DSpace 8.5 is now available!
DSpace Community
We are pleased to announce the release of DSpace 8.5! This release provides security fixes, performance improvements, accessibility improvements and bug fixes to the 8.x platform. No new features are provided. As such, this release should be an easier upgrade for sites already running 8.x.
Security Fixes
Fix for GHSA-4783-qprq-45x8 (high severity) Process DELETE endpoint is unprotected. This means process deletion can be performed by anonymous users via the REST API (if they can determine a process ID). (Donated by 4Science)
Fix for GHSA-fc3c-5p62-2cx7 (high severity) Path traversal vulnerability possible via the “-z” parameter of the “import” script (Batch Import via Zip).
Fix for GHSA-5xvx-grf4-4p7w (high severity) Path traversal vulnerability possible via “export” script (Batch Export via Zip) via a malicious bitstream name. (Donated by 4Science)
Fix for GHSA-qff6-8wrh-2frw (moderate severity) A malicious OAI-ORE remote service can trick DSpace into “harvesting” internal data available via HTTP. This only impacts OAI-ORE harvesting and not OAI-PMH harvesting. (Donated by 4Science)
Breaking Changes
We include a “Breaking Changes” section to the Release Notes to notify you of major changes which may impact your upgrade. Please visit the Release Notes for the full details.
A few key breaking changes to be aware of in DSpace 8.5:
Migration from SHERPA/RoMEO API to Jisc Open Policy Finder API. If you are using the SHERPA/RoMEO integration for submission forms, DSpace has been updated to use the new Jisc Open Policy Finder API because the Sherpa API has been retired. This means that the older "sherpa.romeo.*" settings (in dspace.cfg) have been replaced by "openpolicyfinder.*" settings (in external-providers.cfg). #12005
Major Bug fixes / improvements include:
Fixed bug where users were missing edit permissions on automatically claimed researcher profiles. #12106 (Donated by Eric Penneçot)
Fixed an issue with XML encoding in the OAI-PMH interface. #12409 (Donated by Atmire)
Fixed "Unknown metadata format" errors occurring on OAI-PMH interface due to hard-coded oai_dc prefix. #9770, #10106 (Donated by Acervos Digitais)
Fixed an issue where Health actuator would return DOWN status for missing SEO configuration. #12672 (Donated by 4Science)
Fixed an issue with duplicate detection when creating a new version of an item. #12865 (Donated by Tina Schönborn)
Improved the external sources REST endpoints by restricting them to authenticated users only. #12660
Improved item versioning REST endpoint by adding PreAuthorize annotation. #13048
Added secure methods related to TransformerFactory to protect against XXE style attacks, especially in OAI-PMH. #12681
Added basic sanitization to the experimental IIIF Search API feature. #13072
Fixed bug where unauthorized users could access a collection's Item Template metadata. #12979 (Donated by jjj-n)
Updated several regular expressions applied to user-supplied values to improve performance and security. #13089 (Donated by Atmire)
Added warnings to SSR-related configuration about the risk of SEO impacts. #6075; See also updated documentation for SEO.
Fixed other small bugs. See Changes in 8.x for a list of all changes.
A total of 17 individuals contributed to 8.5. For a full list of changes and contributors in 8.5, see our Release Notes.
Would you like to contribute to a future DSpace release?
DSpace is built and supported by community volunteers. We have no centralized development team. Therefore, we welcome contributions from anyone! Contributions may take the form of:
Contributing money to our DSpace Development Fund - All funds go directly towards development in the next release(s), and you will be acknowledged on our DSpace Development Fund page.
Contributing code - As a volunteer developer you can determine which issue ticket you’d like to work on. Join our weekly developer meetings or get in touch with Tim Donohue if you have any questions.
If you’d like more information on ongoing development, please consider joining our weekly developer meetings, or follow along by reading the public notes of past meetings.