Contribute to the DSpace Development Fund

The newly established DSpace Development Fund supports the development of new features prioritized by DSpace Governance. For a list of planned features see the fund wiki page.

The following policy describes the support agreement that the DSpace Committers Group aspires to in supporting DSpace open source software. This is not a binding contract (either with individual members of the Committers Group or our respective institutions). This agreement may change at any time with a formal vote of the active Committers.

This software support policy was adopted (via majority vote) by the DSpace Committers Group in July 2013.

Summary of DSpace Release Support

We strive to release a new major version of DSpace every year.  We support the last three (3) major versions, so each major version is supported for approximately three years.  Unless an earlier date is announced, end-of-life schedules for each major release are therefore usually based on when that release is no longer one of "last three major releases". 

For example, 8.x would be end-of-life as soon as 11.x is released (as supported releases would be 9.x, 10.x, 11.x). 11.x would be released approximately three years after 8.x.

Support for Security Updates:

  • Version(s) Supported
    • The DSpace Committers provide support for security updates to the most recent three (3) major releases of the platform. Security updates include fixes/patches for vulnerabilities discovered in the DSpace codebase, as well as a best effort to keep dependencies/libraries up-to-date with regards to security. We recommend running the latest major release for the most secure DSpace experience as dependency updates are not always possible to apply to other supported releases (see limitations below).
    • Limits to support for dependency updates:  When vulnerabilities arise in dependencies (or dependencies go "end-of-life"), we may not always be able to apply the dependency update to all supported releases of DSpace. While we do our best to apply security-based dependency updates to all supported releases, any dependency updates that are not reasonably "backwards compatible" may only be possible to apply to the most recent DSpace release(s).
    • Earlier end-of-life dates: In some scenarios, earlier end-of-life dates for DSpace releases may be announced if major concerns arise over the stability or longevity of a specific release.  These announcements would be sent to Mailing Lists and posted on our Releases page.
    • Patches for unsupported releases: Depending on the severity of a particular security issue, the DSpace Committers may make an effort to provide a security patch or recommendation for prior, unsupported versions. This is decided on a case by case basis.
  • Reporting Security Issues
    • If you have located a possible security issue within DSpace, we ask that you report it to security@dspace.org  (this emails all the DSpace Committers). We strive to provide a 7-day (or less) turnaround in investigating the reported issue, and will work towards resolution as soon as possible.  Once a fix has been created and any necessary security releases are performed, we will then report the security issue and resolution to the general public.  You will be publicly credited with discovering/reporting the security issue.
    • We strongly encourage you to report security issues in private, before disclosing them in a public forum.  We take DSpace security issues very seriously and will work quickly to eliminate them once reported.
  • Published Security Advisories

Support for Bug Fixes (and Improvements/Features):

  • Version(s) Supported
    • The DSpace Committers only regularly provide bug fixes to the most recent major release  of the platform.
    • Depending on the severity of a particular bug, DSpace Committers may backport it to prior versions of the software platform. This is decided on a case by case basis.
  • Reporting Bugs / Issues
    • If you have located a possible bug/issue within DSpace, we ask that you report it directly to our DSpace Issue Tracker (GitHub). We strive to investigate bugs as soon as we can after they are reported.  However, based on the severity of the bug, the timeline of an actual fix may depend on how rapidly we can locate a volunteer developer (either a Committer or a community developer).
    • If you are unsure if something you have found is a DSpace bug/issue, you are also welcome to ask about it on our DSpace Technology Mailing List (dspace-tech Google Group).
  • No labels

All content on the LYRASIS Wiki is licensed under the CC BY (Attribution) license, unless otherwise noted.