06 Aug 2026
+ +Koha is the first free and open source software library automation +package (ILS). Development is sponsored by libraries of varying types +and sizes, volunteers, and support companies from around the world. The +website for the Koha project is:
+ + + +Koha 25.11.07 can be downloaded from:
+ +Installation instructions can be found at:
+ +Koha 25.11.07 is a bugfix/maintenance release with security patches.
+ +It includes 27 bugfixes (7 security).
+ +System requirements
+ +You can learn about the system components (like OS and database) needed for running Koha on the community wiki.
+ ++This change refactors the regular expression handling for Batch Item Modification, MARC Modification templates, and Callnumber splitting. It moves from Perl's traditional compile-time regular expression handling to a more dynamic (but restrictive) run-time regular expression handling more similar to Python's "sub" regex method. This functions to reduce vulnerabilities to code injection into Koha's Perl backend.
+This fixes an accessibility issue on the patron's OPAC account messaging preferences form: Missing legend for the fieldset with submit changes and cancel buttons.
+ +It adds a legend tag "visible" for screen reader patrons so that it is clear for the group of buttons what they are being asked to do.
41829 Tag editor button has wrong id on copied MARC field when value builder plugin is used
+ +Sponsored by Koha-Suomi Oy
42178 The Close button submits the remove from bundle form
+ +Sponsored by Lund University Library
42395 Missing translations for the existing holds table (load_patron_holds_table) for a record in the staff interface
+ +++ +This fixes the translatability of strings for the existing holds table in the staff interface for a record (Staff interface > [details page for a record] > Holds > Existing holds).
+ +These strings were not previously translated:
+ ++
+- Priority column: In transit, Waiting, and In processing
+- Change priority column: tooltip text for arrows: + . Move hold up + . Move hold to top + . Move hold to bottom + . Move hold down
+
Sponsored by Koha-Suomi Oy
+This fixes the "Add guarantor" pop-up window when adding a guarantor for a patron.
+ +The form was populating the "Sort 2" field with the value from the patron you are adding the guarantor to (if they had values stored for the Sort 1 and Sort 2 fields in the library management section).
+This fixes the capitalization (title case to sentence case) for a heading in the "Point of sale payout receipt (PAYOUT)" print notice template: Refund Payout Receipt --> Refund payout receipt.
+ +Note: This only affects new Koha installations. Existing installations need to either manually update the notice or replace the existing notice with the default notice text.
42695 Minor language and markup corrections to reports error messages
+ + +++ +This fixes the HTML markup for some report error messages, along with some minor text changes:
+ ++
+- Uses an H1 for the heading
+- Uses p for paragraphs
+
Sponsored by Athens County Public Libraries
The Koha manual is maintained in Sphinx. The home page for Koha +documentation is
+ +Koha Documentation +As of the date of these release notes, the Koha manual is available in the following languages:
The Git repository for the Koha manual can be found at
+ + + +Complete or near-complete translations of the OPAC and staff +interface are available in this release for the following languages:
+ +Partial translations are available for various other languages.
+ +The Koha team welcomes additional translations; please see
+ + + +For information about translating Koha, and join the koha-translate +list to volunteer:
+ + + +The most up-to-date translations can be found at:
+ + + +The release team for Koha 25.11.07 is
+ +Release Manager: Pedro Amorim
QA Manager: Lisette Scheer
QA Team:
+ +Documentation Manager: Aude Charillon
Documentation Team:
+ +Translation Manager: Jonathan Druart
Wiki curators:
+ +Release Maintainers:
+ +Release Maintainer assistants:
+ +We thank the following libraries, companies, and other institutions who are known to have sponsored +new features in Koha 25.11.07
+ +We thank the following individuals who contributed patches to Koha 25.11.07
+ +We thank the following libraries, companies, and other institutions who contributed +patches to Koha 25.11.07
+ +We also especially thank the following individuals who tested patches +for Koha
+ +We regret any omissions. If a contributor has been inadvertently missed, +please send a patch against these release notes to koha-devel@lists.koha-community.org.
+ +The Koha project uses Git for version control. The current development +version of Koha can be retrieved by checking out the main branch of:
+ + + +The branch for this version of Koha and future bugfixes in this release +line is 25.11.x.
+ +Bug reports and feature requests can be filed at the Koha bug +tracker at:
+ + + +He rau ringa e oti ai. +(Many hands finish the work)
+ +Autogenerated release notes updated last on 06 Aug 2026 14:57:11.
diff --git a/misc/release_notes/release_notes_25_11_07.md b/misc/release_notes/release_notes_25_11_07.md new file mode 100644 index 0000000000..fa7b8da53b --- /dev/null +++ b/misc/release_notes/release_notes_25_11_07.md @@ -0,0 +1,382 @@ +# RELEASE NOTES FOR KOHA 25.11.07 +06 Aug 2026 + +Koha is the first free and open source software library automation +package (ILS). Development is sponsored by libraries of varying types +and sizes, volunteers, and support companies from around the world. The +website for the Koha project is: + +- [Koha Community](https://koha-community.org) + +Koha 25.11.07 can be downloaded from: + +- [Download](https://download.koha-community.org/koha-25.11.07.tar.gz) + +Installation instructions can be found at: + +- [Koha Wiki](https://wiki.koha-community.org/wiki/Installation_Documentation) +- OR in the INSTALL files that come in the tarball + +Koha 25.11.07 is a bugfix/maintenance release with security patches. + +It includes 27 bugfixes (7 security). + +**System requirements** + +You can learn about the system components (like OS and database) needed for running Koha on the [community wiki](https://wiki.koha-community.org/wiki/System_requirements_and_recommendations). + + +#### Security bugs + +- [30233](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30233) Remote code execution in user-supplied regex + >This change refactors the regular expression handling for Batch Item Modification, MARC Modification templates, and Callnumber splitting. It moves from Perl's traditional compile-time regular expression handling to a more dynamic (but restrictive) run-time regular expression handling more similar to Python's "sub" regex method. This functions to reduce vulnerabilities to code injection into Koha's Perl backend. +- [42471](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42471) /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting +- [42746](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42746) Stored SQL injection via unvalidated 'agefield' in automatic_item_modification_by_age (C4::Items::ToggleNewStatus) +- [42747](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42747) Stored SQL injection via patroncard layout image_name (patroncards/edit-layout.pl -> create-pdf.pl) +- [42749](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42749) SQL injection in acqui/parcels.pl via the orderby parameter (ORDER BY direction) reaching C4::Acquisition::GetInvoices +- [42847](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42847) SIP authentication ignored after initial successful connection +- [42866](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42866) SQL Injection in Koha/AdditionalContents.pm search_for_display via the patron lang value (stored / second-order, executed on issue-slip print, unvalidated string context, no placeholder) +- [43019](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43019) OPAC pages limited to library are readable by unauthenticated users + +## Bugfixes + +### Accessibility + +#### Other bugs fixed + +- [42229](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42229) Form label used on non-form elements on opac-memberentry.tt pages +- [42232](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42232) Fieldset with missing legend on OPAC account messaging settings page (opac-messaging.tt) + >This fixes an accessibility issue on the patron's OPAC account messaging preferences form: Missing legend for the fieldset with submit changes and cancel buttons. + > + >It adds a legend tag "visible" for screen reader patrons so that it is clear for the group of buttons what they are being asked to do. +- [42233](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42233) OPAC suggestions table header contains no text +- [42234](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42234) OPAC checkout history page table header contains no text + >This fixes the patron checkout history table in the OPAC. It adds a title to the cover image column ("Cover image"). +- [42299](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42299) OPAC detail page: star ratings has no associated label + >This fixes an accessibility issue for star ratings on the OPAC record details page - it adds a label for screen reader patrons. + +### Acquisitions + +#### Other bugs fixed + +- [42919](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42919) Suggestion duplicate warning erases suggestion info + +### Cataloging + +#### Other bugs fixed + +- [41829](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41829) Tag editor button has wrong id on copied MARC field when value builder plugin is used + + **Sponsored by** *Koha-Suomi Oy* +- [42178](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42178) The Close button submits the remove from bundle form + + **Sponsored by** *Lund University Library* +- [42972](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42972) [25.11.x] Cannot add, edit, or delete MARC overlay rules + +### Circulation + +#### Other bugs fixed + +- [41992](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41992) Checkout History remembering Last Page + +### Hold requests + +#### Other bugs fixed + +- [42395](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42395) Missing translations for the existing holds table (load_patron_holds_table) for a record in the staff interface + >This fixes the translatability of strings for the existing holds table in the staff interface for a record (Staff interface > [details page for a record] > Holds > Existing holds). + > + >These strings were not previously translated: + >- Priority column: In transit, Waiting, and In processing + >- Change priority column: tooltip text for arrows: + > . Move hold up + > . Move hold to top + > . Move hold to bottom + > . Move hold down + + **Sponsored by** *Koha-Suomi Oy* + +### Patrons + +#### Other bugs fixed + +- [42245](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42245) Patron search for guarantors is preselecting borrower sort values from the borrower record + >This fixes the "Add guarantor" pop-up window when adding a guarantor for a patron. + > + >The form was populating the "Sort 2" field with the value from the patron you are adding the guarantor to (if they had values stored for the Sort 1 and Sort 2 fields in the library management section). +- [42781](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42781) Declare 'name' before using it in patron-format.js + +### Searching - Elasticsearch + +#### Critical bugs fixed + +- [42485](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42485) Elasticsearch dynamic mapping date detection causes indexing failures with ARRAY MARC format + +### Serials + +#### Other bugs fixed + +- [42844](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42844) Subscription search breaks when using additional field and no search result is returned + +### Templates + +#### Other bugs fixed + +- [42518](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42518) Capitalization: Refund Payout Receipt + >This fixes the capitalization (title case to sentence case) for a heading in the "Point of sale payout receipt (PAYOUT)" print notice template: Refund Payout Receipt --> Refund payout receipt. + > + >Note: This only affects new Koha installations. Existing installations need to either manually update the notice or replace the existing notice with the default notice text. +- [42695](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42695) Minor language and markup corrections to reports error messages + >This fixes the HTML markup for some report error messages, along with some minor text changes: + >- Uses an H1 for the heading + >- Uses p for paragraphs + + **Sponsored by** *Athens County Public Libraries* + +### Test Suite + +#### Other bugs fixed + +- [42705](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42705) OPAC/SCO_spec.ts is failing +- [42783](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42783) Tools/ManageMarcImport_spec.ts is still flaky + +## Documentation + +The Koha manual is maintained in Sphinx. The home page for Koha +documentation is + +- [Koha Documentation](https://koha-community.org/documentation/) +As of the date of these release notes, the Koha manual is available in the following languages: + +- [English (USA)](https://koha-community.org/manual/25.11/en/html/) +- [French](https://koha-community.org/manual/25.11/fr/html/) (80%) +- [German](https://koha-community.org/manual/25.11/de/html/) (85%) +- [Greek](https://koha-community.org/manual/25.11/el/html/) (91%) +- [Hindi](https://koha-community.org/manual/25.11/hi/html/) (61%) + +The Git repository for the Koha manual can be found at + +- [Koha Git Repository](https://gitlab.com/koha-community/koha-manual) + +## Translations + +Complete or near-complete translations of the OPAC and staff +interface are available in this release for the following languages: +