We are pleased to announce the release of DSpace 9.4! This release provides security fixes and bug fixes to the 9.x platform. No new features are provided. As such, this release should be an easier upgrade for sites already running 9.x.
Download DSpace 9.4 <https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379125829/Release+Notes#ReleaseNotes-9.4ReleaseNotes> Security Fixes - Fix for GHSA-4783-qprq-45x8 <https://github.com/DSpace/DSpace/security/advisories/GHSA-4783-qprq-45x8> (high severity) Process DELETE endpoint is unprotected. This means process deletion can be performed by anonymous users via the REST API (if they can determine a process ID). (Donated by 4Science) - Fix for GHSA-fc3c-5p62-2cx7 <https://github.com/DSpace/DSpace/security/advisories/GHSA-fc3c-5p62-2cx7> (high severity) Path traversal vulnerability possible via the “-z” parameter of the “import” script (Batch Import via Zip). - Fix for GHSA-5xvx-grf4-4p7w <https://github.com/DSpace/DSpace/security/advisories/GHSA-5xvx-grf4-4p7w> (high severity) Path traversal vulnerability possible via “export” script (Batch Export via Zip) via a malicious bitstream name. (Donated by 4Science) - Fix for GHSA-4ppv-j692-84v9 <https://github.com/DSpace/DSpace/security/advisories/GHSA-4ppv-j692-84v9> (high severity) EPerson registration tokens are not being properly validated. This allows new registrations to potentially be invalidated by anonymous users. An attacker who is a registered user may also be able to “bind” the ORCID of another user who is actively creating an account via ORCID. - Fix for GHSA-758x-q228-3vqp <https://github.com/DSpace/DSpace/security/advisories/GHSA-758x-q228-3vqp> (moderate severity) Restricted bitstream information (size, md5, filename) can be retrieved anonymously via a bypass of the request a copy “accessToken”. This does not allow access to bitstream file contents. (Donated by 4Science) - Fix for GHSA-qff6-8wrh-2frw <https://github.com/DSpace/DSpace/security/advisories/GHSA-qff6-8wrh-2frw> (moderate severity) A malicious OAI-ORE remote service can trick DSpace into “harvesting” internal data available via HTTP. This only impacts OAI-ORE harvesting and not OAI-PMH harvesting. (Donated by 4Science) Breaking Changes We include a “Breaking Changes” section to the Release Notes to notify you of major changes which may impact your upgrade. Please visit the Release Notes <https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379125829/Release+Notes#ReleaseNotes-9.4ReleaseNotes> for the full details. A few key breaking changes to be aware of in DSpace 9.4: - Migration from SHERPA/RoMEO API to Jisc Open Policy Finder API. If you are using the SHERPA/RoMEO integration for submission forms, DSpace has been updated to use the new Jisc Open Policy Finder API <https://openpolicyfinder.jisc.ac.uk/help/developers> because the Sherpa API has been retired <https://openpolicyfinder.jisc.ac.uk/whats-new/11-02-2026>. This means that the older "sherpa.romeo.*" settings (in dspace.cfg) have been replaced by "openpolicyfinder.*" settings (in external-providers.cfg). #12005 <https://github.com/DSpace/DSpace/pull/12005> - License and Text extraction bundles/files are now admin-only by default. Previously, license files and extracted text would inherit the permissions of the Item itself. Specific bundles (LICENSE, TEXT, SWORD) of files are now access-restricted by default. You can control which bundles are access restricted via the new "core.authorization.restricted-bundle" configuration in dspace.cfg. #12306 <https://github.com/DSpace/DSpace/pull/12306> - After upgrading you may wish to regenerate all extracted text in the TEXT bundle to ensure they are access restricted. See the Release Notes for details. Major Bug fixes / improvements include: - Fixed bug where DOI Organiser batch processing could run into an infinite loop or send large volumes of email. #12728 <https://github.com/DSpace/DSpace/issues/12728> (Donated by engsterhold) - Fixed bug where users were missing edit permissions on automatically claimed researcher profiles. #12106 <https://github.com/DSpace/DSpace/issues/12106> (Donated by Eric Penneçot) - Fixed several errors that occurred when running the healthcheck command. #10805 <https://github.com/DSpace/DSpace/issues/10805> (Donated by Nicholas Woodward) - Integration fixes - Fixed an issue with XML encoding in the OAI-PMH interface. #12409 <https://github.com/DSpace/DSpace/issues/12409> (Donated by Atmire) - Fixed "Unknown metadata format" errors occurring on OAI-PMH interface due to hard-coded oai_dc prefix. #9770 <https://github.com/DSpace/DSpace/issues/9770>, #10106 <https://github.com/DSpace/DSpace/issues/10106> (Donated by Acervos Digitais) - Added secure methods related to TransformerFactory to protect against XXE style attacks, especially in OAI-PMH. #12681 <https://github.com/DSpace/DSpace/pull/12681>, #12721 <https://github.com/DSpace/DSpace/pull/12721>. - Added basic sanitization to the experimental IIIF Search API feature. #13072 <https://github.com/DSpace/DSpace/pull/13072> - Administrative fixes - Fixed bug where “New collection” menu option was not visible to Community Admins. #5856 <https://github.com/DSpace/dspace-angular/pull/5856> (Donated by Toni Prieto) - Fixed an issue with duplicate detection when creating a new version of an item. #12865 <https://github.com/DSpace/DSpace/issues/12865> (Donated by Tina Schönborn) - REST API fixes - Improved the external sources REST endpoints by restricting them to authenticated users only. #12660 <https://github.com/DSpace/DSpace/pull/12660> - Improved item versioning REST endpoint by adding PreAuthorize annotation. #13048 <https://github.com/DSpace/DSpace/pull/13048> - Added JSON payload and URL parameter validation to registration REST API endpoints. #12695 <https://github.com/DSpace/DSpace/pull/12695> (Donated by Sascha Szott) - Fixed bug where unauthorized users could access a collection's Item Template metadata. #12979 <https://github.com/DSpace/DSpace/issues/12979> (Donated by jjj-n) - Updated several regular expressions applied to user-supplied values to improve performance and security. #13089 <https://github.com/DSpace/DSpace/issues/13089> (Donated by Atmire) - Search Engine Optimization (SEO) fixes - Fixed an issue where Health actuator would return DOWN status for missing SEO configuration. #12672 <https://github.com/DSpace/DSpace/issues/12672> (Donated by 4Science) - Added warnings to SSR-related configuration about the risk of SEO impacts. #6075 <https://github.com/DSpace/dspace-angular/pull/6075>; See also updated documentation for SEO. <https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126837/Search+Engine+Optimization> - Fixed other small bugs. See Changes in 9.x <https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126881/Changes+in+9.x> for a list of all changes. A total of 19 individuals contributed to 9.4. For a full list of changes and contributors in 9.4, see our Release Notes <https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379125829/Release+Notes#ReleaseNotes-9.4ReleaseNotes> . Would you like to contribute to a future DSpace release? DSpace is built and supported by community volunteers. We have no centralized development team. Therefore, we welcome contributions from anyone! Contributions may take the form of: - Contributing money to our DSpace Development Fund <https://wiki.lyrasis.org/display/DSPACE/Announcement%3A+DSpace+Development+Fund> - All funds go directly towards development in the next release(s), and you will be acknowledged on our DSpace Development Fund <https://wiki.lyrasis.org/display/DSPACE/Announcement%3A+DSpace+Development+Fund> page. - Contributing code - As a volunteer developer you can determine which issue ticket you’d like to work on. Join our weekly developer meetings <https://wiki.lyrasis.org/display/DSPACE/Developer+Meetings> or get in touch with Tim Donohue <https://wiki.lyrasis.org/display/~tdonohue> if you have any questions. If you’d like more information on ongoing development, please consider joining our weekly developer meetings <https://wiki.lyrasis.org/display/DSPACE/Developer+Meetings>, or follow along by reading the public notes of past meetings. -- All messages to this mailing list should adhere to the Code of Conduct: https://lyrasis.org/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/dspace-tech/cc9b1c03-d12a-499a-8a56-35501d6b926cn%40googlegroups.com.
