers who have worked very hard to deliver all the bug fixes and improvements. This release was entirely volunteer driven!

Development Acknowledgments

A total of 43 unique individuals contributed to 8.2.

Frontend / User Interface Acknowledgments 

The following 29 individuals have contributed directly to the new DSpace (Angular) User Interface in this release (ordered by number of GitHub commits): Andreas Awouters (AAwouters), Alexandre Vryghem (alexandrevryghem), Francesco Molinaro (FrancescoMolinaro), Alan Orth (alanorth), Art Lowel (artlowel), Dan Gastardelli (DanGastardelli), Adamo Fapohunda (AdamF42), Jens Vannerum (jensvannerum), Kristof De Langhe (Atmire-Kristof), Pierre Lasou (pilasou), Tim Donohue (tdonohue), Andrea Barbasso (AndreaBarbasso), Jesiel Viana (jesielviana), Sergio Fernández Celorio (sergius02), Abhinav Sidharthan (AbhinavS96), Lotte Hofstede (LotteHofstede), Agustina Martinez (amgciadev), Kim Shepherd (kshepherd), Sascha Szott (saschaszott), Yannick Paulsen (YPaulsen-TLC), Nicholas Woodward (nwoodward), Carolyn Sullivan (Peredwel), Jean-François Morin (jeffmorin), Joran De Braekeleer (gingyx), Zoltán Kanász-Nagy (kanasznagyzoltan), Nona Luypaert (nona-luypaert), Oscar Chacón (oscar-escire), Victor Hugo Duran Santiago (VictorHugoDuranS), Escalante Guillermo (guillermo2519).

The above contributor list was determined based on contributions to the "dspace-angular" project in GitHub between 8.1 (after Feb 7, 2025) and 8.2 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-02-07

Backend / REST API Acknowledgments 

The following 25 individuals have contributed directly to the DSpace backend (REST API, Java API, OAI-PMH, etc.) in this release (ordered by number of GitHub commits): Kim Shepherd (kshepherd), Tim Donohue (tdonohue), Stefano Maffei (steph-ieffam), Sascha Szott (saschaszott), Jens Vannerum (jensvannerum), Elios Buzo (eliosbz), Adamo Fapohunda (AdamF42), Max Nuding (max-nuding), Michele Boychuk (Micheleboychuk), Toni Prieto (toniprieto), Abhinav Sidharthan (AbhinavS96), Agustina Martinez (amgciadev), Alan Orth (alanorth), Jesiel Viana (jesielviana), Alexandre Vryghem (alexandrevryghem), Mark Wood (mwoodiupui), Marcin Miłosz (MMilosz), Martin Walk (MW3000), Pascal-Nicolas Becker (pnbecker), Piaget Bouaka Donfack (PiagetBouaka), Yury Bondarenko (ybnd), Zahraa Chreim (ZahraaChreim-Atmire), James Sullivan (jameswsullivan), Paulo Graça (paulo-graca), Nicholas Woodward (nwoodward).

The above contributor list was determined based on contributions to the "DSpace" project in GitHub between 8.1 (after Feb 7, 2025) and 8.2 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2025-02-07

8.1 Release Notes

DSpace 8.1 provides bug fixes, accessibility & performance improvements to the 8.x platform. No new features are provided. As such this release should be an easier upgrade for sites already running 8.x.

8.1 Breaking Changes

Some accessibility and bug fixes in 8.1 required major code or configuration changes. The following changes may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

• Angular Server Side Rendering (SSR) is no longer performed for all pages in DSpace.  By default, new limitations are places on which pages (or parts of pages) are rendered via SSR.  This was done to help reduce the CPU/memory that is used by bot traffic. Many bots will trigger SSR unnecessarily, resulting in potential performance issues. You may wish to review these new settings and adapt them, as necessary, to your production site. These new settings are all configurable, allowing you to decide if the new behavior or old behavior is desired.
  • By default, SSR is only performed for paths in the sitemap.  This means search engine crawlers can continue to access these sitemap pages via SSR. However, it ensures bot traffic is limited to a subset of the site. See Server Side Rendering (SSR) Settings and #3682 
  • By default, SSR is no longer performed for the search and browse components (on every page they are used).  This ensures that embedded searches/browses on Community, Collection, or Item (Entity) pages are not triggered by search engine crawlers or bots. See Server Side Rendering (SSR) Settings and #3709
• DSpace has a new, separate command-line log file ([dspace]/log/dspace-cli.log-[date]) for logging the output/results of any scripts that are started from the command-line.  The DSpace backend web application still logs to dspace.log-[date] in the same directory.  You may need to update any local/custom log management scripts to include this new log file.
  
  • This change was necessary to fix a major bug where the backend webapp would sometimes stop logging if a "logrotate" was triggered. See #9832 
• The "Edit Item, Bitstreams tab" was refactored to use an HTML table. This was necessary to fix major accessibility and keyboard navigation issues with the page.  The entire page was rebuilt to us a <table> instead of using nested <div> tags. See #3464

8.1 Major Bug Fixes and Improvements

• Performance improvements in the User Interface
  • Angular Server Side Rendering (SSR) has been updated to attempt to reduce the CPU/memory necessary for managing bot traffic
    • By default, SSR is now only performed for paths in the sitemap (see new "paths" setting in Server Side Rendering (SSR) Settings). This means search engine crawlers can continue to access these sitemap pages via SSR. However, it ensures bot traffic is limited to a subset of the site: #3682 (Donated by Vitor Silverio and Alan Orth) 
    • By default, SSR is no longer performed for the search and browse components (see Server Side Rendering (SSR) Settings). This ensures that embedded searches/browses on Community, Collection, or Item (Entity) pages are not triggered by search engine crawlers or bots: #3709 (Donated by 4Science)
    • Optionally, sites may configure SSR to occur via a separate, private/localhost REST API URL. This may provide performance benefits as it allows SSR processing to bypass DNS lookup and make private requests (including via localhost) directly to the machine running the REST API. See "ssrBaseUrl" in REST API Settings and #3358 (Donated by 4Science)
  • Ensure components are not sending requests for large sets of data (i.e. bypassing pagination): #2513 (Donated by 4Science)
  • Edit Item page would sometimes fail to load or encounter an infinite loop when clicking between tabs: #3677 or when visiting the version history page: #3252 (Donated by Atmire)
  • Workflow tasks loaded slowly when there were large numbers of groups: #9860 (Donated by PCG Academia)
  • Reduced the number of requests sent to backend when loading search results (by fixing a few caching bugs): #3415 (Donated by Atmire)
  • Reduced number of requests when loading the simple item page: #3701 (Donated by Atmire)
  • Browse pages were retrieving more data then necessary, resulting in poor performance for larger numbers of values: #10057 (Donated by Toni Prieto)
  • Several administrative pages could encounter infinite loading errors. These included EPerson and Group pages, Bitstream and Metadata registry, and pagination tools: #3585 (Donated by Atmire)
  • Improve performance of Group2Group cache to better support sites with many Groups. #9760 (Donated by Alfeu U. Tavares)
  • Reduced memory usage OAI-PMH full reindex: #10089 (Donated by Toni Prieto)
• Accessibility improvements in User Interface
  • Edit Item, Bitstreams tab was refactored to enhance accessibility and keyboard control: #3464 (Donated by Atmire)
  • Submission interface now supports keyboard reordering of multi-valued fields: #1271 (Donated by 4Science)
  • Ensured several pages have properly ordered HTML headings: #3071 (Donated by 4Science)
  • An invisible ARIA "live region" now exists which can communicate notifications and page changes to screen readers (Donated by Atmire)
  • All disabled buttons in DSpace are now accessible to users using a screen reader: #3249 (Donated by Atmire)
  • "All of DSpace" browse menu has improved keyboard navigation: #3085 (Donated by Atmire)
  • Controlled Vocabulary tree-view has improved support for keyboard navigation and screen readers: #3367 (Donated by Neki-it)
  • File download link has been updated to include the file name in the ARIA label (for screen readers): #3762 (Donated by Neki-it)
  • Date slider in search results was reloading the entire page of results, causing issues with accessibility: #3236 (Donated by 4Science)
  • Other minor accessibility improvements
• Usability improvements in the User Interface
  • User menu remained open after clicking on a link. #3021 (Donated by 4Science)
  • Ensure it's again possible to add free-text values to metadata fields using a controlled vocabulary: #3583 (Donated by Toni Prieto)
• ORCID integration fixes. These fixes were all funded by ORCID Global Participation Fund and built by 4Science
  • Fix several bugs with updating ORCID synchronization settings in the User Interface: #8925
  • ORCID integration was not sending updated information when an Item is versioned: #8662
  • Disconnecting your Person Entity from ORCID was not revoking your ORCID token: #9088
  • ORCID icons are now displayed next to any author who has an ORCID stored in DSpace.  A tooltip will display the person's ORCID: #9086 
• Submission / Workflow fixes
  • Dropdown or lookup fields would sometimes reset when "Enter" key was pressed: #3724 (Donated by Atmire)
  • Reordering multi-valued fields was not always working properly: #3679 (Donated by 4Science)
    
  • Drag and drop of Subject Keywords in the submission form was not working properly when there were multiple rows of keywords: #3624 (Donated by 4Science)
  • Reviewers were not able to edit files, even when "workflow.reviewer.file-edit" was enabled: #9734 (Donated by Agustina Martinez)
  • Enforce unique Item IDs in the "workspace" database table: #9341 (Donated by Atmire)
• Administrative Fixes
  • Backend webapp would sometimes stop logging if a "logrotate" was triggered.  This was fixed by creating a separate log file (dspace-cli.log-[date]) for command-line task logs: #9832 (Donated by Atmire) 
  • System-wide alerts were not staying on screen: #3424 (Donated by 4Science)
  • Community Administrators where wrongly seeing the button to create top-level communities: #3288 (Donated by 4Science)
  • Edit Item, Metadata tab was truncating the list of available metadata fields: #2730 (Donated by eScire)
  • User Profile page was only showing the first 20 group memberships: #2357(Donated by eScire)
  • On the Administer Workflow page, the "Delete" button was not deleting the Item: #3086 (Donated by eScire)
  • The "filter-media" script now supports a "fromdate" parameter (-d) to only process Items modified/created after a specific date: #9653 (Donated by PCG Academia)
  • If a file was larger than the full-text indexing limit, it was not being indexed properly: #9893 (Donated by Brian Keese)
  • If Tomcat shut down when a Process was running, the Process would stay in the "running" state forever: #9727 and #10156 (Donated by Atmire)
  • DOI Organizer would fail on the first error, ignoring the rest of the queue: #9828 (Donated by Mark Wood)
  • "check links" curation task would fail if it encountered a redirect: #9658 (Donated by Atmire)
• Other major fixes
  • Clicking on Browse by Author after Browse by Issue Date was generating a server error: #573 (Donated by Atmire)
  • After logging in via Shibboleth, the page content and admin sidebar didn't always load correctly: #3011 (Donated by Michael Spalti)
  • Embedded Tomcat was not loading customizations (additions or server modules): #9987 (Donated by David Steelman)
• Many updates to dependencies. Removal of some older, unused dependencies. 
  • Backend dependency updates (includes an upgrade to Spring Boot 3.4)
  • Frontend dependency updates (includes an upgrade to the latest version of Angular 17)
• Many other minor bug fixes as listed in Changes in 8.x.

8.1 New/Updated Language support

• Arabic (العربية) language updates donated by KnowledgeWare Technologies Est.
• Catalan (Català) language updates donated by Toni Prieto
• Czech (Čeština) language updates donated by Milan Majchrak
• French (Français) language updates donated by Pierre Lasou (pilasou) and Nima Behfourouz (nimabehforouz)
• German (Deutsch) language updates donated by Sascha Szott (saschaszott)
• Hungarian (Magyar) language updates donated by Zoltán Kanász-Nagy (kanasznagyzoltan)
• Spanish (Español) language updates donated by Toni Prieto and Neki-it

8.1 Acknowledgments

The DSpace application would not exist without the hard work and support of its community. Thank you to the many developers who have worked very hard to deliver all the bug fixes and improvements. This release was entirely volunteer driven!

Development Acknowledgments

A total of 56 unique individuals contributed to 8.1.

Frontend / User Interface Acknowledgments 

The following 39 individuals have contributed directly to the new DSpace (Angular) User Interface in this release (ordered by number of GitHub commits): Andreas Awouters (AAwouters), Tim Donohue (tdonohue), Alexandre Vryghem (alexandrevryghem), Sascha Szott (saschaszott), Jens Vannerum (jensvannerum), Francesco Molinaro (FrancescoMolinaro), Andrea Guevara (Andrea-Guevara), Giuseppe Digilio (atarix83), Pierre Lasou (pilasou), Milan Majchrak (milanmajchrak), Alan Orth (alanorth), Dan Gastardelli (DanGastardelli), Andrea Barbasso (AndreaBarbasso), Simone Ramundi (Simone-Ramundi), Toni Prieto (toniprieto), Zoltán Kanász-Nagy (kanasznagyzoltan), Alisa Ismailati (alisaismailati), Victor Hugo Duran Santiago (VictorHugoDuranS), Julia Gilmore (alphapetjg), Kim Shepherd (kshepherd), Ricardo Saraiva (rsaraivac), Vincenzo Mecca (vins01-4science), Yana De Pauw (YanaDePauw), Igor Baptista da Costa (IgorBaptist4), Nicholas Woodward (nwoodward), Emmanuel Pastor (pastr),  Koen Pauwels (KoenP), Arta Seyedian (aseyedia), Bridget Almas (balmas), Drew Heles (dheles), Elvi Nemiz (eulereadgbe), Michael Spalti (mspalti), Miika Nurminen (minurmin), Mohamed Ali (mohamedali654321), Mohana Sarmiento (msarmie), Nima Behfourouz (nimabehforouz),  Vladzislav Novski (vNovski), Alfeu Tavares (autavares-dev), Lotte Hofstede (LotteHofstede).

The above contributor list was determined based on contributions to the "dspace-angular" project in GitHub between 8.0 (after June 21, 2024) and 8.1 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2024-06-21

Backend / REST API Acknowledgments 

The following 31 individuals have contributed directly to the DSpace backend (REST API, Java API, OAI-PMH, etc.) in this release (ordered by number of GitHub commits): Tim Donohue (tdonohue), Sascha Szott (saschaszott), Kim Shepherd (kshepherd), Giuseppe Digilio (atarix83), Mark Wood (mwoodiupui), Jens Vannerum (jensvannerum), Andrew Alesik (AndrewAlesik), Nona Luypaert (nona-luypaert), Kristof De Langhe (Atmire-Kristof),  Vincenzo Mecca (vins01-4science), Alfeu Tavares (autavares-dev), Igor Baptista da Costa (IgorBaptist4), Christian Clauss (cclauss), Florian Gantner (floriangantner), Jukka Lipka (jlipka), Marie Verdonck (MarieVerdonck), Mikhail Schastlivtsev (schastlivcev), Nathan Buckingham (ConfusionOrb221), Pierre Lasou (pilasou), Toni Prieto (toniprieto), Agustina Martinez (amgciadev), Alexandre Vryghem (alexandrevryghem), Brian Keese (bkeese), Chris Wilper (cwilper), David Steelman (dsteelma-umd), Drew Heles (dheles), Eike Löhden (Leano1998), Kevin Van de Velde (KevinVdV), Koen Pauwels (KoenP), Oscar Chacón (oscar-escire), Nicholas Woodward (nwoodward).

The above contributor list was determined based on contributions to the "DSpace" project in GitHub between 8.0 (after June 21, 2024) and 8.1 using "git shortlog" on the dspace-8_x branch and excluding all merge commits: git shortlog -s -n -e --no-merges --since 2024-06-21

8.0 Release Notes

DSpace 8.0 is a major release of the DSpace platform.  It provides new features and improvements, along with bug fixes.  You should be aware that all major releases may provide some "breaking changes" (major changes that may impact your local customizations).

Security Fixes

• Fix CVE-2024-38364 (low severity) by disabling the ability to open HTML/XML bitstreams in a user's browser.  See https://github.com/DSpace/DSpace/security/advisories/GHSA-94cc-xjxr-pwvf (or mailing list announcements) for more details & configuration workaround. (Discovered and reported by Muhammad Zeeshan (Xib3rR4dAr))

New User Features

• OpenAIRE Data Correction: this feature provides a basic integration with the OpenAIRE Content Provider Dashboard via the Notification Broker.  It allows repositories who have subscribed to the OpenAIRE Notification Broker to import JSON data from OpenAIRE in order to enhance or correct the metadata of Items in the repository. (Made possible thanks to the OpenAIRE Call Innovation funded project "Enrich local data via the OpenAIRE Graph” awarded to 4Science.)
• OpenAIRE Publication Claim: this feature provides a closer integration between DSpace and the OpenAIRE Publication REST API.  It allows DSpace to import possible publications from OpenAIRE for users having a Researcher Profile in DSpace. (Made possible thanks to the OpenAIRE Call Innovation funded project "Enrich local data via the OpenAIRE Graph” awarded to 4Science.)
  
• COAR Notify Protocol: DSpace now supports the COAR Notify Protocol for sending & receiving Linked Data Notifications (LDN) messages from external systems.  DSpace is able to register external LDN services to send or receive messages from.  This allows users to request review/endorsement from an external service (supporting COAR Notify) during the Item submission process.  It also allows these external services to send event notifications into DSpace's Quality Assurance tool.  (Donated by COAR & 4Science)
• Request Withdrawal or Reinstatement: Optionally, all logged-in users are able to request that a specific Item be withdrawn or reinstated using the DSpace Quality Assurance tool (also used by Data Correction, Publication Claim and COAR Notify).  These requests can be reviewed by an Administrator where they can either accept or reject the request. The request may also be cancelled by the user who submitted it. (Backend Donated by 4Science, funded by the University of California - California Digital Library; Frontend Donated by 4Science)
• Basic Duplicate Detection in submission and workflow: this feature introduces basic duplicate detection into DSpace submission and workflow, using Solr's ability to search by levenshtein distance. When enabled, all new submissions or items in workflow will be checked against similar items already in DSpace & the user will be notified of any possible duplicate items. (Developed by The Library Code with support of TU Berlin, FHNW and ZHAW.)
• "Processes" page has been reorganized: To simplify process management through the Administrator UI, the "Processes Overview" page has been restructured to group processes into separate sections for "running", "scheduled", "completed" and "failed". These sections update automatically. (Donated by Atmire)
• Improved "Primary Bitstream" management: Submitters can now define if a bitstream is a "primary" bitstream directly on the submission page after a file has been uploaded.  On the Item page, the primary bitstream now has a badge. The primary bitstream is the file that will be listed first in the download list, and its thumbnail will be displayed on the Item page. (Developed by 4Science, funded by the University of California - California Digital Library)
• Search Tab on Community/Collection pages: All Community and Collection pages now include a "Search" tab which displays the Recent Submissions by default.  This tab also provides a search box allowing users to search within that Community or Collection. (Donated by Atmire)
• Search Facets on Homepage, Community/Collection pages: Optionally, search facets/filters can now be displayed on home page and all Community, and Collection pages.  By default, they are not displayed on the homepage (see "showDiscoverFilters" in Homepage settings), but always displayed on Community/Collection pages (see "showSidebar" in Community and Collection settings). (Donated by DSquare Technologies and Atmire)
• Advanced Search options: Optionally, a new "Advanced Search" filter can be enabled on the Search page to provide advanced search capabilities.  This "Advanced Search" filter allows supports the searching within fields using the following operators by default: Contains, Not Contains, Equals, and Not Equals. See the "advancedFilters" in the Search settings for more details.  (Donated by DSquare Technologies)
• Lookup via external sources from the Edit Item page (Relationship tab): When editing an Entity, on the "Relationships" tab you can now click the "+Add" button to lookup and import related entities from supported external sources (e.g. CrossRef, ORCID, PubMed, etc).  (Donated by Atmire)
• Import via DOI searches multiple sources at once (CrossRef, DataCite):  a new external source has been added which can be configured to query multiple existing sources simultaneously, returning results from either.  By default, this external source is configured for a new "DOI" lookup which will search CrossRef and DataCite simultaneously. (Donated by University of Bamberg)
• Edit Metadata using Authority Control lookup: User are now able to edit metadata controlled by vocabularies in item's metadata edit form in the same way that is done in submission form. (Donated by Toni Prieto)
• Rioxx v3 OAI profile support: DSpace can now expose metadata in the OAI module in the Research Outputs Metadata Schema (RIOXX) Application Metadata Profile Version 3. See Rioxx v3 schema compliance for details. (Donated by Agustina Martinez, Cambridge University)
• OAI now can expose embargo information & access rights: access rights for bitstreams is available in the OAI XOAI format and has been added to the following OAI formats: OpenAIRE and UKETD/EthOS. (Donated by Agustina Martinez, Cambridge University)
• Creative Commons licenses now appear on Item page. See https://github.com/DSpace/dspace-angular/pull/3010 (Donated by Alfeu U. Tavares)
• Research Organization Registry (ROR) Integration: When using Configurable Entities, ROR can be used as an Organization Data Provider.  New "Organizational Unit" entities can be imported via the ROR API (from the existing MyDSpace import tool).  When imported, the ROR icon is displayed on the "Organization Unit" page, linking back to its entry in ROR (as suggested by the ROR-ID guidelines). ROR information is also shareable via OAI-PMH and ORCID.  (Donated by 4Science)
• Item submission process can be configured at community level: In the "item-submission.xml" configuration, it is now possible to map a submission form to a Community. This will cause all descendant collections to use the mapped item submission process. This can be useful for repositories where top-level communities represent different document types or scopes and descendant collections should share the same submission process. (Donated by Toni Prieto)
• Administrator Reports (beta): The beta release of the Administrator Reports provides the ability to run the reports and display the results in the User Interface (similar to the "DSpace REST Quality Control Reports" from version 6.x).  Two reports are provided: Filtered Collection and Metadata Query.  It is not yet possible to export these reports. At this time, running large reports with many results may result in site performance issues. Therefore, this feature is disabled by default and should be used with caution. (Donated by Université Laval)

Breaking Changes

The following major changings may negatively impact or "break" your local customizations to prior versions of DSpace.  Please be aware of them before upgrading.

• Java 17 and Tomcat 10 (or later) is required for the backend.  The DSpace 8 backend can no longer be run on Java 11 or Tomcat 9 as it has been updated to Spring 6 / Spring Boot v3 to support Jakarta Enterprise Edition 9+.  You must upgrade these dependencies in order to run DSpace 8.  If you are using a different servlet engine, you must ensure it is compatible with Jakarta EE 9+ (e.g. Jetty must be version 11 or later)
  • If you have any custom Java code or custom plugins, they must all be migrated to use "jakarta.*" dependencies instead of "javax.*" dependencies.  It is not possible to use older "javax.*" dependencies in DSpace 8. 
• Node 18 or 20 is required for the frontend. The DSpace 8 User Interface has been upgraded to Angular 17, and Node 16 is no longer supported. (Donated by 4Science)
• The User Interface has been migrated to Angular standalone components. This means that a large number of Angular components were refactored to use standalone components. This migration was mostly automated using the Angular process to migrate to standalone components. If you have custom Angular components, you may need to migrate them as well. See also https://github.com/DSpace/dspace-angular/pull/2750 for more details on this migration process. (Donated by 4Science)
• The deprecated REST API v6 ("dspace-rest" module) was removed.  All custom code must be migrated to the new REST API (first released in 7.x).  Any custom code which depends on the older REST API v6 must be rewritten, as the new REST API is not backwards compatible. For more information on the removed REST API v6, see the DSpace 7.x documentation.
• "Type" field (dc.type) is now required by default. In all submission form configurations (in "submission-forms.xml" as described in Submission User Interface), the "dc.type" field is now required. This was changed to better support integrations with DataCite and other systems that expect a "type" for every resource.  If you do not want this change, you can undo the changes in your local copy of "submission-forms.xml". (Donated by The Library Code)
• The "dc.date.available" field is no longer set by DSpace during submission. DSpace has had two fields which represented when an object was added/available in DSpace: "dc.date.accessioned" and "dc.date.available".  The Accessioned Date (dc.date.accessioned) has always represented the date the object was deposited into DSpace, while the Available Date (dc.date.available) represented the date the object was first available (which may be later than the accessioned date if the item had an embargo).  Since Embargo information is now stored on the item's authorization policy, the "dc.date.available" date is no longer useful or accurate.  Therefore, DSpace no longer will automatically set a "dc.date.available", as any embargo date can be retrieved via the item's policies. See #9103.
  • If you have any custom code that relied on the "dc.date.available" metadata field, we recommend updating it to use "dc.date.accessioned".  Alternatively, you could use the REST API to obtain embargo information from an Item's resource policies.
• In User Interface, the service which generates HTML "<meta>" tags in the "<head>" tag has been renamed from "MetadataService" to "HeadTagService".  If you have generated custom "<meta>" tags, then you will need to migrate them to the new "/src/app/core/metadata/head-tag.service.ts" file.
• In the User Interface configuration, the "universal" section has been renamed to "ssr".  See the "Server Side Rendering (SSR) Settings" in the User Interface Configuration for more details.  If you had previously customized these configurations for your site, you will need to simply move your settings under the new "ssr" section.

Major Updates and Improvements

• Apache Tomcat is now OPTIONAL for the backend.  A new Runnable JAR exists for the DSpace backend which embeds the latest version of Tomcat within it.  This Runnable JAR can be used to run the DSpace Backend without installing Tomcat. See the Installing DSpace guide for more details (Donated by 4Science)
  • DSpace Docker images also now use this Runnable JAR instead of a Tomcat image.
• Performance Improvements
  • Disabled Angular "inlineCriticalCSS" in all Server Side Rendering (SSR). This provides a performance improvement to all SSR generated pages. See https://github.com/DSpace/dspace-angular/pull/2067 (Donated by 4Science)
  • Indexing script performance improvements when reindexing a large number of items (Donated by Toni Prieto)
  • Media filter performance improvements when filtering a large number of bitstreams (for thumbnail creation or full text indexing). (Donated by 4Science)
  • Group/EPerson management User Interface performance improvements for Groups with many EPerson or SubGroup Members.  Added better pagination of group members.
  • Submission form performance improvements.  The submission form has been updated to ensure it no longer loads all related objects. (Donated by Atmire)
  • Workflow tasks page performance improvements (Donated by Atmire)
  • Submission configuration reloading performance improvements. This also improves performance of creating a new Collection. (Donated by Toni Prieto)
  • Checksum checker performance improvements (Donated by 4Science)
  • Sitemap generation performance improvements (Donated by 4Science)
  • Updated robots.txt to stop crawlers from accessing search facets (Donated by Atmire)
• Accessibility improvements in User Interface
  • Hidden "Skip to main content" button now exists on all pages. (Donated by Atmire)
  • Header / Navbar / Admin Sidebar accessibility fixes (Donated by 4Science)
  • Community list accessibility fixes (Donated by Hrafn Malmquist)
  • Color contrast fixes to "dspace" theme (Donated by Maciej Kleban)
  • Search results / MyDSpace / Item Edit /  Browse by / Login menu accessibility fixes (Donated by Atmire)
  • Community/Collection Homepage accessibility fixes (Donated by Atmire)
  • Additional keyboard controls in Submission form (Donated by Atmire)
  • Browse by Author accessibility fixes (Donated by Neki-it)
  • "Loading" message accessibility improvements (Donated by Neki-it)
  • Fixing issue with header menu being keyboard accessible on small screens (Donated by Eike Löhden)
• Google Analytics 4 updated to only count file downloads from ORIGINAL bundle. See https://github.com/DSpace/DSpace/pull/8944 (Donated by Atmire)
• Header and navbar refactoring: change both header and footer structure to make easier to handle DSpace and base themes. These refactors also improve accessibility. (See https://github.com/DSpace/dspace-angular/pull/2676)  (Donated by 4Science)
• Submission form bug fixes / stability improvements. Fixed caching issues and instability of PATCH commands (Donated by 4Science)
• Update the DataCite metadata schema to version 4.5: When DSpace register DOIs via DataCite, it has to send metadata to the DOI registry. The DataCite metadata schema used by DSpace was updated to version 4.5. (Donated by The Library Code)
• Option to disable "Forgot Password" link: When using Authentication by Password, it is now possible to disable the "Forgot Password" link via the new "user.forgot-password" backend configuration. See "Authentication by Password" documentation. (Donated by 4Science)
• Alteration to index-discovery script to only (re-)index specific type of IndexableObject: A new "-t" flag is added to the "index-discovery" script which allows you to only reindex specific object types (E.g. Item, Collection, Community). See Discovery#DiscoverySolrIndexMaintenance
• Add HTML support to System Wide Alert. See https://github.com/DSpace/dspace-angular/pull/3028 (Donated by Abel Gomez)
• Item Counts (webui.strengths) are now updating automatically again.
• Migrate from Joda-Time to java.time  as required by Joda-Time website (Donated by Mark Wood)
• UI Translation (i18n) files are now hashed to ensure they reload when updated:  See https://github.com/DSpace/dspace-angular/issues/2461 (Donated by Atmire)
• UI Migration to Angular standalone components, directives, pipes: Having standalone components, directives and pipes makes it easier to think about the dependencies of the components and are easier to refactor. See https://github.com/DSpace/dspace-angular/issues/2370 and https://angular.io/guide/standalone-migration (Donated by 4Science)
• UI should have a ProcessPollingService for common polling activities (feature process polling): dspace-angular should have a ProcessPollingService which can be used to check if a specific activity has completed
• Embedding data didn't work for REST API objects ending in "s": Standardized REST objects to use plural names. (see https://github.com/DSpace/DSpace/issues/9240) (Donated by Atmire)
• Expose 'creationTime' property on Process object and add it to '/search/byProperty' sort options in REST API: As startTime and endTime are nullable, processes with these properties set to null can't be sorted properly. Every process does have a creationTime however, making for a more reliable sorting mechanism. (Donated by Atmire)
• Consolidated spider detection:  there is no longer a separate operation to check for spiders solely by IP address.  Options to do this are removed or replaced, and the configuration property  solr-statistics.query.filter.spiderIp is removed. (Donated by Mark Wood)
• Option to hide submitter details from dc.description.provenance metadata field.  See the new "metadata.privacy.dc.description.provenance" setting in dspace.cfg  (Donated by PCG Academia)
• New ESLint rules for User Interface codebase to enforce better coding practices & reduce merge conflicts.  See https://github.com/DSpace/dspace-angular/pull/2343 (Donated by Atmire)
• Fixed bug where UI would often request "/api" root endpoint multiple times for every page (Donated by Atmire)
• Fixed bug where Amazon S3 data store was always enabled.  (Donated by 4Science)
• Fixed bug where Amazon S3 data store would sometimes leave around temp files during download process. See https://github.com/DSpace/DSpace/pull/9477 (Donated by 4Science)
• Fixed bug where MathJAX code would be displayed twice on item page. (Donated by Atmire)
• Fixed bug where subject was missing from system emails (Donated by Mark Wood)
• Fixed bug where "git" was required as a build dependency of the backend (Donated by Hrafn Malmquist)
• Fixed bug where some Item Edit pages could be viewable anonymously (but could not be interacted with). (Donated by 4Science)
• Fixed bug where first hit to repository was often not counted in SOLR Statistics because of a CSRF token mismatch.
• Fixed SEO bug where legacy bitstream URLs were redirecting with a 302 instead of a 301. See https://github.com/DSpace/dspace-angular/pull/3062 (Donated by Atmire)
• Fixed a large number of other small bugs.  See Changes in 8.x for a list of all changes.
• Major Dependency updates:  Backend updated to Spring Boot 3, Spring 6, Spring Security 6, Hibernate 6, Flyway 10.  Frontend updated to Angular 17.

New/Updated Language support

• (NEW) Arabic (العربية) translation added by KnowledgeWare Technologies Est. and updated by Ahmad Mostafa (ahmadmostafa1976)
• Czech (Čeština) translation updates donated by NTK
• Finnish (Suomi) translation updates donated by Reeta Kuukoski (reetagithub)
• French (Français) language updates donated by Pierre Lasou (pilasou)
• German (Deutsch) language updates donated by Mirko Scherf (mirkoscherf), Sascha Szott (saschaszott), and Janne Jensen (mugraph)
• Italian (Italiano) language updates donated by 4Science
• Polish (Polski) language updates donated by PCG Academia
• Portuguese (Português) language updates donated by Ricardo Saraiva (rsaraivac) and José Carvalho (j-n-c)
• Portuguese - Brazilian (Português do Brasil) updates donated by Marco Aurelio Cardoso (marcoaureliocardoso) and Thiago Rodrigues (t-rodrigues)
• Serbian Cyrillic (Српски) language updates donated by Milos Ivanovic (imilos)
• Serbian Latin (Srpski (lat)) language updates donated by Milos Ivanovic (imilos)
• Spanish (Español) language updates donated by Arvo Consultores y Tecnología. S.L

8.0 Acknowledgments

DSpace 8.0 had 312,960 lines of code changed and 94 unique individuals contributing to either the frontend or backend.

Frontend / User Interface Acknowledgments

The following 72 individuals have contributed directly to the new DSpace (Angular) User Interface in this release (ordered by number of GitHub commits): Alexandre Vryghem (alexandrevryghem), Andrea Barbasso (AndreaBarbasso), Francesco Molinaro (FrancescoMolinaro), Giuseppe Digilio (atarix83), Enea Jahollari (enea4science), Mattia Vianelli (Sondissimo), Tim Donohue (tdonohue), Yury Bondarenko (ybnd), Alisa Ismailati, Andreas Awouters (AAwouters), Davide Negretti (davide-negretti), Vladzislav Novski (vNovski), Art Lowel (artlowel), Francesco Bacchelli (frabacche), Kim Shepherd (kshepherd), Jean-François Morin (jeffmorin), Kuno Vercammen, Simone Ramundi, Jens Vannerum (jensvannerum), Michele Boychuk (Micheleboychuk), Vincenzo Mecca (vins01-4science), Zahraa Chreim (ZahraaChreim-Atmire), Sascha Szott (saschaszott), Lotte Hofstede (LotteHofstede), Alan Orth (alanorth), Hugo Daniel Dominguez de la Cruz (hugo-escire), Koen Pauwels (KoenP), Toni Prieto (toniprieto), Eike Löhden (Leano1998), Mark Wood (mwoodiupui), Paulo Graça (paulo-graca), Ricardo Saraiva (rsaraivac),  Stefano Maffei (steph-ieffam), Max Nuding (hutattedonmyarm), Hrafn Malmquist (J4bbi), Oscar Chacón (oscar-escire), Pierre Lasou (pilasou), Sergio Fernández Celorio (sergius02), Thiago Rodrigues, William Welling (wwelling), Alfeu Uzai Tavares, Kristof De Langhe (Atmire-Kristof), Marie Verdonck (MarieVerdonck), Michał Dykas (michdyk), Nona Luypaert (nona-luypaert), Michael Spalti (mspalti), Mirko Scherf (mirkoscherf), Thomas Misilo (misilot), Victor Hugo Duran Santiago (VictorHugoDuranS), Yana De Pauw (YanaDePauw), Abel Gómez (abelgomez), Agustina Martinez (amgciadev), Florian Gantner (floriangantner), Milos Ivanovic (imilos),   Hardy Pottinger (hardyoyo), Marco Aurelio Cardoso, Gaurav Patel (GauravD2t), Reeta Kuukoski (reetagithub), Maciej Kleban (Dawnkai), Andrea Bollini (abollini), Andreas Mahnke (mahnkong), Bram Luyten (bram-atmire), IgorBaptist4, Janne Jensen (mugraph), José Carvalho (josekarvalho), Mohamed Ali, NTK, Pascal-Nicolas Becker (pnbecker), Philipp Rumpf (philipprumpf), Nagy Akos (akoscomp), Milan Majchrak (milanmajchrak), Ahmad Nasser.

The above contributor list was determined based on contributions to the "dspace-angular" project in GitHub between 7.6 (after June 23, 2023) and 8.0 using "git shortlog" on the main branch and excluding all merge commits: 
git shortlog -s -n -e --no-merges --since 2023-06-23

Backend / REST API Acknowledgments

The following 56 individuals have contributed directly to the DSpace backend (REST API, Java API, OAI-PMH, etc) in this release (ordered by number of commits): Tim Donohue (tdonohue), Francesco Bacchelli (frabacche), Michele Boychuk (Micheleboychuk), Mohamed Eskander (eskander17), Mark Wood (mwoodiupui),  Kim Shepherd (kshepherd), Stefano Maffei (steph-ieffam), Agustina Martinez (amgciadev),  Toni Prieto (toniprieto), Alexandre Vryghem (alexandrevryghem), Andrea Bollini (abollini),  Alan Orth (alanorth), Sascha Szott (saschaszott), Vincenzo Mecca (vins01-4science), Paulo Graça (paulo-graca),  Adán Román Ruiz (aroman-arvo), Mattia Vianelli (Sondissimo), Koen Pauwels (KoenP), Yana De Pauw (YanaDePauw), Christian Bethge (ChrisBethgster), Nicholas Woodward (nwoodward), Florian Gantner (floriangantner), Marie Verdonck (MarieVerdonck), Kristof De Langhe (Atmire-Kristof), Pascal-Nicolas Becker (pnbecker), Andrei Alesik (AndrewAlesik), Michael Spalti (mspalti), Nona Luypaert (nona-luypaert), Damian Jozefowski (damian-joz), Jean-François Morin (jeffmorin), Francesco Molinaro (FrancescoMolinaro), Jens Vannerum (jensvannerum),  Philipp Rumpf (philipprumpf), Xiqinger, Roy Brushini (Bezkup), Thomas Misilo (misilot), Max Nuding (hutattedonmyarm), David Steelman, Eike Löhden (Leano1998), Hrafn Malmquist (J4bbi),  Luca Giamminonni (LucaGiamminonni), Martin Walk (MW3000), William Welling (wwelling), Marsa Haoua (marsaoua), wwuck, Christian Clauss (cclauss), Damiano Fiorenza, John Abrahams (jabrah), Marie-Hélène Vézina (mhvezina), Mark Cooper (mark-cooper),  Mirko Scherf (mirkoscherf), Sean Kalynuk (uofmsean), Shankeerthan Kasilingam, Yannick Paulsen (YPaulsen-TLC), Corrado Lombardi (corrad82-4s), Milan Majchrak (milanmajchrak).

The above contributor list was determined based on contributions to the "DSpace" project in GitHub between 7.6 (after June 23, 2023) and 8.0 using "git shortlog" on the main branch and excluding all merge commits: 
git shortlog -s -n -e --no-merges --since 2023-06-23

Additional Thanks

Additional thanks to our DSpace Leadership Group and DSpace Steering Group for their ongoing DSpace support and advice.

Thanks also to the various developer & community Working Groups who have worked diligently to help make DSpace 8 a reality. These include:

• DSpace Developers Team - This volunteer-based team leads the development of new releases. Anyone is welcome to join the Developer Meetings
• DSpace Community Advisory Team (DCAT) - This team helped organize/lead the DSpace 8.0 Testathon (to bang on the system to find any last bugs), and they also provided us with advice on features, etc.

We apologize to any contributor accidentally left off this list. DSpace has such a large, active development community that we sometimes lose track of all our contributors. Acknowledgments to those left off will be made in future releases.