Bug 42719: [26.05.x] Handle missing CGISESSID in OAuth login (IdP-initiated flow)

When a user initiates login from the IdP (e.g. Okta app tile), they
hit the OAuth endpoint without an existing session cookie. The code
crashed calling ->value on an undefined cookie object.

This patch:
- Removes the premature 'No user session found' guard that blocked
  IdP-initiated flows entirely
- Creates a session on-the-fly for the initial request when no
  cookie exists (IdP-initiated flow)
- On callback, redirects with wrong_csrf_token error instead of
  crashing when the cookie is missing

CSRF protection is preserved: the state token is bound to the
session created in the initial request, and the browser returns
the cookie on callback for validation.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
(cherry picked from commit cd02922675f42f1c404acaa274d14fd155778941)
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

.codespell-ignore

@@ -1,7 +1,6 @@
 ser
 thes
 nam
-rovider
 fo
 isnt
 wither
@@ -18,3 +17,12 @@ theses
 rouge
 connexion
 falsy
+aas
+carmel
+checkin
+laf
+lamba
+plack
+prfile
+requestor
+vai

C4/Accounts.pm

@@ -28,7 +28,6 @@ BEGIN {
 }
 
 use C4::Context;
-use C4::Stats;
 use C4::Members;
 use Koha::Account;
 use Koha::Account::Lines;

C4/Acquisition.pm

@@ -2432,7 +2432,8 @@ sub GetInvoices {
               NULL
             )
           ) AS is_linked_to_subscriptions,
-          SUM(aqorders.quantityreceived) AS receiveditems
+          SUM(aqorders.quantityreceived) AS receiveditems,
+          SUM(aqorders.quantity) AS itemsexpected
         FROM aqinvoices
           LEFT JOIN aqbooksellers ON aqbooksellers.id = aqinvoices.booksellerid
           LEFT JOIN aqorders ON aqorders.invoiceid = aqinvoices.invoiceid
@@ -2530,7 +2531,7 @@ sub GetInvoices {
     if ( $args{order_by} ) {
         my ( $column, $direction ) = split / /, $args{order_by};
         if ( grep { $_ eq $column } @columns ) {
-            $direction ||= 'ASC';
+            $direction = ( uc( $direction // '' ) eq 'DESC' ) ? 'DESC' : 'ASC';
             $query .= " ORDER BY $column $direction";
         }
     }

C4/Auth.pm

@@ -275,15 +275,18 @@ sub get_template_and_user {
         }
 
         if ($kick_out) {
+            $session  = get_session("");
             $template = C4::Templates::gettemplate(
                 'opac-auth.tt', 'opac',
                 $in->{query}
             );
+            $template->param( sessionID => $session->id );
+
             $cookie = $cookie_mgr->replace_in_list(
                 $cookie,
                 $in->{query}->cookie(
                     -name     => 'CGISESSID',
-                    -value    => '',
+                    -value    => $session->id,
                     -HttpOnly => 1,
                     -secure   => ( C4::Context->https_enabled() ? 1 : 0 ),
                     -sameSite => 'Lax',

C4/Auth_with_shibboleth.pm

@@ -312,7 +312,7 @@ Create some metadata for your koha instance (if you're in a single instance setu
 
 =item 2.
 
-Swap metadata with your Identidy Provider (IdP)
+Swap metadata with your Identify Provider (IdP)
 
 =item 3.
 
@@ -365,7 +365,7 @@ Note: The minimum you need here is a <matchpoint> block, containing a valid colu
 
 It should be as simple as that; you should now be able to login via shibboleth in the opac.
 
-If you need more help configuring your B<S>ervice B<P>rovider to authenticate against a chosen B<Id>entity B<P>rovider then it might be worth taking a look at the community wiki L<page|https://wiki.koha-community.org/wiki/Shibboleth_Configuration>
+If you need more help configuring your B<S>ervice B<P>rovider to authenticate against a chosen B<Id>entity B<P>rovider then it might be worth taking a look at the community wiki L<page|https://wiki.koha-community.org/wiki/Shibboleth_Configuration>  # codespell:ignore
 
 =head1 FUNCTIONS
 

C4/Breeding.pm

@@ -155,7 +155,9 @@ sub Z3950Search {
     }
     my $xslh = Koha::XSLT::Base->new;
 
-    my $nremaining = $s;
+    my $nremaining    = $s;
+    my $hits_per_page = 20;    #TODO make configurable
+    my $total_hits    = 0;
     while ( $nremaining-- ) {
         my $k;
         my $event;
@@ -169,18 +171,22 @@ sub Z3950Search {
             my ($error) = $oConnection[$k]->error_x();    #ignores errmsg, addinfo, diagset
             if ($error) {
                 if ( $error =~ m/^(10000|10007)$/ ) {
-                    push( @errconn, { server => $servers[$k]->{host}, error => $error } );
+                    push( @errconn, { server => $servers[$k]->{host}, errcode => $error } );
                 }
             } else {
                 my $numresults = $oResult[$k]->size();
+                $total_hits += $numresults;
                 my $i;
                 my $res;
-                if ( $numresults > 0 and $numresults >= ( ( $page - 1 ) * 20 ) ) {
+                if ( $numresults > 0 and $numresults >= ( ( $page - 1 ) * $hits_per_page ) ) {
-                    $show_next   = 1                           if $numresults >= ( $page * 20 );
+                    $show_next   = 1 if $numresults >= ( $page * $hits_per_page );
-                    $total_pages = int( $numresults / 20 ) + 1 if $total_pages < ( $numresults / 20 );
+                    $total_pages = int( $numresults / $hits_per_page ) + 1
+                        if $total_pages < ( $numresults / $hits_per_page );
                     for (
-                        $i = ( $page - 1 ) * 20 ;
+                        $i = ( $page - 1 ) * $hits_per_page ;
-                        $i < ( ( $numresults < ( $page * 20 ) ) ? $numresults : ( $page * 20 ) ) ;
+                        $i < (
+                            ( $numresults < ( $page * $hits_per_page ) ) ? $numresults : ( $page * $hits_per_page )
+                            ) ;
                         $i++
                         )
                     {
@@ -191,14 +197,17 @@ sub Z3950Search {
                                 $xslh
                             );    #ignores error in sequence numbering
                             push @breeding_loop, $res if $res;
-                            push @errconn, { server => $servers[$k]->{servername}, error => $error, seq => $i + 1 }
+                            push @errconn, { server => $servers[$k]->{servername}, errcode => $error, seq => $i + 1 }
                                 if $error;
                         } else {
+                            my @diags = $oConnection[$k]->error_x();    # errcode, errmsg, addinfo, diagset
+                            next unless $diags[0];                      # Just silently ignore empty results
                             push @errconn,
                                 {
-                                'server'  => $servers[$k]->{servername},
+                                server  => $servers[$k]->{servername},
-                                error     => ( ( $oConnection[$k]->error_x() )[0] ),
+                                errcode => $diags[0],
-                                error_msg => ( ( $oConnection[$k]->error_x() )[1] ), seq => $i + 1
+                                errmsg  => $diags[1],
+                                seq     => $i + 1,
                                 };
                         }
                     }
@@ -212,6 +221,7 @@ sub Z3950Search {
             total_pages     => $total_pages,
             show_nextbutton => $show_next ? 1 : 0,
             show_prevbutton => $page != 1,
+            total_hits      => $total_hits,
         );
     }    # while nremaining
 

C4/Circulation.pm

@@ -83,7 +83,6 @@ use Try::Tiny;
 use JSON;
 
 use C4::Context;
-use C4::Stats qw( UpdateStats );
 use C4::Reserves
     qw( CheckReserves CanItemBeReserved MoveReserve ModReserve ModReserveMinusPriority IsAvailableForItemLevelRequest );
 use C4::Biblio qw( UpdateTotalIssues );
@@ -123,6 +122,7 @@ use Koha::SearchEngine::Indexer;
 use Koha::Exceptions::Checkout;
 use Koha::Plugins;
 use Koha::Recalls;
+use Koha::Statistics;
 use Koha::Library::Hours;
 use Koha::Library::FloatLimits;
 use Carp            qw( carp );
@@ -885,7 +885,7 @@ sub CanBookBeIssued {
     if ( $patron->category->category_type eq 'X' && ( $item_object->barcode ) ) {
 
         # stats only borrower -- add entry to statistics table, and return issuingimpossible{STATS} = 1  .
-        C4::Stats::UpdateStats(
+        Koha::Statistic->new(
             {
                 branch         => C4::Context->userenv->{'branch'},
                 type           => 'localuse',
@@ -897,7 +897,7 @@ sub CanBookBeIssued {
                 location       => $item_object->location,
                 interface      => C4::Context->interface,
             }
-        );
+        )->store();
         my $block_lost_return = C4::Context->preference("BlockReturnOfLostItems") ? 1 : 0;
         ModDateLastSeen( $item_object->itemnumber, $block_lost_return );    # FIXME Move to Koha::Item
         return ( { STATS => 1, }, {} );
@@ -1985,7 +1985,7 @@ sub AddIssue {
             }
 
             # Record the fact that this book was issued.
-            C4::Stats::UpdateStats(
+            Koha::Statistic->new(
                 {
                     branch         => C4::Context->userenv->{'branch'},
                     type           => ( $onsite_checkout ? 'onsite_checkout' : 'issue' ),
@@ -1998,7 +1998,7 @@ sub AddIssue {
                     ccode          => $item_object->ccode,
                     categorycode   => $patron->categorycode
                 }
-            );
+            )->store();
 
             # Send a checkout slip.
             my $circulation_alert = 'C4::ItemCirculationAlertPreference';
@@ -2021,19 +2021,16 @@ sub AddIssue {
 
             # Log the checkout
             if ( C4::Context->preference('IssueLog') ) {
-                my $info = $item_object->itemnumber;
+                my $info = to_json(
-                if ( defined($confirmations) || defined($forced) ) {
+                    {
-                    $info = to_json(
+                        issue         => $issue->issue_id,
-                        {
+                        branchcode    => $issue->branchcode,
-                            issue         => $issue->issue_id,
+                        itemnumber    => $item_object->itemnumber,
-                            branchcode    => $issue->branchcode,
+                        confirmations => $confirmations || [],
-                            itemnumber    => $item_object->itemnumber,
+                        forced        => $forced        || []
-                            confirmations => $confirmations,
+                    },
-                            forced        => $forced
+                    { pretty => 1, canonical => 1 }
-                        },
+                );
-                        { pretty => 1, canonical => 1 }
-                    );
-                }
                 logaction(
                     "CIRCULATION", "ISSUE",
                     $patron->borrowernumber,
@@ -2720,7 +2717,7 @@ sub AddReturn {
 
     # Record the fact that this book was returned.
     my $categorycode = $patron_unblessed ? $patron_unblessed->{categorycode} : undef;
-    C4::Stats::UpdateStats(
+    Koha::Statistic->new(
         {
             branch         => $branch,
             type           => $stat_type,
@@ -2732,7 +2729,8 @@ sub AddReturn {
             categorycode   => $categorycode,
             interface      => C4::Context->interface,
         }
-    ) unless ( $skip_localuse && !$issue );
+    )->store()
+        unless ( $skip_localuse && !$issue );
 
     # Send a check-in slip. # NOTE: borrower may be undef. Do not try to send messages then.
     if ($patron) {
@@ -3497,17 +3495,13 @@ sub CanBookBeRenewed {
 
         # If its cron, tell it it's too soon for a an auto renewal
         return ( 0, $auto_renew, { soonest_renew_date => $soonest } ) if $cron;
-
-        # Check if it's too soon for a manual renewal
-        my $soonestManual = GetSoonestRenewDate( $patron, $issue );
-        if ( $soonestManual > dt_from_string() ) {
-            return ( 0, "too_soon", { soonest_renew_date => $soonestManual } ) unless $override_limit;
-        }
     }
 
-    $soonest = GetSoonestRenewDate( $patron, $issue );
+    unless ($cron) {
-    if ( $soonest > dt_from_string() ) {
+        $soonest = GetSoonestRenewDate( $patron, $issue );
-        return ( 0, "too_soon", { soonest_renew_date => $soonest } ) unless $override_limit;
+        if ( $soonest > dt_from_string() ) {
+            return ( 0, "too_soon", { soonest_renew_date => $soonest } ) unless $override_limit;
+        }
     }
 
     my $auto_renew_code =
@@ -3750,7 +3744,7 @@ sub AddRenewal {
             )->store();
 
             # Add the renewal to stats
-            C4::Stats::UpdateStats(
+            Koha::Statistic->new(
                 {
                     branch         => $item_object->renewal_branchcode( { branch => $branch } ),
                     type           => 'renew',
@@ -3763,7 +3757,7 @@ sub AddRenewal {
                     categorycode   => $patron->categorycode,
                     interface      => C4::Context->interface,
                 }
-            );
+            )->store();
 
             #Update borrowers.lastseen
             try {

C4/ClassSplitRoutine/RegEx.pm

@@ -19,6 +19,9 @@ package C4::ClassSplitRoutine::RegEx;
 
 use Modern::Perl;
 
+use Koha::Logger;
+use Koha::Regex::Replacement;
+
 =head1 NAME
 
 C4::ClassSplitRoutine::RegEx - regex call number sorting key routine
@@ -41,13 +44,62 @@ sub split_callnumber {
     my ( $cn_item, $regexs ) = @_;
 
     for my $regex (@$regexs) {
-        eval "\$cn_item =~ $regex";    ## no critic (StringyEval)
+        _apply_substitution( \$cn_item, $regex );
     }
     my @lines = split "\n", $cn_item;
 
     return @lines;
 }
 
+=head2 _apply_substitution
+
+  _apply_substitution( \$string, $regex );
+
+Applies a single admin-configured s/// substitution to $string in place,
+without ever evaluating the input as code. The rule is parsed as
+C<s/PATTERN/REPLACEMENT/FLAGS> (any non-space delimiter is accepted); the pattern is compiled with
+qr// (so embedded-code assertions are treated as a runtime pattern and blocked
+by Perl), and the replacement is expanded as data via
+Koha::Regex::Replacement::expand_template. The
+/e flag is rejected and anything that is not a plain substitution is ignored.
+This replaces the previous C<eval "\$cn_item =~ $regex"> stringy eval, which
+executed arbitrary Perl.
+
+=cut
+
+sub _apply_substitution {
+    my ( $ref, $regex ) = @_;
+
+    return unless defined $regex;
+
+    # Parse  s<DELIM>PATTERN<DELIM>REPLACEMENT<DELIM>FLAGS, allowing any
+    # non-space delimiter and backslash-escaped delimiters inside the pattern
+    # and replacement. Anything that is not a well-formed plain substitution is
+    # ignored rather than executed.
+    return unless $regex =~ m{^s(\S)((?:\\.|(?!\1).)*)\1((?:\\.|(?!\1).)*)\1([a-z]*)\z}s;
+    my ( $pattern, $replacement, $flags ) = ( $2, $3, $4 );
+
+    return if $flags =~ /e/;    # never evaluate the replacement as code
+    my $global = $flags =~ /g/ ? 1      : 0;
+    my $ci     = $flags =~ /i/ ? '(?i)' : '';
+
+    my $compiled = eval { qr/$ci$pattern/ };
+    unless ( defined $compiled ) {
+        Koha::Logger->get->warn("C4::ClassSplitRoutine::RegEx: failed to compile pattern [$pattern]: $@");
+        return;
+    }
+
+    my $expand = sub { Koha::Regex::Replacement::expand_template( $replacement, [ @{^CAPTURE} ], {%+} ) };
+
+    if ($global) {
+        ${$ref} =~ s/$compiled/$expand->()/ge;
+    } else {
+        ${$ref} =~ s/$compiled/$expand->()/e;
+    }
+
+    return;
+}
+
 1;
 
 =head1 AUTHOR

C4/Context.pm

@@ -52,6 +52,10 @@ use Koha::Config::SysPrefs;
 use Koha::Config;
 use Koha::Database;
 
+# NOTE: The below list should match the corresponding options in the .pref file
+# for CSVDelimiter
+use constant ALLOWED_CSV_DELIMITERS => ( ';', 'tabulation', ',', '/', '\\', '#' );
+
 =head1 NAME
 
 C4::Context - Maintain and manipulate the context of a Koha script
@@ -485,6 +489,13 @@ sub delete_preference {
 
 sub csv_delimiter {
     my ( $self, $value ) = @_;
+
+    # Validate input against allowed delimiters
+    if ($value) {
+        my %allowed = map { $_ => 1 } ALLOWED_CSV_DELIMITERS;
+        $value = undef unless $allowed{$value};
+    }
+
     my $delimiter = $value || $self->preference('CSVDelimiter') || ',';
     $delimiter = "\t" if $delimiter eq 'tabulation';
     return $delimiter;

C4/Creators/Lib.pm

@@ -272,7 +272,7 @@ ADD_LAYOUTS:
 
 This function returns an arrayref whose elements are hashes containing all profiles upon success and 1 upon failure. Errors are logged
 to the Apache log. Two parameters are accepted. The first limits the field(s) returned. This parameter should be string of comma separated
-fields. ie. "field_1, field_2, ...field_n" The second limits the records returned based on a string containing a valud SQL 'WHERE' filter.
+fields. ie. "field_1, field_2, ...field_n" The second limits the records returned based on a string containing a valid SQL 'WHERE' filter.
 
 NOTE: Do not pass in the keyword 'WHERE.'
 
@@ -320,7 +320,7 @@ sub get_all_image_names {
 
 This function returns an arrayref whose elements are hashes containing the batch_ids of current batches along with the item count
 for each batch upon success and 1 upon failure. Item counts are stored under the key '_item_count' Errors are logged to the Apache log.
-One parameter is accepted which limits the records returned based on a string containing a valud SQL 'WHERE' filter.
+One parameter is accepted which limits the records returned based on a string containing a valid SQL 'WHERE' filter.
 
 NOTE: Do not pass in the keyword 'WHERE.'
 
@@ -352,7 +352,7 @@ sub get_batch_summary {
 
 This function returns an arrayref whose elements are hashes containing the label_ids of current labels along with the item count
 for each label upon success and 1 upon failure. Item counts are stored under the key '_item_count' Errors are logged to the Apache log.
-One parameter is accepted which limits the records returned based on a string containing a valud SQL 'WHERE' filter.
+One parameter is accepted which limits the records returned based on a string containing a valid SQL 'WHERE' filter.
 
 NOTE: Do not pass in the keyword 'WHERE.'
 
@@ -405,7 +405,7 @@ sub get_label_summary {
 
 This function returns an arrayref whose elements are hashes containing the label_ids of current cards along with the item count
 for each card upon success and 1 upon failure. Item counts are stored under the key '_item_count' Errors are logged to the Apache log.
-One parameter is accepted which limits the records returned based on a string containing a valud SQL 'WHERE' filter.
+One parameter is accepted which limits the records returned based on a string containing a valid SQL 'WHERE' filter.
 
 NOTE: Do not pass in the keyword 'WHERE.'
 

C4/HoldsQueue.pm

@@ -476,7 +476,6 @@ sub _allocateWithTransportCostMatrix {
 
     my @m = map { [ (undef) x $num_tasks ] } ( 1 .. $num_agents );
 
-    my $inf = -1;    # Initially represent infinity with a negative value.
     my $max = 0;
 
     # If some candidate holds requests cannot be filled and there are
@@ -493,6 +492,7 @@ sub _allocateWithTransportCostMatrix {
 
 RETRY:
     while (1) {
+        my $inf = -1;    # Initially represent infinity with a negative value.
         return [] if $num_agents == 0 || $num_tasks + scalar(@remaining) == 0;
 
         if ( $num_tasks < $num_agents && @remaining ) {
@@ -668,20 +668,32 @@ RETRY:
 
         if ( $retries-- > 0 && @unallocated && @remaining ) {
 
+            # @unallocated is built by iterating agents (rows), so its
+            # entries are not necessarily in column order: Munkres'
+            # row-to-column assignment is a permutation, not a monotonic
+            # mapping. The matrix compaction below scans columns in
+            # ascending order and expects to consume @unallocated in that
+            # same order, so it must be sorted first.
+            my @unallocated_sorted = sort { $a <=> $b } @unallocated;
+
             # Remove the transport cost of unfilled holds and compact the matrix.
             # Also remove the hold request from the array.
             for ( my $i = 0 ; $i < $num_agents ; $i++ ) {
                 my $u = 0;
                 for ( my $j = 0 ; $j < $num_tasks ; $j++ ) {
-                    if ( $u < scalar(@unallocated) && $unallocated[$u] == $j ) {
+                    if ( $u < scalar(@unallocated_sorted) && $unallocated_sorted[$u] == $j ) {
                         $u++;
                     } elsif ( $u > 0 ) {
                         $m[$i][ $j - $u ] = $m[$i][$j];
                     }
                 }
             }
-            for ( my $u = 0 ; $u < scalar(@unallocated) ; $u++ ) {
+
-                splice @requests, $unallocated[$u], 1;
+            # Indices must be spliced out in reverse order, otherwise removing
+            # a lower index shifts the position of any higher index still to
+            # be removed.
+            for my $u ( reverse @unallocated_sorted ) {
+                splice @requests, $u, 1;
             }
             $num_tasks = scalar(@requests);
 

C4/Items.pm

@@ -38,6 +38,7 @@ BEGIN {
         SearchItems
         PrepareItemrecordDisplay
         ToggleNewStatus
+        GetAutomaticItemModificationAgeFields
     );
 }
 
@@ -58,6 +59,7 @@ use Try::Tiny qw( catch try );
 use Koha::AuthorisedValues;
 use Koha::DateUtils qw( dt_from_string );
 use Koha::Database;
+use Koha::Logger;
 
 use Koha::Biblios;
 use Koha::Biblioitems;
@@ -1655,6 +1657,25 @@ sub PrepareItemrecordDisplay {
     };
 }
 
+=head2 GetAutomaticItemModificationAgeFields
+
+    my @fields = GetAutomaticItemModificationAgeFields();
+
+Returns the fixed, C<items.>-prefixed list of date columns that are valid
+"age field" values for automatic item modification rules (see
+ToggleNewStatus below). This is the single source of truth for that
+allow-list; it is shared with F<tools/automatic_item_modification_by_age.pl>
+so the two cannot drift apart.
+
+=cut
+
+sub GetAutomaticItemModificationAgeFields {
+    return (
+        'items.dateaccessioned', 'items.replacementpricedate', 'items.datelastborrowed', 'items.datelastseen',
+        'items.damaged_on',      'items.itemlost_on',          'items.withdrawn_on'
+    );
+}
+
 =head2 ToggleNewStatus
 
 Missing POD for ToggleNewStatus.
@@ -1671,17 +1692,32 @@ sub ToggleNewStatus {
     my @item_columns       = map { "items.$_" } Koha::Items->columns;
     my @biblioitem_columns = map { "biblioitems.$_" } Koha::Biblioitems->columns;
     my @biblio_columns     = map { "biblio.$_" } Koha::Biblios->columns;
+    my @age_fields         = GetAutomaticItemModificationAgeFields();
     my $report;
     for my $rule (@rules) {
         my $age = $rule->{age};
 
         # Default to using items.dateaccessioned if there's an old item modification rule
-        # missing an agefield value
+        # missing an agefield value, or if the stored value is not (or is no longer) a
-        my $agefield      = $rule->{agefield} ? $rule->{agefield} : 'items.dateaccessioned';
+        # recognised age field - values are only trusted from a fixed allow-list since
+        # this is spliced directly into the SQL below and cannot be bound as a placeholder.
+        my $agefield = $rule->{agefield} // '';
+        unless ( grep { $_ eq $agefield } @age_fields ) {
+            Koha::Logger->get->warn(qq{Rejecting invalid agefield "$agefield" in automatic item modification rule})
+                if length $agefield;
+            $agefield = 'items.dateaccessioned';
+        }
         my $conditions    = $rule->{conditions};
         my $substitutions = $rule->{substitutions};
-        foreach (@$substitutions) {
+        foreach my $substitution (@$substitutions) {
-            ( $_->{item_field} ) = ( $_->{field} =~ /items\.(.*)/ );
+            my $field = $substitution->{field} // '';
+            if ( grep { $_ eq $field } @item_columns ) {
+                ( $substitution->{item_field} ) = ( $field =~ /^items\.(.*)/ );
+            } else {
+                Koha::Logger->get->warn(
+                    qq{Rejecting invalid substitution field "$field" in automatic item modification rule})
+                    if length $field;
+            }
         }
         my @params;
 
@@ -1706,6 +1742,9 @@ sub ToggleNewStatus {
                     $query .= qq| AND $condition->{field} = ?|;
                     push @params, $condition->{value};
                 }
+            } else {
+                Koha::Logger->get->warn(
+                    qq{Rejecting invalid condition field "$condition->{field}" in automatic item modification rule});
             }
         }
         if ( defined $age ) {
@@ -1722,6 +1761,7 @@ sub ToggleNewStatus {
                 my $field = $substitution->{item_field};
                 my $value = $substitution->{value};
                 next unless $substitution->{field};
+                next unless defined $field;
                 next
                     if ( defined $values->{ $substitution->{item_field} }
                     and $values->{ $substitution->{item_field} } eq $substitution->{value} );

C4/Koha.pm

@@ -742,13 +742,28 @@ sub _normalize_match_point {
 
 sub _isbn_cleanup {
     my ($isbn) = @_;
-    return NormalizeISBN(
+
-        {
+    return unless $isbn;
-            isbn          => $isbn,
+
-            format        => 'ISBN-10',
+    if ( $isbn =~ /^979/ ) {
-            strip_hyphens => 1,
+
-        }
+        # ISBNs starting with 979 cannot be converted to ISBN-10 format, but all other valid ISBNs can
-    ) if $isbn;
+        return NormalizeISBN(
+            {
+                isbn          => $isbn,
+                format        => 'ISBN-13',
+                strip_hyphens => 1,
+            }
+        );
+    } else {
+        return NormalizeISBN(
+            {
+                isbn          => $isbn,
+                format        => 'ISBN-10',
+                strip_hyphens => 1,
+            }
+        );
+    }
 }
 
 =head2 NormalizeISBN

C4/Reports.pm

@@ -51,8 +51,8 @@ This will return a list of all the available delimiters.
 sub GetDelimiterChoices {
     my $default = C4::Context->preference('CSVDelimiter');
 
-    # NOTE: The below list should match the corresponding options in the .pref file
+    # Use the centralized list of allowed delimiters from C4::Context
-    my @dels = ( ';', 'tabulation', ',', '/', '\\', '#' );
+    my @dels = C4::Context::ALLOWED_CSV_DELIMITERS;
 
     return {
         values  => \@dels,

C4/Reserves.pm

@@ -1,7 +1,7 @@
 package C4::Reserves;
 
 # Copyright 2000-2002 Katipo Communications
-#           2006 SAN Ouest Provence
+#           2006 SAN Ouest Provence  # codespell:ignore
 #           2007-2010 BibLibre Paul POULAIN
 #           2011 Catalyst IT
 #
@@ -110,10 +110,10 @@ This modules provides some functions to deal with reservations.
   - priority >0      : then the reserve is at 1st stage, and not yet affected to any item.
              =0      : then the reserve is being dealt
   - found : NULL         : means the patron requested the 1st available, and we haven't chosen the item
-            T(ransit)    : the reserve is linked to an item but is in transit to the pickup branch
+            T (Transit)    : the reserve is linked to an item but is in transit to the pickup branch
-            W(aiting)    : the reserve is linked to an item, is at the pickup branch, and is waiting on the hold shelf
+            W (Waiting)    : the reserve is linked to an item, is at the pickup branch, and is waiting on the hold shelf
-            F(inished)   : the reserve has been completed, and is done
+            F (Finished)   : the reserve has been completed, and is done
-            P(rocessing) : reserved item has been returned using self-check machine and reserve needs to be confirmed
+            P (Processing) : reserved item has been returned using self-check machine and reserve needs to be confirmed
                            by librarian before notice is send and status changed to waiting.
                            Applicable only if HoldsNeedProcessingSIP system preference is set.
   - itemnumber : empty : the reserve is still unaffected to an item
@@ -271,7 +271,6 @@ sub AddReserve {
 
     # Log the hold creation
     if ( C4::Context->preference('HoldsLog') ) {
-
         my $info = to_json(
             {
                 hold                   => $hold->id,
@@ -289,12 +288,11 @@ sub AddReserve {
                 patron_expiration_date => $hold->patron_expiration_date,
                 priority               => $hold->priority,
                 reservenotes           => $hold->reservenotes,
-                confirmations          => $confirmations,
+                confirmations          => $confirmations || [],
-                forced                 => $forced
+                forced                 => $forced        || []
             },
             { pretty => 1, canonical => 1 }
         );
-
         logaction( 'HOLDS', 'CREATE', $hold->id, $info );
     }
 

C4/SIP/SIPServer.pm

@@ -55,6 +55,10 @@ my %transports = (
 # Read configuration
 #
 my $config = C4::SIP::Sip::Configuration->new( $ARGV[0] );
+
+# Per-process record of when this worker loaded $config. Not shared since $config is per-process.
+our $sip2_config_read_timestamp = Koha::Caches->get_instance->get_from_cache('sip2_resource_last_modified');
+
 my @params;
 
 #
@@ -234,13 +238,15 @@ sub _config_up_to_date {
 
     my $cache                       = Koha::Caches->get_instance();
     my $sip2_resource_last_modified = $cache->get_from_cache("sip2_resource_last_modified");
-    my $sip2_config_read_timestamp  = $cache->get_from_cache("sip2_config_read_timestamp");
 
     unless ($sip2_resource_last_modified) {
-        siplog( "LOG_WARNING", "Couldn't find sip2_resource_last_modified, considering configuration not up to date" );
+        siplog( "LOG_INFO", "Couldn't find sip2_resource_last_modified, considering configuration not up to date" );
         return 0;
     }
-    return $sip2_config_read_timestamp >= $sip2_resource_last_modified;
+
+    return 0 unless defined $sip2_config_read_timestamp;
+
+    return $sip2_config_read_timestamp >= $sip2_resource_last_modified ? 1 : 0;
 }
 
 #
@@ -260,15 +266,17 @@ sub process_request {
     my ( $sockaddr, $port, $proto );
     my $transport;
 
+    # Flush L1 before the freshness check so it sees the current shared value, not a stale one inherited at fork.
+    Koha::Caches->flush_L1_caches();
+
     $self->{config} = $config;
     unless ( $self->_config_up_to_date() ) {
         $self->{config} = C4::SIP::Sip::Configuration->get_configuration( undef, $self->{config} );
+        $sip2_config_read_timestamp = Koha::Caches->get_instance->get_from_cache('sip2_resource_last_modified');
     }
 
-    # Flushing L1 to make sure the request will be processed using the correct data
-    Koha::Caches->flush_L1_caches();
-
     $self->{account} = undef;    # Clear out the account from the last request, it may be different
+    $self->{ils}     = undef;    # And the ILS handle, so a reused worker can't reuse a prior session's connection
     $self->{logger}  = set_logger( Koha::Logger->get( { interface => 'sip' } ) );
 
     # Flush previous MDCs to prevent accidentally leaking incorrect MDC-entries
@@ -468,12 +476,12 @@ sub telnet_transport {
             $pwd = get_clean_string($pwd);
             siplog( "LOG_DEBUG", "telnet_transport 2: uid length %s, pwd length %s", length($uid), length($pwd) );
 
-            # Check if user is authorized for SIP access, then authenticate via login_core
+            # Only log the terminal in once login_core actually authenticates it
-            if ( exists( $config->{accounts}->{$uid} ) ) {
+            if ( exists( $config->{accounts}->{$uid} )
+                && C4::SIP::Sip::MsgType::login_core( $self, $uid, $pwd ) )
+            {
                 $account = $config->{accounts}->{$uid};
-                if ( C4::SIP::Sip::MsgType::login_core( $self, $uid, $pwd ) ) {
+                last;
-                    last;
-                }
             }
             siplog( "LOG_WARNING", "Invalid login attempt: '%s'", ( $uid || '' ) );
             print("Invalid login$CRLF");

C4/SIP/Sip/Configuration.pm

@@ -41,17 +41,13 @@ my $parser = XML::Simple->new(
 sub get_configuration {
     my ( $class, $config_file, $current_config ) = @_;
 
-    my $cache                       = Koha::Caches->get_instance();
+    my $cache = Koha::Caches->get_instance();
-    my $sip2_resource_last_modified = $cache->get_from_cache("sip2_resource_last_modified");
 
-    if ($sip2_resource_last_modified) {
+    unless ( $cache->get_from_cache("sip2_resource_last_modified") ) {
-        $cache->set_in_cache( 'sip2_config_read_timestamp', $sip2_resource_last_modified );
-    } else {
 
-        # Set sip2_resource_last_modified so config won't be read from db on each request
+        # Seed sip2_resource_last_modified so the configuration is not re-read
-        my $now = dt_from_string()->epoch;
+        # from the database on every request while the value is missing.
-        $cache->set_in_cache( 'sip2_resource_last_modified', $now );
+        $cache->set_in_cache( 'sip2_resource_last_modified', dt_from_string()->epoch );
-        $cache->set_in_cache( 'sip2_config_read_timestamp',  $now );
     }
 
     my $cfg;

C4/SIP/Sip/MsgType.pm

@@ -932,19 +932,19 @@ sub login_core {
     my $pwd    = shift;
     my $status = 1;                 # Assume it all works
 
+    # Clear any session state up front, including anything left over from a previous connection
+    # on this preforked worker, so no login_core exit path can leave the caller acting as an
+    # authenticated terminal. Only a successful api_auth below re-establishes the session.
+    delete $server->{$_} foreach qw( account ils institution policy sip_username sip_password );
+
     # Check if this userid is authorized for SIP access
     if ( !exists( $server->{config}->{accounts}->{$uid} ) ) {
         siplog( "LOG_WARNING", "MsgType::login_core: SIP access not authorized for user '$uid'" );
         return 0;
     }
 
-    # Store the active account configuration
+    # Authenticate before storing the account on the session
-    $server->{account} = $server->{config}->{accounts}->{$uid};
+    my $inst = $server->{config}->{accounts}->{$uid}->{institution};
-    my $inst = $server->{account}->{institution};
-    $server->{institution}  = $server->{config}->{institutions}->{$inst};
-    $server->{policy}       = $server->{institution}->{policy};
-    $server->{sip_username} = $uid;
-    $server->{sip_password} = $pwd;
 
     # Authenticate using Koha's internal authentication (checks hashed password in borrowers table)
     my $auth_status = api_auth( $uid, $pwd, $inst );
@@ -956,6 +956,13 @@ sub login_core {
         return 0;
     }
 
+    # Store the active account configuration now user has authenticated
+    $server->{account}      = $server->{config}->{accounts}->{$uid};
+    $server->{institution}  = $server->{config}->{institutions}->{$inst};
+    $server->{policy}       = $server->{institution}->{policy};
+    $server->{sip_username} = $uid;
+    $server->{sip_password} = $pwd;
+
     siplog( "LOG_INFO", "Successful login/auth for '%s' of '%s'", $server->{account}->{id}, $inst );
 
     #

C4/SocialData.pm

@@ -110,7 +110,7 @@ sub update_data {
             $i++;
         }
     }
-    say "$i data insered or updated";
+    say "$i data inserted or updated";
 }
 
 =head2 get_report

C4/Stats.pm

@@ -1,66 +0,0 @@
-package C4::Stats;
-
-# Copyright 2000-2002 Katipo Communications
-#
-# This file is part of Koha.
-#
-# Koha is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 3 of the License, or
-# (at your option) any later version.
-#
-# Koha is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Koha; if not, see <https://www.gnu.org/licenses>.
-
-use Modern::Perl;
-use base 'Exporter';
-
-BEGIN {
-    our @EXPORT_OK = qw(
-        UpdateStats
-    );
-}
-
-use Koha::Statistics;
-
-=head1 NAME
-
-C4::Stats - Update Koha statistics (log)
-
-=head1 SYNOPSIS
-
-    use C4::Stats;
-
-=head1 DESCRIPTION
-
-The functions of this module deals with statistics table of Koha database.
-
-=head1 FUNCTIONS
-
-=head2 UpdateStats
-
-    C4::Stats::UpdateStats($params);
-
-    This is a (legacy) alias for Koha::Statistic->new($params)->store.
-    Please see Koha::Statistic module.
-
-=cut
-
-sub UpdateStats {
-    my $params = shift;
-    Koha::Statistic->new($params)->store;
-}
-
-1;
-__END__
-
-=head1 AUTHOR
-
-Koha Development Team <https://koha-community.org/>
-
-=cut

C4/Suggestions.pm

@@ -108,7 +108,7 @@ sub ModSuggestion {
         my $transport =
                ( C4::Context->preference("FallbackToSMSIfNoEmail") )
             && ( $patron->smsalertnumber )
-            && ( !$patron->email ) ? 'sms' : 'email';
+            && ( !$patron->notice_email_address ) ? 'sms' : 'email';
 
         if (
             my $letter = C4::Letters::GetPreparedLetter(

C4/UsageStats.pm

@@ -241,6 +241,7 @@ sub _shared_preferences {
         AmazonCoverImages
         OPACAmazonCoverImages
         Babeltheque
+        EnableZotero
         GoogleJackets
         HTML5MediaEnabled
         LibraryThingForLibrariesEnabled

C4/Utils/DataTables/VirtualShelves.pm

@@ -16,7 +16,7 @@ sub search {
     my $start    = $params->{start};
     my $length   = $params->{length};
 
-    # If not logged in user, be carreful and set the borrowernumber to 0
+    # If not logged in user, be careful and set the borrowernumber to 0
     # to prevent private lists lack
     my $loggedinuser = C4::Context->userenv->{'number'} || 0;
 

Koha.pm

@@ -29,7 +29,7 @@ use vars qw{ $VERSION };
 # - #4 : the developer version. The 4th number is the database subversion.
 #        used by developers when the database changes. updatedatabase take care of the changes itself
 #        and is automatically called by Auth.pm when needed.
-$VERSION = "26.05.00.000";
+$VERSION = "26.05.03.000";
 
 sub version {
     return $VERSION;

Koha/Account.pm

@@ -25,7 +25,6 @@ use Try::Tiny    qw( catch try );
 
 use C4::Letters;
 use C4::Log      qw( logaction );
-use C4::Stats    qw( UpdateStats );
 use C4::Overdues qw(GetFine);
 use C4::Context;
 
@@ -38,6 +37,7 @@ use Koha::Account::DebitTypes;
 use Koha::Exceptions;
 use Koha::Exceptions::Account;
 use Koha::Plugins;
+use Koha::Statistics;
 
 =head1 NAME
 
@@ -286,7 +286,7 @@ sub add_credit {
                     }
                 )->store();
 
-                C4::Stats::UpdateStats(
+                Koha::Statistic->new(
                     {
                         branch         => $library_id,
                         type           => lc($credit_type),
@@ -294,7 +294,8 @@ sub add_credit {
                         borrowernumber => $self->{patron_id},
                         interface      => $interface,
                     }
-                ) if grep { $credit_type eq $_ } ( 'PAYMENT', 'WRITEOFF' );
+                )->store()
+                    if grep { $credit_type eq $_ } ( 'PAYMENT', 'WRITEOFF' );
 
                 Koha::Plugins->call(
                     'after_account_action',

Koha/ActionLog.pm

@@ -19,12 +19,14 @@ package Koha::ActionLog;
 
 use Modern::Perl;
 
+use JSON qw( decode_json );
+
 use C4::Context;
 
 # Avoid `use Koha::Patrons` here: Koha::ActionLog is loaded transitively by
 # C4::Log very early in the dependency chain, before Koha::Patron has been
-# fully defined. The accessors below reach for Koha::Patron at call time,
+# fully defined. The accessors below reach for Koha::Patron (and Koha::Items)
-# by which point it is reliably available.
+# at call time, by which point they are reliably available.
 
 use base qw(Koha::Object);
 
@@ -70,6 +72,42 @@ sub patron {
     return Koha::Patron->_new_from_dbic($rs);
 }
 
+=head3 item
+
+    my $item = $log->item;
+
+Returns the related I<Koha::Item> for a CIRCULATION log entry, or I<undef>.
+
+The itemnumber is not stored in a dedicated column; it lives inside the
+C<info> field, which for circulation is either a JSON payload carrying an
+C<itemnumber> key (ISSUE, RENEWAL) or a bare itemnumber string (RETURN).
+Returns I<undef> for non-circulation rows, when no itemnumber can be
+derived, or when the item has since been deleted.
+
+=cut
+
+sub item {
+    my ($self) = @_;
+
+    return unless ( $self->module // q{} ) eq 'CIRCULATION';
+
+    my $info = $self->info;
+    return unless defined $info;
+
+    my $itemnumber;
+    my $decoded = eval { decode_json($info) };
+    if ( ref($decoded) eq 'HASH' && $decoded->{itemnumber} ) {
+        $itemnumber = $decoded->{itemnumber};
+    } elsif ( $info =~ /^\s*(\d+)\s*$/ ) {
+        $itemnumber = $1;
+    }
+
+    return unless $itemnumber;
+
+    require Koha::Items;
+    return Koha::Items->find($itemnumber);
+}
+
 =head2 Internal methods
 
 =head3 _type

Koha/AdditionalContents.pm

@@ -95,19 +95,31 @@ sub search_for_display {
     my ( $self, $params ) = @_;
     my $lang = $params->{lang} || q{};
 
-    # If lang is not default, we will search for entries matching $lang but fallback to default if $lang is not found
-    # Then we need a subquery count in where clause; DBIx::Class/SQL::Abstract does not support it, fallback to literal SQL
-    my $subquery =
-        qq|(SELECT COUNT(*) FROM additional_contents_localizations WHERE lang='$lang' AND additional_content_id=me.additional_content_id)=0|;
-
     my $search_params = get_public_query_search_params($params);
     $search_params->{lang} = 'default' if !$lang || $lang eq 'default';
-    $search_params->{-or} = [ { 'lang' => $lang }, '-and' => [ 'lang', 'default', \$subquery ] ]
+
-        if !$search_params->{lang};
+    unless ( $search_params->{lang} ) {
+        $search_params->{-or} = [
+            { lang => $lang },
+            {
+                -and => [
+                    { lang => 'default' },
+                    \[
+                        '(SELECT COUNT(*) FROM additional_contents_localizations WHERE lang = ? AND additional_content_id = me.additional_content_id) = 0',
+                        $lang
+                    ]
+                ]
+            }
+        ];
+    }
 
     my $attribs = {
         prefetch => 'additional_content',
-        order_by => { -desc => 'additional_content.published_on' }
+        order_by => [
+            \['ISNULL(additional_content.number)'],
+            { -asc  => 'additional_content.number' },
+            { -desc => 'additional_content.published_on' },
+        ],
     };
     return Koha::AdditionalContentsLocalizations->search( $search_params, $attribs );
 }

Koha/BackgroundJob/BatchUpdateItem.pm

@@ -104,7 +104,7 @@ sub process {
     };
 
     try {
-        my ($results) = Koha::Items->search( { itemnumber => \@record_ids } )->batch_update(
+        my ($results) = Koha::Items->search( { itemnumber => { -in => \@record_ids } } )->batch_update(
             {
                 regex_mod                         => $regex_mod,
                 new_values                        => $new_values,

Koha/BackgroundJob/PseudonymizeStatistic.pm

@@ -18,6 +18,7 @@ package Koha::BackgroundJob::PseudonymizeStatistic;
 use Modern::Perl;
 
 use Koha::PseudonymizedTransactions;
+use Koha::Statistics;
 
 use base 'Koha::BackgroundJob';
 

Koha/Biblio.pm

@@ -1624,7 +1624,9 @@ sub get_marc_authors {
     if ( $marcflavour eq "UNIMARC" ) {
         $fields_filter = '200';
     } else {    # marc21/normarc
-        $fields_filter = '100';
+        $fields_filter = '1..';
+        $mintag        = '100';
+        $maxtag        = '111';
     }
 
     my @first_authors = @{

Koha/ClassSortRule.pm

@@ -23,7 +23,7 @@ use base qw(Koha::Object);
 
 =head1 NAME
 
-Koha::ClassSortRule Koha Classfication Sorting Rule Object class
+Koha::ClassSortRule Koha Classification Sorting Rule Object class
 
 =head1 API
 

Koha/ClassSource.pm

@@ -26,7 +26,7 @@ my $cache = Koha::Caches->get_instance();
 
 =head1 NAME
 
-Koha::ClassSource - Koha Classfication Source Object class
+Koha::ClassSource - Koha Classification Source Object class
 
 =head1 API
 

Koha/ClassSplitRule.pm

@@ -25,7 +25,7 @@ use base qw(Koha::Object);
 
 =head1 NAME
 
-Koha::ClassSplitRule Koha Classfication Splitting Rule Object class
+Koha::ClassSplitRule Koha Classification Splitting Rule Object class
 
 =head1 API
 

Koha/Database/DataInconsistency.pm

@@ -68,7 +68,8 @@ sub invalid_item_library {
 
 =head2 ids
 
-    Build a hashref of IDs from a Koha::Object Koha::Objects-based object.
+    Build a set of biblionumbers suitable for an IN search from a Koha::Object or Koha::Objects-based object.
+    Returns a subquery for a Koha::Objects set and an arrayref for a single Koha::Object.
 
 =cut
 
@@ -76,8 +77,8 @@ sub ids {
     my ( $self, $object ) = @_;
     if ( $object->can('_resultset') ) {
 
-        # It's a Koha::Objects
+        # It's a Koha::Objects, don't materialize the ids, let the database resolve the set
-        return [ $object->get_column('biblionumber') ];
+        return $object->_resultset->get_column('biblionumber')->as_query;
     } else {
 
         # It's a single Koha::Object
@@ -98,7 +99,7 @@ sub no_item_type {
     if ( C4::Context->preference('item-level_itypes') ) {
         my $items_without_itype = Koha::Items->search(
             {
-                biblionumber => $ids,
+                biblionumber => { -in => $ids },
                 -or          => [ itype => undef, itype => '' ]
             }
         );
@@ -122,7 +123,7 @@ sub no_item_type {
     } else {
         my $biblioitems_without_itemtype = Koha::Biblioitems->search(
             {
-                biblionumber => $ids,
+                biblionumber => { -in => $ids },
                 -or          => [ itemtype => undef, itemtype => '' ]
             }
         );
@@ -152,7 +153,7 @@ sub invalid_item_type {
     if ( C4::Context->preference('item-level_itypes') ) {
         my $items_with_invalid_itype = Koha::Items->search(
             {
-                biblionumber => $ids,
+                biblionumber => { -in => $ids },
                 -and         => [ itype => { not_in => \@itemtypes }, itype => { '!=' => '' } ]
             }
         );
@@ -169,7 +170,7 @@ sub invalid_item_type {
     } else {
         my $biblioitems_with_invalid_itemtype = Koha::Biblioitems->search(
             {
-                biblionumber => $ids,
+                biblionumber => { -in => $ids },
                 -and         => [ itemtype => { not_in => \@itemtypes }, itemtype => { '!=' => '' } ]
             }
         );
@@ -200,7 +201,7 @@ sub errors_in_marc {
     my ( $item_tag, $item_subfield ) = C4::Biblio::GetMarcFromKohaField("items.itemnumber");
     my $search_string = q{ExtractValue(metadata,'count(//datafield[@tag="} . $item_tag . q{"])')>0};
     my $biblio_metadatas_with_item_fields =
-        Koha::Biblio::Metadatas->search( { biblionumber => $ids } )->search( \$search_string );
+        Koha::Biblio::Metadatas->search( { biblionumber => { -in => $ids } } )->search( \$search_string );
     if ( $biblio_metadatas_with_item_fields->count ) {
         while ( my $biblio_metadata_with_item_fields = $biblio_metadatas_with_item_fields->next ) {
             push @item_fields_in_marc,
@@ -212,7 +213,7 @@ sub errors_in_marc {
 
     my ( $biblio_tag,     $biblio_subfield )     = C4::Biblio::GetMarcFromKohaField("biblio.biblionumber");
     my ( $biblioitem_tag, $biblioitem_subfield ) = C4::Biblio::GetMarcFromKohaField("biblioitems.biblioitemnumber");
-    $biblios = Koha::Biblios->search( { biblionumber => $ids } );
+    $biblios = Koha::Biblios->search( { biblionumber => { -in => $ids } } );
     while ( my $biblio = $biblios->next ) {
         my $record = eval { $biblio->metadata->record; };
         if ($@) {
@@ -248,7 +249,7 @@ sub errors_in_marc {
                 __x(
                 q{Biblionumber {biblionumber} has biblioitemnumber '{biblioitemnumber_in_marc}' but should be '{biblioitemnumber}' in {biblioitem_tag}${biblioitem_subfield}},
                 biblionumber             => $biblio->biblionumber,
-                biblioitemnumber_in_marc => $biblionumber,
+                biblioitemnumber_in_marc => $biblioitemnumber,
                 biblioitemnumber         => $biblio->biblioitem->biblioitemnumber,
                 biblioitem_tag           => $biblioitem_tag,
                 biblioitem_subfield      => $biblioitem_subfield,
@@ -316,7 +317,7 @@ sub nonexistent_AV {
             # We are only checking biblios with items
             my $items = Koha::Items->search(
                 {
-                    'me.biblionumber' => $ids,
+                    'me.biblionumber' => { -in => $ids },
                     $tmp_kohafield    => {
                         -not_in => [ $avs->get_column('authorised_value'), '' ],
                         '!='    => undef,
@@ -371,7 +372,7 @@ sub empty_title {
     my @errors;
     $biblios = Koha::Biblios->search(
         {
-            biblionumber => $ids,
+            biblionumber => { -in => $ids },
             -or          => [
                 title => '',
                 title => undef,

Koha/Devel/CI/IncrementalRuns.pm

@@ -140,6 +140,7 @@ sub get_files_to_test {
             @koha_commit_history;
             if ($last_build_commit) {
                 @files = @{ from_json( read_file("$self->{git_repo_dir}/$self->{test_dir}/$last_build_commit") ) };
+                @files = grep { $dev_files->get_filetype($_) eq $filetype } @files;
                 @files = $dev_files->remove_exceptions( \@files, $filetype );
                 push @files, $dev_files->ls_files( $filetype, "$last_build_commit HEAD" );
             } else {

Koha/EDI.pm

@@ -1603,7 +1603,7 @@ Koha::EDI
      Returns 1 on success undef on error
 
      Most usual cause of error is a line with no or incorrect budget codes
-     which woild cause order creation to abort
+     which would cause order creation to abort
      If other correct lines exist these are processed and the erroneous line os logged
 
 =head2 title_level_class

Koha/Edifact.pm

@@ -414,7 +414,7 @@ Edifact - Edifact message handler
 
 =head2 service_string_advice
 
-  Examines the Service String Advice returns 1 if the default separartors are in use
+  Examines the Service String Advice returns 1 if the default separators are in use
   undef otherwise
 
 =head2 segmentize

Koha/Edifact/Order.pm

@@ -149,7 +149,7 @@ sub interchange_header {
     $hdr .= $self->interchange_control_reference();
     $hdr .= $separator;
 
-    # Recipents reference password not usually used in edifact
+    # Recipients reference password not usually used in edifact
     $hdr .= q{+ORDERS};        # application reference
 
     #Edifact does not usually include the following
@@ -468,7 +468,7 @@ sub order_line {
     # FTX free text for current orderline
     #    Pass vendor note in FTX free text segment
     if ( $orderline->order_vendornote ) {
-        my $vendornote = $orderline->order_vendornote;
+        my $vendornote = encode_text( $orderline->order_vendornote );
         chomp $vendornote;
         my $ftx = 'FTX+LIN+++';
         $ftx .= $vendornote;
@@ -492,7 +492,7 @@ sub order_line {
     # RFF : suppliers unique quotation reference number
     if ( $orderline->suppliers_reference_number ) {
         $rff = join q{}, 'RFF+', $orderline->suppliers_reference_qualifier,
-            ':', $orderline->suppliers_reference_number, $seg_terminator;
+            ':', encode_text( $orderline->suppliers_reference_number ), $seg_terminator;
         $self->add_seg($rff);
     }
 
@@ -579,7 +579,7 @@ sub gir_segments {
     my $orderfields  = $params->{ol_fields};
     my @onorderitems = @{ $params->{items} };
 
-    my $budget_code = $orderfields->{budget_code};
+    my $budget_code = encode_text( $orderfields->{budget_code} );
     my @segments;
     my $sequence_no = 1;
     my $lsq_field   = C4::Context->preference('EdifactLSQ');
@@ -593,27 +593,27 @@ sub gir_segments {
         }
         if ( $item->{branchcode} ) {
             push @gir_elements,
-                { identity_number => 'LLO', data => $item->{branchcode} };
+                { identity_number => 'LLO', data => encode_text( $item->{branchcode} ) };
         }
         if ( $item->{itype} ) {
             push @gir_elements,
-                { identity_number => 'LST', data => $item->{itype} };
+                { identity_number => 'LST', data => encode_text( $item->{itype} ) };
         }
 
         # Handle LSQ mapping
         if ( $lsq_field && $item->{$lsq_field} ) {
             push @gir_elements,
-                { identity_number => 'LSQ', data => $item->{$lsq_field} };
+                { identity_number => 'LSQ', data => encode_text( $item->{$lsq_field} ) };
         }
 
         # Handle LSL mapping
         if ( $lsl_field && $item->{$lsl_field} ) {
             push @gir_elements,
-                { identity_number => 'LSL', data => $item->{$lsl_field} };
+                { identity_number => 'LSL', data => encode_text( $item->{$lsl_field} ) };
         }
         if ( $item->{itemcallnumber} ) {
             push @gir_elements,
-                { identity_number => 'LSM', data => $item->{itemcallnumber} };
+                { identity_number => 'LSM', data => encode_text( $item->{itemcallnumber} ) };
         }
 
         # itemcallnumber -> shelfmark
@@ -621,7 +621,7 @@ sub gir_segments {
             push @gir_elements,
                 {
                 identity_number => 'LVT',
-                data            => $orderfields->{servicing_instruction}
+                data            => encode_text( $orderfields->{servicing_instruction} )
                 };
         }
         my $e_cnt   = 0;    # count number of elements so we dont exceed 5 per segment
@@ -666,7 +666,7 @@ sub lin_segment {
     my ( $line_number, $item_number_id ) = @_;
 
     if ($item_number_id) {
-        $item_number_id = "++${item_number_id}:EN";
+        $item_number_id = "++" . encode_text($item_number_id) . ":EN";
     } else {
         $item_number_id = q||;
     }
@@ -691,7 +691,7 @@ sub additional_product_id {
     }
 
     # function id set to 5 states this is the main product id
-    return "PIA+5+$product_id:$product_code$seg_terminator";
+    return "PIA+5+" . encode_text($product_id) . ":$product_code$seg_terminator";
 }
 
 sub message_date_segment {

Koha/Exceptions/Patron.pm

@@ -21,7 +21,7 @@ use Exception::Class (
     },
     'Koha::Exceptions::Patron::FailedDeleteAnonymousPatron' => {
         isa         => 'Koha::Exceptions::Patron',
-        description => "Deleting patron failed, AnonymousPatron is not deleteable"
+        description => "Deleting patron failed, AnonymousPatron is not deletable"
     },
     'Koha::Exceptions::Patron::FailedDeleteProtectedPatron' => {
         isa         => 'Koha::Exceptions::Patron',

Koha/File/Transport.pm

@@ -244,6 +244,45 @@ sub _is_connected {
     die "Subclass must implement _is_connected";
 }
 
+=head3 current_directory
+
+    my $path = $transport->current_directory();
+
+Returns the transport's current remote working directory as a plain string,
+without side effects. Automatically establishes a connection if needed.
+
+B<Note:> This is a read-only query. It must never navigate the connection -
+unlike some underlying libraries' own C<cwd()>/C<pwd()> methods, which differ
+in meaning between backends (see subclass implementations).
+
+B<Returns:> The current directory path on success, undef on failure. Check
+object_messages() for details.
+
+=cut
+
+sub current_directory {
+    my ($self) = @_;
+
+    return unless $self->_ensure_connected();
+
+    return $self->_current_directory();
+}
+
+=head3 _current_directory
+
+    my $path = $transport->_current_directory();
+
+Internal method that returns the protocol-specific current working
+directory. Must be implemented by subclasses. Called by current_directory()
+after connection verification.
+
+=cut
+
+sub _current_directory {
+    my ($self) = @_;
+    die "Subclass must implement _current_directory";
+}
+
 =head3 _auto_change_directory
 
     $transport->_auto_change_directory($dir_type, $custom_path);

Koha/File/Transport/FTP.pm

@@ -17,6 +17,7 @@ package Koha::File::Transport::FTP;
 
 use Modern::Perl;
 use Net::FTP;
+use Time::Local qw( timegm );
 use Try::Tiny;
 
 use base qw(Koha::File::Transport);
@@ -122,6 +123,26 @@ sub _download_file {
     return 1;
 }
 
+=head3 _current_directory
+
+    my $path = $self->_current_directory;
+
+Internal method that returns the FTP connection's current working directory.
+
+Net::FTP's own C<cwd()> method is a mutator: called with no argument it
+defaults to "/" and issues a real C<CWD /> command, changing the connection's
+directory as a side effect and returning a boolean rather than a path. The
+read-only equivalent is C<pwd()>, which sends PWD and parses the path out of
+the response without navigating anywhere.
+
+=cut
+
+sub _current_directory {
+    my ($self) = @_;
+
+    return $self->{connection}->pwd;
+}
+
 =head3 _change_directory
 
     my $success = $server->_change_directory($directory);
@@ -144,7 +165,7 @@ sub _change_directory {
             type    => 'success',
             payload => {
                 directory => $remote_directory,
-                pwd       => $self->{connection}->pwd
+                pwd       => $self->_current_directory
             }
         }
     );
@@ -156,7 +177,22 @@ sub _change_directory {
 
 Internal method that performs the FTP-specific file listing operation.
 Returns an array reference of hashrefs with file information.
-Each hashref contains: filename, longname, size, perms.
+Each hashref contains: filename, longname, size, perms, mtime, type.
+
+The listing is obtained with MLSD (RFC 3659), whose machine-readable output
+is locale- and platform-independent and gives us the filename unambiguously
+(the pathname is the entire text after the "facts" and a single space, so
+filenames containing spaces are handled correctly). Servers that do not
+support MLSD fall back to NLST, which returns bare filenames only.
+
+This mirrors what Net::FTP does internally for rmdir(). Net::FTP 3.x exposes
+no public MLSD method, so we drive it through its _list_cmd() helper - the
+same private method that backs the public ls()/dir() and that Net::FTP's own
+rmdir() uses for MLSD. That interface has been stable for many releases.
+
+The hashref shape is kept consistent with the SFTP and Local transports so
+that consumers of list_files() (including out-of-tree ones) can rely on the
+same structure regardless of transport type.
 
 =cut
 
@@ -164,26 +200,63 @@ sub _list_files {
     my ($self) = @_;
     my $operation = "list";
 
-    # Get detailed listing using dir() for consistency with SFTP format
-    my $detailed_list = $self->{connection}->dir or return $self->_abort_operation($operation);
-
-    # Convert to hash format consistent with SFTP
     my @file_list;
-    foreach my $line ( @{$detailed_list} ) {
 
-        # Parse FTP dir output (similar to ls -l format)
+    # Prefer MLSD: machine-readable, no locale/format guessing. Net::FTP has
-        # Example: "-rw-r--r-- 1 user group 1234 Jan 01 12:00 filename.txt"
+    # no public MLSD method, so use its internal _list_cmd() (as its own
-        if ( $line =~ /^([d\-rwx]+)\s+\S+\s+\S+\s+\S+\s+(\d+)\s+(.+?)\s+(.+)$/ ) {
+    # rmdir() does). Returns an arrayref of "facts filename" lines, or undef.
-            my ( $perms, $size, $date_part, $filename ) = ( $1, $2, $3, $4 );
+    my $mlsd = $self->{connection}->_list_cmd("MLSD");
 
-            # Skip directories (start with 'd')
+    if ( $mlsd && @{$mlsd} ) {
-            next if $perms =~ /^d/;
+        foreach my $line ( @{$mlsd} ) {
 
+            # Each line is "fact1=val;fact2=val;...; pathname"; the pathname is
+            # everything after the facts and the single separating space.
+            next unless $line =~ /^(.*?;)\s(.+)$/;
+            my ( $facts_str, $filename ) = ( $1, $2 );
+
+            my %fact =
+                map { my ( $k, $v ) = split /=/, $_, 2; ( lc($k) => $v ) }
+                grep { length } split /;/, $facts_str;
+
+            # Skip only the current/parent directory pseudo-entries; real
+            # subdirectories (type=dir) are now included like Local and SFTP.
+            next if ( $fact{type} // q{} ) =~ /^(?:cdir|pdir)$/i;
+
+            my $type =
+                  ( $fact{type} // q{} ) eq 'file' ? 'file'
+                : ( $fact{type} // q{} ) eq 'dir'  ? 'directory'
+                :                                    'other';
+
+            my $perms = $self->_perms_from_mlsd_facts( \%fact, $type );
             push @file_list, {
                 filename => $filename,
                 longname => $line,
+                size     => $fact{size},
+                perms    => $perms,
+                mtime    => $self->_mtime_from_mlsd_fact( $fact{modify} ),
+                type     => $type,
+            };
+        }
+    } else {
+
+        # Fallback for servers without MLSD: NLST returns bare filenames
+        # only, so probe each entry with SIZE/MDTM (both plain Net::FTP
+        # methods) to recover size, mtime and a best-effort type. A
+        # permission-denied file would be misclassified as a directory here
+        # (SIZE failing is the only signal available) - a rare, accepted
+        # limitation of this legacy fallback path. perms stays undef: there
+        # is no way to get Unix permission bits without MLSD/UNIX.mode.
+        my $names = $self->{connection}->ls or return $self->_abort_operation($operation);
+        foreach my $name ( grep { !/^[.]{1,2}$/ } @{$names} ) {
+            my $size = $self->{connection}->size($name);
+            push @file_list, {
+                filename => $name,
+                longname => undef,
                 size     => $size,
-                perms    => $perms
+                perms    => undef,
+                mtime    => $self->{connection}->mdtm($name),
+                type     => defined $size ? 'file' : 'directory',
             };
         }
     }
@@ -194,7 +267,7 @@ sub _list_files {
             type    => 'success',
             payload => {
                 count => scalar @file_list,
-                pwd   => $self->{connection}->pwd
+                pwd   => $self->_current_directory
             }
         }
     );
@@ -202,6 +275,60 @@ sub _list_files {
     return \@file_list;
 }
 
+=head3 _perms_from_mlsd_facts
+
+    my $perms = $self->_perms_from_mlsd_facts( \%fact, $type );
+
+Converts MLSD facts into the same C<"%04o"> Unix permission-bits string used
+by the Local and SFTP transports.
+
+Prefers the C<UNIX.mode> vendor-extension fact (exact Unix octal
+permissions) when the server provides it. Otherwise approximates from the
+RFC 3659 C<perm> fact, which describes only what the connected user is
+allowed to do (append/create/delete/rename/list/mkdir/read/write/etc.), not
+a real owner/group/other split - the resulting triad is mirrored across
+owner/group/other since that distinction isn't available. Returns undef if
+neither fact is present.
+
+=cut
+
+sub _perms_from_mlsd_facts {
+    my ( $self, $fact, $type ) = @_;
+
+    if ( defined $fact->{'unix.mode'} ) {
+        return sprintf( "%04o", oct( $fact->{'unix.mode'} ) & oct('07777') );
+    }
+
+    my $perm = $fact->{perm};
+    return unless defined $perm;
+
+    my $bits = 0;
+    $bits |= 4 if $perm                         =~ /r/;
+    $bits |= 2 if $perm                         =~ /[wa]/;
+    $bits |= 1 if $type eq 'directory' && $perm =~ /e/;
+
+    return sprintf( "%04o", ( $bits << 6 ) | ( $bits << 3 ) | $bits );
+}
+
+=head3 _mtime_from_mlsd_fact
+
+    my $mtime = $self->_mtime_from_mlsd_fact( $fact->{modify} );
+
+Converts an MLSD C<modify> fact (RFC 3659 C<YYYYMMDDHHMMSS[.sss]> format,
+always UTC) into a Unix epoch timestamp. Returns undef if the fact is
+missing or doesn't match the expected format.
+
+=cut
+
+sub _mtime_from_mlsd_fact {
+    my ( $self, $modify ) = @_;
+
+    return unless defined $modify;
+    return unless $modify =~ /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/;
+
+    return eval { timegm( $6, $5, $4, $3, $2 - 1, $1 ) };
+}
+
 =head3 _rename_file
 
 Internal method that performs the FTP-specific file rename operation.
@@ -255,9 +382,19 @@ Internal method to check if transport is currently connected.
 sub _is_connected {
     my ($self) = @_;
 
-    return $self->{connection} && $self->{connection}->pwd();
+    return $self->{connection} && $self->_current_directory();
 }
 
+=head3 _abort_operation
+
+    return $self->_abort_operation($operation);
+
+Records an error message for the named operation, aborts any in-progress
+transfer on the current connection and returns nothing, so callers can
+C<return $self-E<gt>_abort_operation($operation)> on failure.
+
+=cut
+
 sub _abort_operation {
     my ( $self, $operation ) = @_;
 

Koha/File/Transport/Local.pm

@@ -19,6 +19,7 @@ use Modern::Perl;
 use File::Copy qw( copy move );
 use File::Spec;
 use IO::Dir;
+use Fcntl qw( S_ISDIR S_ISREG );
 
 use base qw(Koha::File::Transport);
 
@@ -253,11 +254,27 @@ sub _change_directory {
     return 1;
 }
 
+=head3 _current_directory
+
+    my $path = $self->_current_directory;
+
+Internal method that returns the local transport's current working
+directory: the directory most recently set via change_directory(), falling
+back to the configured download_directory, then to '.'.
+
+=cut
+
+sub _current_directory {
+    my ($self) = @_;
+
+    return $self->{current_directory} || $self->download_directory || '.';
+}
+
 =head3 _list_files
 
 Internal method that performs the local file system file listing operation.
 Returns an array reference of hashrefs with file information.
-Each hashref contains: filename, longname, size, perms, mtime.
+Each hashref contains: filename, longname, size, perms, mtime, type.
 
 =cut
 
@@ -300,14 +317,20 @@ sub _list_files {
     while ( defined( my $file = $dir_handle->read ) ) {
         next if $file =~ /^\.\.?$/;    # Skip . and ..
         my $full_path = File::Spec->catfile( $directory, $file );
-        next unless -f $full_path;     # Only files
 
-        # Get file stats for consistency with SFTP format
+        # Get file stats for consistency with the SFTP/FTP format
-        my @stat  = stat($full_path);
+        my @stat = stat($full_path);
+        next unless @stat;             # Skip entries we can't stat (e.g. broken symlinks)
+
         my $size  = $stat[7] || 0;
         my $mtime = $stat[9] || 0;
         my $mode  = $stat[2] || 0;
 
+        my $type =
+              S_ISDIR($mode) ? 'directory'
+            : S_ISREG($mode) ? 'file'
+            :                  'other';
+
         # Create permissions string (simplified)
         my $perms = sprintf( "%04o", $mode & oct('07777') );
 
@@ -316,7 +339,8 @@ sub _list_files {
             longname => sprintf( "%s %8d %s %s", $perms, $size, scalar( localtime($mtime) ), $file ),
             size     => $size,
             perms    => $perms,
-            mtime    => $mtime
+            mtime    => $mtime,
+            type     => $type,
         };
     }
     $dir_handle->close;

Koha/File/Transport/SFTP.pm

@@ -23,7 +23,8 @@ use File::Spec;
 use IO::File;
 use Net::SFTP::Foreign;
 use Try::Tiny;
-use JSON qw( decode_json encode_json );
+use JSON  qw( decode_json encode_json );
+use Fcntl qw( S_ISDIR S_ISREG );
 
 use base qw(Koha::File::Transport);
 
@@ -137,6 +138,24 @@ sub _download_file {
     return 1;
 }
 
+=head3 _current_directory
+
+    my $path = $self->_current_directory;
+
+Internal method that returns the SFTP connection's current working directory.
+
+Net::SFTP::Foreign's C<cwd()> is a pure read-only accessor - it reports the
+current remote directory without navigating - unlike FTP's C<cwd()> (see
+Koha::File::Transport::FTP::_current_directory).
+
+=cut
+
+sub _current_directory {
+    my ($self) = @_;
+
+    return $self->{connection}->cwd;
+}
+
 =head3 _change_directory
 
     my $success = $server->_change_directory($directory);
@@ -172,7 +191,16 @@ sub _change_directory {
 
 Internal method that performs the SFTP-specific file listing operation.
 Returns an array reference of hashrefs with file information.
-Each hashref contains: filename, longname, a (attributes).
+Each hashref contains: filename, longname, size, perms, mtime, type.
+
+Net::SFTP::Foreign's ls() natively returns the size/perms/mtime nested inside
+a Net::SFTP::Foreign::Attributes object (the 'a' key). Those fields are
+flattened out here so the returned shape matches the FTP and Local transports.
+
+Net::SFTP::Foreign::ls() does not filter '.' and '..' out of its
+SSH_FXP_READDIR response itself - whether those pseudo-entries appear is
+purely down to the remote server implementation. They are skipped here so
+behaviour is consistent with the FTP and Local transports.
 
 =cut
 
@@ -182,6 +210,22 @@ sub _list_files {
 
     my $file_list = $self->{connection}->ls or return $self->_abort_operation($operation);
 
+    my @files = map {
+        my $attrs = $_->{a};
+        my $mode  = $attrs ? $attrs->perm : undef;
+        {
+            filename => $_->{filename},
+            longname => $_->{longname},
+            size     => $attrs                  ? $attrs->size                            : undef,
+            perms    => $attrs && defined $mode ? sprintf( "%04o", $mode & oct('07777') ) : undef,
+            mtime    => $attrs                  ? $attrs->mtime                           : undef,
+            type     => !defined $mode          ? 'other'
+            : S_ISDIR($mode) ? 'directory'
+            : S_ISREG($mode) ? 'file'
+            : 'other',
+        }
+    } grep { $_->{filename} !~ /^\.\.?$/ } @{$file_list};
+
     $self->add_message(
         {
             message => $operation,
@@ -194,7 +238,7 @@ sub _list_files {
         }
     );
 
-    return $file_list;
+    return \@files;
 }
 
 =head3 _rename_file

Koha/FrameworkPlugin.pm

@@ -56,7 +56,7 @@ Koha::FrameworkPlugin - Facilitate use of plugins in MARC/items editor
 
     This object support two code styles:
     - In the new style, the plugin returns a hashref with a builder and a
-      launcher key pointing to two anynomous subroutines.
+      launcher key pointing to two anonymous subroutines.
     - In the old style, the builder is subroutine plugin_javascript and the
       launcher is subroutine plugin. For each plugin the routines are
       redefined.

Koha/Hold.pm

@@ -214,14 +214,32 @@ sub move_hold {
         $new_itemnumber   = $item->itemnumber;
         $new_biblionumber = $item->biblionumber;
 
+        # need to make sure the item is being moved to a valid pickup location
+        return { success => 0, error => 'invalidPickupBranch' } unless $self->_pickup_valid_for_item( $item, $patron );
+
         $canReserve = C4::Reserves::CanItemBeReserved( $patron, $item, $self->branchcode, { ignore_hold_counts => 1 } );
     } elsif ( $args->{new_biblionumber} ) {
         $new_biblionumber = $args->{new_biblionumber};
 
+        # for record level holds we must check to make sure there is at least 1 item on the record that can fulfill the new hold
+        my @items = Koha::Items->search( { biblionumber => $new_biblionumber } )->as_list;
+
+        return { success => 0, error => 'noItemsOnBib' } unless @items;
+
+        my $valid_pickup_item = 0;
+        foreach my $candidate_item (@items) {
+            if ( $self->_pickup_valid_for_item( $candidate_item, $patron ) ) {
+                $valid_pickup_item = 1;
+                last;
+            }
+        }
+        return { success => 0, error => 'invalidPickupBranch' } unless $valid_pickup_item;
+
         $canReserve = C4::Reserves::CanBookBeReserved(
             $patron->borrowernumber, $new_biblionumber, $self->branchcode,
             { ignore_hold_counts => 1 }
         );
+
     } else {
         return { success => 0, error => 'Missing itemnumber or biblionumber' };
     }
@@ -1697,6 +1715,30 @@ sub strings_map {
     return $strings;
 }
 
+=head3 _pickup_valid_for_item
+
+Helper method to determine if the pickup location for an item is valid when a hold is moved.
+Returns true if the pickup location is valid.
+
+=cut
+
+sub _pickup_valid_for_item {
+    my ( $self, $item, $patron ) = @_;
+
+    my $branchitemrule = C4::Circulation::GetBranchItemRule(
+        Koha::Policy::Holds->holds_control_library( $item, $patron ),
+        $item->effective_itemtype
+    );
+
+    my $policy = $branchitemrule->{hold_fulfillment_policy};
+
+    return 0
+        if ( $policy eq 'homebranch' || $policy eq 'holdingbranch' )
+        && $self->branchcode ne $item->$policy;
+
+    return 1;
+}
+
 =head2 Internal methods
 
 =head3 _type

Koha/Holds.pm

@@ -161,11 +161,18 @@ sub get_items_that_can_fill {
             collapse => 1,
         }
     )->get_column('itemnumber');
+    my @pending_recalls = Koha::Recalls->search(
+        { 'status' => [ 'waiting', 'in_transit' ] },
+        {
+            columns  => ['item_id'],
+            collapse => 1,
+        }
+    )->get_column('item_id');
 
     return Koha::Items->search(
         {
             -or        => \@bibs_or_items,
-            itemnumber => { -not_in => [ @branchtransfers, @waiting_holds ] },
+            itemnumber => { -not_in => [ @branchtransfers, @waiting_holds, @pending_recalls ] },
             onloan     => undef,
             notforloan => 0,
         }

Koha/ILL/Batch.pm

@@ -108,7 +108,7 @@ sub create_and_log {
 
     $logger->log_something(
         {
-            modulename   => 'ILL',
+            modulename   => 'ILL_BATCHES',
             actionname   => 'batch_create',
             objectnumber => $self->id,
             infos        => to_json( {} )
@@ -144,7 +144,7 @@ sub update_and_log {
 
     $logger->log_something(
         {
-            modulename   => 'ILL',
+            modulename   => 'ILL_BATCHES',
             actionname   => 'batch_update',
             objectnumber => $self->id,
             infos        => to_json(
@@ -172,7 +172,7 @@ sub delete_and_log {
 
     $logger->log_something(
         {
-            modulename   => 'ILL',
+            modulename   => 'ILL_BATCHES',
             actionname   => 'batch_delete',
             objectnumber => $self->id,
             infos        => to_json( {} )

Koha/ILL/Batch/Status.pm

@@ -63,7 +63,7 @@ sub create_and_log {
 
     $logger->log_something(
         {
-            modulename   => 'ILL',
+            modulename   => 'ILL_BATCHES',
             actionname   => 'batch_status_create',
             objectnumber => $self->id,
             infos        => to_json( {} )
@@ -94,7 +94,7 @@ sub update_and_log {
 
     $logger->log_something(
         {
-            modulename   => 'ILL',
+            modulename   => 'ILL_BATCHES',
             actionname   => 'batch_status_update',
             objectnumber => $self->id,
             infos        => to_json(
@@ -131,7 +131,7 @@ sub delete_and_log {
 
     $logger->log_something(
         {
-            modulename   => 'ILL',
+            modulename   => 'ILL_BATCHES',
             actionname   => 'batch_status_delete',
             objectnumber => $self->id,
             infos        => to_json( {} )

Koha/ILL/Request.pm

@@ -45,6 +45,7 @@ use Koha::Items;
 use Koha::Libraries;
 use Koha::AdditionalContents;
 use Koha::Patron;
+use Koha::Statistics;
 
 use C4::Circulation qw( CanBookBeIssued AddIssue );
 
@@ -1725,6 +1726,12 @@ sub check_out {
         }
 
         # We can allegedly check out, so make it so
+        # Mark as ILL checkout in the logs to track system-initiated checkouts.
+        # AddIssue signature is ( $patron, $barcode, $datedue, $cancelreserve,
+        # $issuedate, $sipmode, $params ) - pad to position 7 so the params
+        # hashref is not mistaken for $issuedate or $sipmode.
+        push @issue_args, undef while @issue_args < 6;
+        push @issue_args, { forced => ['ILL_CHECKOUT'] };
         my $issue = C4::Circulation::AddIssue(@issue_args);
 
         if ($issue) {
@@ -2269,7 +2276,7 @@ Actions to be done after the request has been completed
 sub after_completed {
     my ($self) = @_;
 
-    C4::Stats::UpdateStats(
+    Koha::Statistic->new(
         {
             borrowernumber => $self->borrowernumber // undef,
             branch         => $self->branchcode,
@@ -2281,7 +2288,7 @@ sub after_completed {
             location       => undef,
             type           => 'illreq_comp',
         }
-    );
+    )->store();
 }
 
 =head3 after_created
@@ -2295,7 +2302,7 @@ Actions to be done after the request has been fully created
 sub after_created {
     my ($self) = @_;
 
-    C4::Stats::UpdateStats(
+    Koha::Statistic->new(
         {
             borrowernumber => $self->borrowernumber // undef,
             branch         => $self->branchcode,
@@ -2307,7 +2314,7 @@ sub after_created {
             location       => undef,
             type           => 'illreq_created',
         }
-    );
+    )->store();
 }
 
 =head3 requested_partners

Koha/ImportBatch.pm

@@ -102,7 +102,7 @@ sub new_from_file {
             );
         }
 
-        if ($errors) {
+        if ( scalar @$errors ) {
             Koha::Logger->get->warn( 'The following error(s) occurred during '
                     . ( defined $format ? ( $format . " " ) : "" )
                     . "record import:\nERROR: "

Koha/Item.pm

@@ -58,6 +58,7 @@ use Koha::StockRotationItem;
 use Koha::StockRotationRotas;
 use Koha::TrackedLinks;
 use Koha::Policy::Holds;
+use Koha::Statistics;
 
 use base qw(Koha::Object);
 
@@ -268,7 +269,7 @@ Record a statistics entry for this item (e.g. on store or delete).
 
 sub _add_statistic {
     my ( $self, $type ) = @_;
-    C4::Stats::UpdateStats(
+    Koha::Statistic->new(
         {
             borrowernumber => undef,
             branch         => C4::Context->userenv ? C4::Context->userenv->{branch} : undef,
@@ -279,7 +280,7 @@ sub _add_statistic {
             location       => $self->location,
             type           => $type,
         }
-    );
+    )->store();
 }
 
 =head3 delete

Koha/Item/Templates.pm

@@ -31,7 +31,7 @@ Koha::Item::Templates - Koha Item Template Object set class
 
 =head3 get_available
 
-Returns a hashref with keys 'owned' and 'shared' pointing to Koha::Item::Templats objects
+Returns a hashref with keys 'owned' and 'shared' pointing to Koha::Item::Templates objects
 representing templates owned by the user or shared to the user respectivetly.
 
 =cut

Koha/Items.pm

@@ -32,6 +32,7 @@ use Koha::SearchEngine::Indexer;
 use Koha::Item::Attributes;
 use Koha::Item;
 use Koha::CirculationRules;
+use Koha::Regex::Replacement;
 
 use base qw(Koha::Objects);
 
@@ -311,9 +312,9 @@ sub filter_by_has_recalls {
 
     $params //= {};
     my $recalls = Koha::Recalls->search(
-        { %$params, 'me.itemnumber' => [ $self->get_column('itemnumber') ], 'me.item_level' => 1, },
+        { %$params, 'me.item_id' => [ $self->get_column('itemnumber') ], 'me.item_level' => 1, },
         {
-            columns  => ['itemnumber'],
+            columns  => ['item_id'],
             distinct => 1
         }
     )->_resultset->as_query;
@@ -599,7 +600,8 @@ sub batch_update {
 
     if (@modified_itemnumbers) {
         my @biblionumbers =
-            uniq( Koha::Items->search( { itemnumber => \@modified_itemnumbers } )->get_column('biblionumber') );
+            uniq(
+            Koha::Items->search( { itemnumber => { -in => \@modified_itemnumbers } } )->get_column('biblionumber') );
 
         if (@biblionumbers) {
             my $indexer = Koha::SearchEngine::Indexer->new( { index => $Koha::SearchEngine::BIBLIOS_INDEX } );
@@ -633,22 +635,24 @@ sub apply_regex {
     my $modifiers = $params->{modifiers} || q{};
     my $value     = $params->{value};
 
-    $replace =~ s/"/\\"/g;              # Protection from embedded code
-    $replace = '"' . $replace . '"';    # Put in a string for /ee
     my @available_modifiers = qw( i g );
     my $retained_modifiers  = q||;
     for my $modifier ( split //, $modifiers ) {
         $retained_modifiers .= $modifier
             if grep { /$modifier/ } @available_modifiers;
     }
+
+    # The replacement is expanded as DATA (capture-group backreferences and the
+    # \n \r \t escapes) and never evaluated as code, so @{...}/${...}
+    # interpolation blocks are inert text, not Perl.
     if ( $retained_modifiers =~ m/^(ig|gi)$/ ) {
-        $value =~ s/$search/$replace/igee;
+        $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/ige;
     } elsif ( $retained_modifiers eq 'i' ) {
-        $value =~ s/$search/$replace/iee;
+        $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/ie;
     } elsif ( $retained_modifiers eq 'g' ) {
-        $value =~ s/$search/$replace/gee;
+        $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/ge;
     } else {
-        $value =~ s/$search/$replace/ee;
+        $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/e;
     }
 
     return $value;

Koha/Objects.pm

@@ -374,7 +374,7 @@ sub empty {
 
 Koha::Objects->reset();
 
-resets iteration so the next call to next() will start agein
+resets iteration so the next call to next() will start again
 with the first object in a set.
 
 =cut

Koha/Patron.pm

@@ -1038,7 +1038,7 @@ sub is_going_to_expire {
     return 0 unless $self->dateexpiry;
     return 0 if $self->dateexpiry =~ '^9999';
     return 1
-        if dt_from_string( $self->dateexpiry, undef, 'floating' )->subtract( days => $delay ) <
+        if dt_from_string( $self->dateexpiry, undef, 'floating' )->subtract( days => $delay ) <=
         dt_from_string( undef, undef, 'floating' )->truncate( to => 'day' );
     return 0;
 }

Koha/Patron/Restriction/Type.pm

@@ -55,7 +55,7 @@ sub delete {
             my $default = Koha::Patron::Restriction::Types->find( { is_default => 1 } )->code;
 
             # We can't use Koha objects here because Koha::Patron::Debarments
-            # is not a Koha object. So we'll do it old skool
+            # is not a Koha object. So we'll do it old school
             my $rows = C4::Context->dbh->do(
                 "UPDATE borrower_debarments SET type = ? WHERE type = ?",
                 undef, ( $default, $self->code )

Koha/Patrons.pm

@@ -716,7 +716,7 @@ sub filter_by_safe_to_delete {
         push @ids, $patron->borrowernumber
             if $patron->safe_to_delete;
     }
-    return Koha::Patrons->search( { borrowernumber => \@ids } );
+    return Koha::Patrons->search( { borrowernumber => { -in => \@ids } } );
 }
 
 =head3 extended_attributes_config
@@ -749,6 +749,10 @@ sub check_for_existing_matches {
         $match_conditions->{$field} = $new_patron_data->{$field} if $new_patron_data->{$field};
     }
 
+    # Without any usable conditions, Koha::Patrons->search would run
+    # unfiltered and match every patron in the system.
+    return { 'duplicate_found' => 0 } unless $match_conditions && %$match_conditions;
+
     my $patrons = Koha::Patrons->search($match_conditions);
     if ( $patrons->count > 0 ) {
         return {

Koha/Patrons/Import.pm

@@ -594,7 +594,7 @@ LINE: while ( my $borrowerline = <$handle> ) {
 
  my @csvcolumns = $self->prepare_columns({headerrow => $borrowerline, keycol => \%csvkeycol, errors => \@errors, });
 
-Returns an array of all column key and populates a hash of colunm key positions.
+Returns an array of all column key and populates a hash of column key positions.
 
 =cut
 

Koha/Plugins.pm

@@ -47,9 +47,10 @@ BEGIN {
     pop @INC if $INC[-1] eq '.';
 
     # Load plugins early to ensure they're available before any transactions begin
+    # Skip under "perl -c" to avoid C3 error when syntax checking plugins
     my $enable_plugins = C4::Context->config("enable_plugins") // 0;
 
-    if ($enable_plugins) {
+    if ( $enable_plugins && !$^C ) {
         require Koha::Plugins::Loader;
         Koha::Plugins::Loader->get_enabled_plugins();
     }
@@ -132,6 +133,12 @@ sub get_enabled_plugins {
     return Koha::Plugins::Loader->get_enabled_plugins();
 }
 
+=head3 _verbose
+
+Helper function to reduce verbosity in tests
+
+=cut
+
 sub _verbose {
     my $class = shift;
 
@@ -321,6 +328,14 @@ sub InstallPlugins {
     }
 
     foreach my $plugin_class (@plugin_classes) {
+
+        # Force a fresh load from disk. Without this, a long-lived Plack
+        # worker that already has the plugin loaded would rescan a stale
+        # symbol table during an upgrade, so plugin_methods ends up out of
+        # sync with the installed .pm (e.g. missing newly-added methods or
+        # retaining methods that were renamed or removed).
+        $self->_forget_plugin_class($plugin_class);
+
         if ( can_load( modules => { $plugin_class => undef }, verbose => $verbose, nocache => 1 ) ) {
             next unless $plugin_class->isa('Koha::Plugins::Base');
 
@@ -358,6 +373,43 @@ sub InstallPlugins {
     return @plugins;
 }
 
+=head3 _forget_plugin_class
+
+Force Perl to forget an in-memory plugin class, so a subsequent re-require
+picks up the .pm file as it currently exists on disk, rather than whatever
+was loaded into this worker previously.
+
+We deliberately do not use Symbol::delete_package here: it clears the
+whole symbol table, including any already-loaded packages nested under
+it (e.g. Koha::Plugin::Foo::Controller, bundled by the plugin in its own
+Koha/Plugin/Foo/Controller.pm). Since those keep their own %INC entry,
+they are never re-required afterwards and are left permanently blanked
+out. Module::Pluggable discovers them as their own entries in the plugin
+list regardless, so they get reloaded on their own turn; this helper
+only ever clears the target class's own symbols, leaving any nested
+packages alone.
+
+=cut
+
+sub _forget_plugin_class {
+    my ( $self, $plugin_class ) = @_;
+
+    return unless Class::Inspector->loaded($plugin_class);
+
+    no strict 'refs';    ## no critic (ProhibitNoStrict)
+    @{"${plugin_class}::ISA"} = ();
+    my $stash = \%{"${plugin_class}::"};
+    for my $symbol ( keys %$stash ) {
+        next if $symbol =~ /::\z/;    # leave nested packages alone
+        delete $stash->{$symbol};
+    }
+
+    ( my $plugin_inc_key = $plugin_class ) =~ s{::}{/}g;
+    delete $INC{"$plugin_inc_key.pm"};
+
+    return;
+}
+
 =head2 RemovePlugins
 
     Koha::Plugins->RemovePlugins( {
@@ -401,6 +453,13 @@ sub RemovePlugins {
     $class->_restart_after_change();
 }
 
+=head3 _restart_after_change
+
+Helper function to reload plack after a plugin change if the
+'plugins_restart' flag is enabled in the koha-conf.xml
+
+=cut
+
 sub _restart_after_change {
     my ( $class, $params ) = @_;
 

Koha/REST/V1/ERM/EHoldings/Titles/Local.pm

@@ -22,6 +22,7 @@ use Mojo::Base 'Mojolicious::Controller';
 use Koha::ERM::EHoldings::Titles;
 use Koha::BackgroundJob::CreateEHoldingsFromBiblios;
 use Koha::BackgroundJob::ImportKBARTFile;
+use Koha::SearchEngine::Indexer;
 
 use Scalar::Util qw( blessed );
 use Try::Tiny    qw( catch try );
@@ -95,6 +96,11 @@ sub add {
                 my $title = Koha::ERM::EHoldings::Title->new_from_api($body)
                     ->store( { create_linked_biblio => $create_linked_biblio } );
 
+                if ($create_linked_biblio) {
+                    my $indexer = Koha::SearchEngine::Indexer->new( { index => $Koha::SearchEngine::BIBLIOS_INDEX } );
+                    $indexer->index_records( $title->biblio_id, "specialUpdate", "biblioserver" );
+                }
+
                 $title->resources($resources);
 
                 my @extended_attributes =
@@ -161,6 +167,11 @@ sub update {
 
                 $title->set_from_api($body)->store( { create_linked_biblio => $create_linked_biblio } );
 
+                if ($create_linked_biblio) {
+                    my $indexer = Koha::SearchEngine::Indexer->new( { index => $Koha::SearchEngine::BIBLIOS_INDEX } );
+                    $indexer->index_records( $title->biblio_id, "specialUpdate", "biblioserver" );
+                }
+
                 $title->resources($resources);
                 my @extended_attributes =
                     map { { 'id' => $_->{field_id}, 'value' => $_->{value} } } @{$extended_attributes};

Koha/REST/V1/ILL.pm

@@ -19,6 +19,7 @@ use Modern::Perl;
 
 use Mojo::Base 'Mojolicious::Controller';
 
+use C4::Context;
 use Koha::Patrons;
 
 use Try::Tiny qw( catch try );
@@ -31,6 +32,26 @@ Koha::REST::V1::ILL
 
 =head2 Class methods
 
+=head3 config
+
+Return the configuration options needed for the ILL Vue app
+
+=cut
+
+sub config {
+    my $c = shift->openapi->valid_input or return;
+
+    return $c->render(
+        status  => 200,
+        openapi => {
+            settings => {
+                ILLModule      => C4::Context->preference('ILLModule'),
+                ILLPartnerCode => C4::Context->preference('ILLPartnerCode'),
+            },
+        },
+    );
+}
+
 =head3 list_users
 
 Return the list of possible ILL users

Koha/REST/V1/OAuth/Client.pm

@@ -66,10 +66,11 @@ sub login {
     }
 
     my $current_session;
+    my $session_id;
     my $current_session_cookie = $c->req->cookie('CGISESSID');
     if ($current_session_cookie) {
-        my $current_session_id = $current_session_cookie->value;
+        $session_id      = $current_session_cookie->value;
-        $current_session = Koha::Session->get_session( { sessionID => $current_session_id } );
+        $current_session = Koha::Session->get_session( { sessionID => $session_id } );
     }
 
     unless ( $provider_config && $provider_config->{authorize_url} ) {
@@ -91,10 +92,15 @@ sub login {
     if ($is_callback) {
 
         # callback, check CSRF token
+        unless ($session_id) {
+            my $error = "wrong_csrf_token";
+            return $c->redirect_to( $uri . "?auth_error=$error" );
+        }
+
         unless (
             Koha::Token->new->check_csrf(
                 {
-                    session_id => $c->req->cookie('CGISESSID')->value,
+                    session_id => $session_id,
                     token      => $c->param('state'),
                 }
             )
@@ -105,8 +111,14 @@ sub login {
         }
     } else {
 
-        # initial request, generate CSRF token
+        # initial request — create session if needed (IdP-initiated flow)
-        $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );
+        unless ($session_id) {
+            $current_session = Koha::Session->get_session( {} );
+            $session_id      = $current_session->id;
+            $c->cookie( CGISESSID => $session_id, { path => '/' } );
+        }
+
+        $state = Koha::Token->new->generate_csrf( { session_id => $session_id } );
 
         Koha::Auth::Identity::Referer->store_referer(
             {

Koha/Recalls.pm

@@ -24,8 +24,7 @@ use Koha::Database;
 use Koha::Recall;
 use Koha::DateUtils qw( dt_from_string );
 use Koha::Plugins;
-
+use Koha::Statistics;
-use C4::Stats qw( UpdateStats );
 
 use base qw(Koha::Objects);
 
@@ -191,7 +190,7 @@ sub add_recall {
         $item = Koha::Items->find($itemnumber);
 
         # add to statistics table
-        C4::Stats::UpdateStats(
+        Koha::Statistic->new(
             {
                 branch         => C4::Context->userenv->{'branch'},
                 type           => 'recall',
@@ -202,7 +201,7 @@ sub add_recall {
                 categorycode   => $checkout->patron->categorycode,
                 interface      => $interface,
             }
-        );
+        )->store();
 
         Koha::Plugins->call(
             'after_recall_action',

Koha/Regex/Replacement.pm

@@ -0,0 +1,199 @@
+package Koha::Regex::Replacement;
+
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <https://www.gnu.org/licenses>.
+
+use Modern::Perl;
+
+=head1 NAME
+
+Koha::Regex::Replacement - expand a regular-expression replacement string as data
+
+=head1 SYNOPSIS
+
+    use Koha::Regex::Replacement;
+
+    if ( $value =~ /$search/ ) {
+        my $text = Koha::Regex::Replacement::expand_template(
+            $replacement,      # the user-supplied replacement string
+            [ @{^CAPTURE} ],   # numbered capture groups from the match ($1 is element 0)
+            { %+ },            # named capture groups from the match
+        );
+    }
+
+=head1 DESCRIPTION
+
+Koha lets staff run regular-expression find and replace over MARC fields, item
+fields and call numbers. The replacement half of those substitutions used to be
+run through Perl's C<s///ee>, which evaluated the replacement as Perl code and
+so allowed arbitrary code execution (see bug 30233).
+
+Note: It was necessary to use C<s///ee> because Perl does not provide a native
+way of processing backreferences and backslash escapes in the replacement string
+at runtime. While this doesn't matter when running hard-coded regular expressions,
+it does make it difficult to support replacement strings provided by end users.
+
+Note: While the "expand_template" may seem bespoke, it works similarly to
+how Python's own template expansion works in Python's re.sub() regular
+expression substitution function:
+https://github.com/python/cpython/blob/3.15/Modules/_sre/sre.c#L3022
+
+This module expands the replacement string as B<data> instead of evaluating it.
+It walks the string once, from left to right, and only acts on the handful of
+placeholders a replacement legitimately contains:
+
+=over
+
+=item * numbered backreferences: C<$1> .. C<$n>, C<${n}>, and the older
+        C<\1> .. C<\9> form
+
+=item * named captures: C<$+{name}> and C<${name}>
+
+=item * the escapes C<\n>, C<\r> and C<\t>, plus C<\\> and C<\$> for a literal
+        backslash or dollar sign
+
+=back
+
+Every other character is copied through unchanged. Because the string is never
+evaluated, interpolation blocks such as C<@{[ ... ]}> and C<${ ... }> end up in
+the output as ordinary text rather than being run as Perl.
+
+Case-folding escapes (C<\U>, C<\L>, C<\u>, C<\l>, C<\E>) are deliberately left
+out. They are a display nicety rather than a requirement, and omitting them
+keeps this routine small and easy to follow. They can be added later if a real
+call-number or MARC workflow turns out to need them.
+
+=head1 FUNCTIONS
+
+=head2 expand_template
+
+    my $text = Koha::Regex::Replacement::expand_template( $replacement, \@captures, \%named_captures );
+
+Returns C<$replacement> with the placeholders listed above resolved. Numbered
+backreferences are looked up in C<\@captures> (element 0 is group 1, matching
+C<@{^CAPTURE}>) and named captures in C<\%named_captures> (matching C<%+>). A
+reference to a group that did not match, or to a name that is not present,
+expands to the empty string. The input is treated purely as data and is never
+run as code.
+
+=cut
+
+sub expand_template {
+    my ( $replacement, $captures, $named_captures ) = @_;
+    $captures       //= [];
+    $named_captures //= {};
+
+    my $output     = '';
+    my @characters = split //, $replacement;
+    my $position   = 0;
+
+    while ( $position < @characters ) {
+        my $character = $characters[$position];
+
+        # Backslash escapes: \n \r \t, the legacy \1 .. \9 backreference, and
+        # \\ or \$ for a literal backslash or dollar. Any other \X is emitted as
+        # a literal X, so a stray backslash can never introduce executable syntax.
+        if ( $character eq '\\' && $position + 1 < @characters ) {
+            my $escaped = $characters[ $position + 1 ];
+
+            if    ( $escaped eq 'n' ) { $output .= "\n"; }
+            elsif ( $escaped eq 'r' ) { $output .= "\r"; }
+            elsif ( $escaped eq 't' ) { $output .= "\t"; }
+            elsif ( $escaped =~ /[1-9]/ ) {    # legacy \1 .. \9 backreference
+                my $group_value = $captures->[ $escaped - 1 ];
+                $output .= defined $group_value ? $group_value : '';
+            } else {                           # \\ -> \, \$ -> $, any other \X -> X
+                $output .= $escaped;
+            }
+
+            $position += 2;
+            next;
+        }
+
+        if ( $character eq '$' ) {
+
+            # ${name} or ${number}: read up to the closing brace, then treat a
+            # number as a positional group and anything else as a named group.
+            if ( $position + 1 < @characters && $characters[ $position + 1 ] eq '{' ) {
+                my $scan = $position + 2;
+                my $name = '';
+                $name .= $characters[ $scan++ ] while $scan < @characters && $characters[$scan] ne '}';
+
+                if ( $scan < @characters ) {    # found the closing brace
+                    if ( $name =~ /^[0-9]+\z/ ) {
+                        my $group_value = $name >= 1 ? $captures->[ $name - 1 ] : undef;
+                        $output .= defined $group_value ? $group_value : '';
+                    } else {
+                        my $named_value = $named_captures->{$name};
+                        $output .= defined $named_value ? $named_value : '';
+                    }
+                    $position = $scan + 1;
+                    next;
+                }
+
+                # An unterminated ${ : emit the dollar literally and carry on.
+                $output .= '$';
+                $position += 1;
+                next;
+            }
+
+            # $+{name}: a named capture written with the %+ syntax.
+            if (   $position + 2 < @characters
+                && $characters[ $position + 1 ] eq '+'
+                && $characters[ $position + 2 ] eq '{' )
+            {
+                my $scan = $position + 3;
+                my $name = '';
+                $name .= $characters[ $scan++ ] while $scan < @characters && $characters[$scan] ne '}';
+
+                if ( $scan < @characters ) {
+                    my $named_value = $named_captures->{$name};
+                    $output .= defined $named_value ? $named_value : '';
+                    $position = $scan + 1;
+                    next;
+                }
+
+                $output .= '$';
+                $position += 1;
+                next;
+            }
+
+            # $1 .. $n: a plain numbered backreference (a run of digits after $).
+            if ( $position + 1 < @characters && $characters[ $position + 1 ] =~ /[0-9]/ ) {
+                my $scan         = $position + 1;
+                my $group_number = '';
+                $group_number .= $characters[ $scan++ ] while $scan < @characters && $characters[$scan] =~ /[0-9]/;
+
+                my $group_value = $group_number >= 1 ? $captures->[ $group_number - 1 ] : undef;
+                $output .= defined $group_value ? $group_value : '';
+                $position = $scan;
+                next;
+            }
+
+            # A lone $ that is not a backreference is a literal dollar sign.
+            $output .= '$';
+            $position += 1;
+            next;
+        }
+
+        # Anything that is not a recognised placeholder is copied verbatim.
+        $output .= $character;
+        $position += 1;
+    }
+
+    return $output;
+}
+
+1;

Koha/SIP2/Object.pm

@@ -46,8 +46,9 @@ This is the base class for SIP2 objects in the Koha library system.
 sub store {
     my ($self) = @_;
 
+    my $result = $self->SUPER::store;
     _update_config_timestamp();
-    return $self->SUPER::store;
+    return $result;
 }
 
 =head3 delete
@@ -59,8 +60,9 @@ sub store {
 sub delete {
     my ($self) = @_;
 
+    my $result = $self->SUPER::delete;
     _update_config_timestamp();
-    return $self->SUPER::delete;
+    return $result;
 }
 
 =head3 _update_config_timestamp

Koha/Schema/Result/ReportsDictionary.pm

@@ -75,7 +75,7 @@ SQL snippet for us in reports
   is_nullable: 1
   size: 6
 
-Koha module this definition is for Circulation, Catalog, Patrons, Acquistions, Accounts)
+Koha module this definition is for (Circulation, Catalog, Patrons, Acquisitions, Accounts)
 
 =cut
 
@@ -117,8 +117,8 @@ __PACKAGE__->add_columns(
 __PACKAGE__->set_primary_key("id");
 
 
-# Created by DBIx::Class::Schema::Loader v0.07049 @ 2021-01-21 13:39:29
+# Created by DBIx::Class::Schema::Loader v0.07051 @ 2026-06-11 18:54:31
-# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:7r8vJ2yWD3yQCyri+uNSRw
+# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:NEd9fYq1gJ8G+SvtDIF8Ng
 
 
 # You can replace this text with custom content, and it will be preserved on regeneration

Koha/Schema/Result/SipAccount.pm

@@ -148,6 +148,7 @@ Foreign key to sip_institutions.sip_institution_id
 =head2 holds_get_captured
 
   data_type: 'tinyint'
+  default_value: 1
   is_nullable: 1
 
 =head2 inhouse_item_types
@@ -297,7 +298,7 @@ __PACKAGE__->add_columns(
   "holds_block_checkin",
   { data_type => "tinyint", is_nullable => 1 },
   "holds_get_captured",
-  { data_type => "tinyint", is_nullable => 1 },
+  { data_type => "tinyint", default_value => 1, is_nullable => 1 },
   "inhouse_item_types",
   { data_type => "varchar", is_nullable => 1, size => 255 },
   "inhouse_patron_categories",
@@ -506,8 +507,8 @@ __PACKAGE__->belongs_to(
 );
 
 
-# Created by DBIx::Class::Schema::Loader v0.07051 @ 2026-04-24 16:44:37
+# Created by DBIx::Class::Schema::Loader v0.07053 @ 2026-08-11 14:14:39
-# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:nr/MwKeH6rrt/ekP3Zeqcw
+# DO NOT MODIFY THIS OR ANYTHING ABOVE! md5sum:X188nmexWCwsij/WO44ljA
 
 
 __PACKAGE__->add_columns(

Koha/SearchEngine/Elasticsearch.pm

@@ -58,6 +58,7 @@ use Search::Elasticsearch::Role::Cxn;
 }
 
 use Try::Tiny qw( catch try );
+use JSON::PP  ();
 use YAML::XS;
 
 use List::Util qw( sum0 );
@@ -272,6 +273,15 @@ sub get_elasticsearch_mappings {
             $mappings->{properties}{'match-heading'}             = _get_elasticsearch_field_config( 'search', 'text' );
             $mappings->{properties}{'subject-heading-thesaurus'} = _get_elasticsearch_field_config( 'search', 'text' );
         }
+
+        # Disable date and numeric detection to prevent Elasticsearch from
+        # auto-detecting field types in marc_data_array. Without this, a
+        # subfield value that looks like a date (e.g. "2024-01-15") causes
+        # ES to lock that subfield to type "date", and subsequent non-date
+        # values fail to index. (Bug 42485)
+        $mappings->{date_detection}    = JSON::PP::false;
+        $mappings->{numeric_detection} = JSON::PP::false;
+
         $all_mappings{ $self->index } = $mappings;
     }
     $self->sort_fields( \%{ $sort_fields{ $self->index } } );

Koha/SearchEngine/Elasticsearch/QueryBuilder.pm

@@ -609,7 +609,7 @@ our $koha_to_index_name = {
 };
 
 # Note that sears and aat map to 008/11 values here
-# but don't appear in C4/Headin/MARC21 thesaurus
+# but don't appear in C4/Heading/MARC21 thesaurus
 # because they don't have values in controlled field indicators
 # https://www.loc.gov/marc/authority/ad008.html
 our $thesaurus_to_value = {

Koha/SimpleMARC.pm

@@ -18,6 +18,9 @@ package Koha::SimpleMARC;
 use Modern::Perl;
 use base 'Exporter';
 
+use Koha::Exceptions;
+use Koha::Regex::Replacement;
+
 BEGIN {
     our @EXPORT_OK = qw(
         read_field
@@ -717,8 +720,6 @@ sub _modify_values {
 
     if ( $regex and $regex->{search} ) {
         my $replace = $regex->{replace};
-        $replace =~ s/"/\\"/g;              # Protection from embedded code
-        $replace = '"' . $replace . '"';    # Put in a string for /ee
         $regex->{modifiers} //= q||;
         my @available_modifiers = qw( i g );
         my $modifiers           = q||;
@@ -726,15 +727,20 @@ sub _modify_values {
             $modifiers .= $modifier
                 if grep { /$modifier/ } @available_modifiers;
         }
+        my $search = $regex->{search};
         foreach my $value (@$values) {
+
+            # The replacement is expanded as DATA (capture-group backreferences
+            # and the \n \r \t escapes) and never evaluated as code, so
+            # @{...}/${...} interpolation blocks are inert text, not Perl.
             if ( $modifiers =~ m/^(ig|gi)$/ ) {
-                $value =~ s/$regex->{search}/$replace/igee;
+                $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/ige;
             } elsif ( $modifiers eq 'i' ) {
-                $value =~ s/$regex->{search}/$replace/iee;
+                $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/ie;
             } elsif ( $modifiers eq 'g' ) {
-                $value =~ s/$regex->{search}/$replace/gee;
+                $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/ge;
             } else {
-                $value =~ s/$regex->{search}/$replace/ee;
+                $value =~ s/$search/Koha::Regex::Replacement::expand_template( $replace, [@{^CAPTURE}], {%+} )/e;
             }
         }
     }

Koha/Suggestion.pm

@@ -103,8 +103,12 @@ sub store {
 
             my $toaddress;
             if ( $emailpurchasesuggestions eq "BranchEmailAddress" ) {
+
+                # can be undef for branch=any suggestions
                 my $library = $result->library;
-                $toaddress = $library->inbound_email_address;
+                if ( $library && $library->inbound_email_address ) {
+                    $toaddress = $library->inbound_email_address;
+                }
             } elsif ( $emailpurchasesuggestions eq "KohaAdminEmailAddress" ) {
                 $toaddress = C4::Context->preference('ReplytoDefault')
                     || C4::Context->preference('KohaAdminEmailAddress');

Koha/Util/OpenDocument.pm

@@ -21,6 +21,7 @@ use Modern::Perl;
 
 use File::Basename    qw( dirname );
 use OpenOffice::OODoc qw( odfDocument odfWorkingDirectory );
+use Scalar::Util      qw(looks_like_number);
 
 use parent qw( Exporter );
 
@@ -70,6 +71,7 @@ sub generate_ods {
         for ( my $i = 0 ; $i < $nb_rows ; $i++ ) {
             for ( my $j = 0 ; $j < $nb_cols ; $j++ ) {
                 my $cellval = $input_rows[$i][$j];
+                $odf_doc->cellValueType( $odf_rows[$i], $j, 'float' ) if looks_like_number($cellval);
                 $odf_doc->cellValue( $odf_rows[$i], $j, $cellval );
             }
         }

Makefile.PL

@@ -393,23 +393,24 @@ my $target_map = {
     './virtualshelves'                                 => 'INTRANET_CGI_DIR',
 
     # ignore files and directories created by the install itself
-    './pm_to_blib'                               => 'NONE',
+    './pm_to_blib'                                => 'NONE',
-    './blib'                                     => 'NONE',
+    './blib'                                      => 'NONE',
-    '.git-blame-ignore-revs'                     => 'NONE',
+    '.git-blame-ignore-revs'                      => 'NONE',
-    './.github'                                  => 'NONE',
+    './.github'                                   => 'NONE',
-    '.prettierrc.js'                             => 'NONE',
+    '.prettierrc.js'                              => 'NONE',
-    '.sass-lint.yml'                             => 'NONE',
+    '.sass-lint.yml'                              => 'NONE',
-    '.scss-lint.yml'                             => 'NONE',
+    '.scss-lint.yml'                              => 'NONE',
-    'gulpfile.js'                                => 'NONE',
+    'gulpfile.js'                                 => 'NONE',
-    'package.json'                               => 'NONE',
+    'package.json'                                => 'NONE',
-    'yarn.lock'                                  => 'NONE',
+    'yarn.lock'                                   => 'NONE',
-    'cypress.config.ts'                          => 'NONE',
+    'cypress.config.ts'                           => 'NONE',
-    'tsconfig.json'                              => 'NONE',
+    'tsconfig.json'                               => 'NONE',
-    'webpack.config.js'                          => 'NONE',
+    'webpack.config.js'                           => 'NONE',
-    'rspack.config.js'                           => 'NONE',
+    'rspack.config.js'                            => 'NONE',
-    'eslint.config.mjs'                          => 'NONE',
+    'eslint.config.mjs'                           => 'NONE',
-    '.codespell-ignore'                          => 'NONE',
+    '.codespell-ignore'                           => 'NONE',
-    './koha-tmpl/intranet-tmpl/prog/js/vue/dist' => 'NONE',
+    './koha-tmpl/intranet-tmpl/prog/js/vue/dist'  => 'NONE',
+    './koha-tmpl/opac-tmpl/bootstrap/js/vue/dist' => 'NONE',
 };
 
 =head1 CONFIGURATION OPTIONS
@@ -675,11 +676,26 @@ get_file_map( $target_map, $dirtree, $file_map );
 
 #NOTE: List files generated by build-resources.PL, so that they're copied into blib for installation
 #INTRANET_TMPL_DIR
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/bookings.css'}     = 'blib/INTRANET_TMPL_DIR/prog/css/bookings.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/bookings-rtl.css'} = 'blib/INTRANET_TMPL_DIR/prog/css/bookings-rtl.css';
 $file_map->{'koha-tmpl/intranet-tmpl/prog/css/calendar.css'}     = 'blib/INTRANET_TMPL_DIR/prog/css/calendar.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/calendar-rtl.css'} = 'blib/INTRANET_TMPL_DIR/prog/css/calendar-rtl.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/edifact_interchange.css'} =
+    'blib/INTRANET_TMPL_DIR/prog/css/edifact_interchange.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/edifact_interchange-rtl.css'} =
+    'blib/INTRANET_TMPL_DIR/prog/css/edifact_interchange-rtl.css';
 $file_map->{'koha-tmpl/intranet-tmpl/prog/css/holds.css'}        = 'blib/INTRANET_TMPL_DIR/prog/css/holds.css';
-$file_map->{'koha-tmpl/intranet-tmpl/prog/css/installer.css'}    = 'blib/INTRANET_TMPL_DIR/prog/css/installer.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/holds-rtl.css'}    = 'blib/INTRANET_TMPL_DIR/prog/css/holds-rtl.css';
-$file_map->{'koha-tmpl/intranet-tmpl/prog/css/mainpage.css'}     = 'blib/INTRANET_TMPL_DIR/prog/css/mainpage.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/ill-requests.css'} = 'blib/INTRANET_TMPL_DIR/prog/css/ill-requests.css';
-$file_map->{'koha-tmpl/intranet-tmpl/prog/css/staff-global.css'} = 'blib/INTRANET_TMPL_DIR/prog/css/staff-global.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/ill-requests-rtl.css'} =
+    'blib/INTRANET_TMPL_DIR/prog/css/ill-requests-rtl.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/installer.css'}     = 'blib/INTRANET_TMPL_DIR/prog/css/installer.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/installer-rtl.css'} = 'blib/INTRANET_TMPL_DIR/prog/css/installer-rtl.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/mainpage.css'}      = 'blib/INTRANET_TMPL_DIR/prog/css/mainpage.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/mainpage-rtl.css'}  = 'blib/INTRANET_TMPL_DIR/prog/css/mainpage-rtl.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/staff-global.css'}  = 'blib/INTRANET_TMPL_DIR/prog/css/staff-global.css';
+$file_map->{'koha-tmpl/intranet-tmpl/prog/css/staff-global-rtl.css'} =
+    'blib/INTRANET_TMPL_DIR/prog/css/staff-global-rtl.css';
 
 #NOTE: The 'koha-tmpl/intranet-tmpl/prog/js/vue/dist' directory is now handled in the "top_targets" function
 
@@ -1926,7 +1942,11 @@ sub top_targets {
     #NOTE: Make move_compiled_js depend on pm_to_blib, so we have access to the blib directory
     #NOTE: Copy the generated vue dist files into the relevant blib
     $compile_step .= "move_compiled_js: compile_css_js pm_to_blib\n";
+    $compile_step .= "\t" . 'mkdir -p blib/INTRANET_TMPL_DIR/prog/js/vue/' . "\n";
     $compile_step .= "\t" . 'cp -r koha-tmpl/intranet-tmpl/prog/js/vue/dist blib/INTRANET_TMPL_DIR/prog/js/vue/' . "\n";
+    $compile_step .= "\t" . 'mkdir -p blib/OPAC_TMPL_DIR/bootstrap/js/vue/' . "\n";
+    $compile_step .=
+        "\t" . 'cp -r koha-tmpl/opac-tmpl/bootstrap/js/vue/dist blib/OPAC_TMPL_DIR/bootstrap/js/vue/' . "\n";
     $compile_step .= "\n";
 
     my $top_targets = $compile_step . "\n" . $inherited;

about.pl

@@ -871,10 +871,9 @@ sub elasticsearch_check {
             #       fetch the list of available indexes (e.g. plugins, etc)
             $es_status->{nodes} = $es_conf->{nodes};
             my $es = Search::Elasticsearch->new($es_conf);
-            my $es_status->{version} = $es->info->{version}->{number};
 
             foreach my $index (@indexes) {
-                my $index_count;
+                my $index_count = 0;
                 try {
                     $index_count = $es->indices->stats( index => $index )->{_all}{primaries}{docs}{count};
                 } catch {
@@ -910,6 +909,9 @@ sub elasticsearch_check {
                     };
             }
             $es_status->{running} = $es_running;
+            if ($es_running) {
+                $es_status->{version} = $es->info->{version}->{number};
+            }
 
             $template->param(
                 elasticsearch_status      => $es_status,

acqui/addorderiso2709.pl

@@ -176,7 +176,7 @@ if ( $op eq "" ) {
     #import selected lines
     $template->param( 'basketno' => $cgiparams->{'basketno'} );
 
-    # Budget_id is mandatory for adding an order, we just add a default, the user needs to modify this aftewards
+    # Budget_id is mandatory for adding an order, we just add a default, the user needs to modify this afterwards
     my $budgets = GetBudgets();
     if ( scalar @$budgets == 0 ) {
         die "No budgets defined, can't continue";

acqui/basket.pl

@@ -235,12 +235,12 @@ unless ( CanUserManageBasket( $loggedinuser, $basket, $userflags ) ) {
 # FIXME : the query->param('booksellerid') below is probably useless. The bookseller is always known from the basket
 # if no booksellerid in parameter, get it from basket
 # warn "=>".$basket->{booksellerid};
-my $op = $query->param('op') // 'list';
+our $op = $query->param('op') // 'list';
 
 our $confirm_pref = C4::Context->preference("BasketConfirmations") || '1';
 $template->param( skip_confirm_reopen => 1 ) if $confirm_pref eq '2';
 
-my @messages;
+our @messages = ();
 
 if ( $op eq 'cud-delete-order' ) {
     output_and_exit( $query, $cookie, $template, 'insufficient_permission' )

acqui/spent.pl

@@ -56,46 +56,60 @@ my ($unitprice_field) = C4::Budgets->FieldsForCalculatingFundValues();
 
 my $query = <<EOQ;
 SELECT
-    aqorders.biblionumber, aqorders.basketno, aqorders.ordernumber,
+    biblionumber,
-    quantity-quantityreceived AS tleft,
+    basketno,
-    budgetdate, entrydate,
+    ordernumber,
-    aqbasket.booksellerid,
+    tleft,
-    GROUP_CONCAT(DISTINCT itype SEPARATOR '|') as itypes,
+    budgetdate,
+    entrydate,
+    booksellerid,
+    itypes,
     title,
-    aqorders.invoiceid,
+    invoiceid,
-    aqinvoices.invoicenumber,
+    invoicenumber,
     quantityreceived,
     $unitprice_field,
     datereceived,
     aqbooksellers.name as vendorname
-FROM (aqorders, aqbasket)
+FROM
-LEFT JOIN biblio ON
+    (
-    biblio.biblionumber=aqorders.biblionumber
+    SELECT
-LEFT JOIN aqorders_items ON
+        aqorders.biblionumber, aqorders.basketno, aqorders.ordernumber,
-    aqorders.ordernumber = aqorders_items.ordernumber
+        quantity-quantityreceived AS tleft,
-LEFT JOIN items ON
+        budgetdate, entrydate,
-    aqorders_items.itemnumber = items.itemnumber
+        aqbasket.booksellerid,
-LEFT JOIN aqinvoices ON
+        GROUP_CONCAT(DISTINCT itype SEPARATOR '|') as itypes,
-    aqorders.invoiceid = aqinvoices.invoiceid
+        title,
-LEFT JOIN aqbooksellers ON
+        aqorders.invoiceid,
-    aqbasket.booksellerid = aqbooksellers.id
+        aqinvoices.invoicenumber,
-WHERE
+        quantityreceived,
-    aqorders.basketno=aqbasket.basketno AND
+        $unitprice_field,
-    budget_id=? AND
+        datereceived
-    datecancellationprinted IS NULL AND
+    FROM aqorders
-    datereceived IS NOT NULL
+    JOIN aqbasket ON aqorders.basketno=aqbasket.basketno
-    GROUP BY aqorders.biblionumber, aqorders.basketno, aqorders.ordernumber,
+    LEFT JOIN biblio ON
-             tleft,
+        biblio.biblionumber=aqorders.biblionumber
-             budgetdate, entrydate,
+    LEFT JOIN aqorders_items ON
-             aqbasket.booksellerid,
+        aqorders.ordernumber = aqorders_items.ordernumber
-             title,
+    LEFT JOIN items ON
-             aqorders.invoiceid,
+        aqorders_items.itemnumber = items.itemnumber
-             aqinvoices.invoicenumber,
+    LEFT JOIN aqinvoices ON
-             quantityreceived,
+        aqorders.invoiceid = aqinvoices.invoiceid
-             $unitprice_field,
+    WHERE
-             datereceived,
+        budget_id=? AND
-             aqbooksellers.name
+        datecancellationprinted IS NULL AND
-
+        datereceived IS NOT NULL
+        GROUP BY aqorders.biblionumber, aqorders.basketno, aqorders.ordernumber,
+                 tleft,
+                 budgetdate, entrydate,
+                 aqbasket.booksellerid,
+                 title,
+                 aqorders.invoiceid,
+                 aqinvoices.invoicenumber,
+                 quantityreceived,
+                 $unitprice_field,
+                 datereceived
+    ) orders LEFT JOIN aqbooksellers ON orders.booksellerid = aqbooksellers.id
 EOQ
 my $sth = $dbh->prepare($query);
 $sth->execute($bookfund);

admin/aqbudgetperiods.pl

@@ -1,7 +1,7 @@
 #!/usr/bin/perl
 
 # Copyright 2008 BibLibre, BibLibre, Paul POULAIN
-#                SAN Ouest Provence
+#                SAN Ouest Provence  # codespell:ignore
 #
 # This file is part of Koha.
 #

admin/check_parent_total.pl

@@ -91,7 +91,7 @@ else {
 
 # FIXME - we really need a better way to do this consistently
 # and across the board, be it bigints, Math::FixedPoint, a
-# modernized version of Math::Curency that isn't tied to the system
+# modernized version of Math::Currency that isn't tied to the system
 # locale, or something else.
 $total                 = sprintf( "%.2f", $total );
 $sub_unalloc           = sprintf( "%.2f", $sub_unalloc );

admin/smtp_servers.pl

@@ -107,6 +107,51 @@ if ( $op eq 'cud-add' ) {
             reason => 'invalid_id'
             };
     }
+} elsif ( $op eq 'cud-test_email' ) {
+    my $smtp_server_id = $input->param('smtp_server_id');
+    my $smtp_server;
+
+    $smtp_server = Koha::SMTP::Servers->find($smtp_server_id)
+        unless !$smtp_server_id;
+
+    if ($smtp_server) {
+        my $test_email_address = C4::Context->preference('KohaAdminEmailAddress');
+        my $smtp_transport     = $smtp_server->transport;
+
+        my $params = {
+            to        => $test_email_address,
+            from      => $test_email_address,
+            sender    => $test_email_address,
+            subject   => "Koha SMTP Test",
+            text_body => "Email is working."
+        };
+
+        my $email = Koha::Email->create($params);
+
+        try {
+            $email->send_or_die( { transport => $smtp_transport } );
+            push @messages,
+                {
+                type => 'message',
+                code => 'success_on_test'
+                };
+        } catch {
+            push @messages,
+                {
+                type => 'alert',
+                code => 'error_on_test'
+                };
+        };
+
+    } else {
+        push @messages,
+            {
+            type   => 'alert',
+            code   => 'error_on_test',
+            reason => 'invalid_id'
+            };
+    }
+    $op = 'list';
 } elsif ( $op eq 'cud-edit_save' ) {
 
     my $smtp_server_id = $input->param('smtp_server_id');

api/v1/swagger/definitions/action_log.yaml

@@ -67,4 +67,12 @@ properties:
       Patron object joined on `object` (only meaningful for MEMBERS,
       CIRCULATION, FINES and APIKEYS rows; only present if requested
       via x-koha-embed)
+  item:
+    type:
+      - object
+      - "null"
+    description: |
+      Item object derived from the itemnumber carried in `info` (only
+      meaningful for CIRCULATION rows; only present if requested via
+      x-koha-embed)
 additionalProperties: false

api/v1/swagger/definitions/checkout.yaml

@@ -5,7 +5,9 @@ properties:
     type: integer
     description: internally assigned checkout identifier
   patron_id:
-    type: integer
+    type:
+      - integer
+      - "null"
     description: Internal patron identifier
   item_id:
     type:

api/v1/swagger/definitions/ill_config.yaml

@@ -0,0 +1,7 @@
+---
+type: object
+properties:
+  settings:
+    type: object
+    description: List of sysprefs used for the ILL module
+additionalProperties: false

api/v1/swagger/paths/action_logs.yaml

@@ -67,6 +67,7 @@
           enum:
             - librarian
             - patron
+            - item
         collectionFormat: csv
     responses:
       "200":

api/v1/swagger/paths/ill_config.yaml

@@ -0,0 +1,38 @@
+---
+/ill/config:
+  get:
+    x-mojo-to: ILL#config
+    operationId: getILLconfig
+    description: This resource returns a list of options needed for the ILL Vue app. EXPERIMENTAL - DO NOT RELY on this, it is subject to change!
+    summary: get the ILL config
+    tags:
+      - ill_config
+    produces:
+      - application/json
+    responses:
+      200:
+        description: The ILL config
+        schema:
+          $ref: "../swagger.yaml#/definitions/ill_config"
+      400:
+        description: Bad request
+        schema:
+          $ref: "../swagger.yaml#/definitions/error"
+      403:
+        description: Access forbidden
+        schema:
+          $ref: "../swagger.yaml#/definitions/error"
+      500:
+        description: |
+          Internal server error. Possible `error_code` attribute values:
+
+          * `internal_server_error`
+        schema:
+          $ref: "../swagger.yaml#/definitions/error"
+      503:
+        description: Under maintenance
+        schema:
+          $ref: "../swagger.yaml#/definitions/error"
+    x-koha-authorization:
+      permissions:
+        ill: 1

api/v1/swagger/paths/patrons.yaml

@@ -615,7 +615,7 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        borrowers: "1"
+        borrowers: edit_borrowers
   delete:
     x-mojo-to: Patrons#delete
     operationId: deletePatron

api/v1/swagger/swagger.yaml

@@ -108,6 +108,8 @@ definitions:
     $ref: ./definitions/ill_backend.yaml
   ill_backends:
     $ref: ./definitions/ill_backends.yaml
+  ill_config:
+    $ref: ./definitions/ill_config.yaml
   ill_status:
     $ref: ./definitions/ill_status.yaml
   ill_request:
@@ -471,6 +473,8 @@ paths:
     $ref: "./paths/holds.yaml#/~1holds~1{hold_id}~1suspension"
   "/holds/{hold_id}/lowest_priority":
     $ref: "./paths/holds.yaml#/~1holds~1{hold_id}~1lowest_priority"
+  /ill/config:
+    $ref: ./paths/ill_config.yaml#/~1ill~1config
   /ill/backends:
     $ref: ./paths/ill_backends.yaml#/~1ill~1backends
   "/ill/backends/{ill_backend_id}":
@@ -1403,6 +1407,9 @@ tags:
   - description: "Manage ILL module batch statuses\n"
     name: ill_batchstatuses
     x-displayName: ILL batch statuses
+  - description: "Manage ILL configuration\n"
+    name: ill_config
+    x-displayName: ILL configuration
   - description: "Manage ILL requests\n"
     name: ill_requests
     x-displayName: ILL requests

catalogue/search.pl

@@ -556,7 +556,8 @@ if ( $@ || $error ) {
 }
 
 my $hits = $results_hashref->{$server}->{"hits"} // 0;
-if ( $hits == 0 && $basic_search ) {
+if ( $hits == 0 && $basic_search && $operands[0] !~ /^\".*\"$/ ) {
+    my $og_query = $query_desc;
     $operands[0] = '"' . $operands[0] . '"';    #quote it
     ## I. BUILD THE QUERY
     (
@@ -585,6 +586,10 @@ if ( $hits == 0 && $basic_search ) {
     };
     my $quoted_hits = $quoted_results_hashref->{$server}->{"hits"} // 0;
     if ($quoted_hits) {
+        $template->param(
+            quoted_hits => 1,
+            og_query    => $og_query,
+        );
         $results_hashref->{$server} = $quoted_results_hashref->{$server};
         $hits = $quoted_hits;
     }

cataloguing/addbiblio.pl

@@ -878,7 +878,7 @@ if ( $op eq "cud-addbiblio" ) {
 
     if ( $biblio && C4::Context->preference('marcflavour') eq 'MARC21' ) {
         my $fixed_length_info =
-            Koha::Biblio::Metadata::Extractor::MARC->new( { biblio => $biblio } )->check_fixed_length;
+            Koha::Biblio::Metadata::Extractor::MARC->new( { metadata => $record } )->check_fixed_length;
         $template->param( marc21_fixlen => $fixed_length_info ) if @{ $fixed_length_info->{failed} };
     }
 

cataloguing/value_builder/EXAMPLE.pl

@@ -23,7 +23,7 @@ use C4::Auth   qw( get_template_and_user );
 use C4::Output qw( output_html_with_http_headers );
 
 # Example of framework plugin new style.
-# It should define and return at least one and normally two anynomous
+# It should define and return at least one and normally two anonymous
 # subroutines in a hash ref.
 # REQUEST: If you copy this code to construct a new plugin, please REMOVE
 # all comments copied from this file.

circ/branchtransfers.pl

@@ -98,14 +98,21 @@ if ( $op eq "cud-KillWaiting" ) {
         $cancelled  = 1;
         $reqmessage = 1;
     }    # FIXME else?
+} elsif ( $op eq "cud-IgnoreHold" ) {
+    $ignoreRs   = 1;
+    $settransit = 1;
+    $op         = 'cud-transfer';
 } elsif ( $op eq "cud-SetTransit" ) {
     my $item       = $query->param('itemnumber');
     my $reserve_id = $query->param('reserve_id');
     ModReserveAffect( $item, $borrowernumber, 1, $reserve_id );
+    my $hold = Koha::Holds->find( { reserve_id => $reserve_id } );
     $ignoreRs   = 1;
     $settransit = 1;
     $reqmessage = 1;
     $trigger    = 'Reserve';
+    $op         = 'cud-transfer';
+    $tobranchcd = $hold->branchcode;
 } elsif ( $op eq 'cud-KillReserved' ) {
     my $biblionumber = $query->param('biblionumber');
     my $reserve_id   = $query->param('reserve_id');

circ/overdue.pl

@@ -352,7 +352,7 @@ if ($noreport) {
                 preferred_name => $data->{preferred_name},
                 middle_name    => $data->{middle_name},
                 cardnumber     => $data->{cardnumber},
-                title          => $data->{title}
+                title          => $data->{borrowertitle}
             },
             duedate                 => $data->{date_due},
             borrowernumber          => $data->{borrowernumber},

cpanfile

@@ -91,8 +91,8 @@ requires 'Net::Z3950::ZOOM', '1.16';
 requires 'Number::Format', '1.52';
 requires 'OpenOffice::OODoc', '2.125';
 requires 'PDF::API2', '2';
-requires 'PDF::Reuse', '0.36';
+requires 'PDF::Reuse', '0.43';
-requires 'PDF::Reuse::Barcode', '0.05';
+requires 'PDF::Reuse::Barcode', '0.09';
 requires 'PDF::Table', 'v0.9.3';
 requires 'POSIX', '1.09';
 requires 'Plack::Middleware::LogWarn', '0.001002';

debian/scripts/koha-create

@@ -138,6 +138,7 @@ generate_config_file() {
         -e "s#__TEMPLATE_CACHE_DIR__#$TEMPLATE_CACHE_DIR#g" \
         -e "s#__TIMEZONE__#$TIMEZONE#g" \
         -e "s#__BCRYPT_SETTINGS__#$BCRYPT_SETTINGS#g" \
+        -e "s#__ENCRYPTION_KEY__#$ENCRYPTION_KEY#g" \
         -e "s#__UPLOAD_PATH__#$UPLOAD_PATH#g" \
         -e "s#__TMP_PATH__#$TMP_PATH#g" \
         -e "s/__LOG_DIR__/\/var\/log\/koha\/$name/g" \
@@ -650,7 +651,7 @@ if [ "${CLO_ELASTICSEARCH_SERVER}" != "" ]; then
 fi
 
 BCRYPT_SETTINGS=$(htpasswd -bnBC 10 "" password | tr -d ':\n' | sed 's/$2y/$2a/');
-
+ENCRYPTION_KEY="$(pwgen -s 32 1)"
 
 if [ "$ENABLE_SRU" != "no" ]; then
     enable_sru_server

debian/scripts/koha-plack

@@ -367,6 +367,12 @@ set_action()
 
 _do_instance() {
     local name=$1
+    #NOTE: It's very important that PERL5LIB and KOHA_HOME are local
+    #      By being local, we keep the PERL5LIB and KOHA_HOME specific
+    #      to the instance that we're working on right now.
+    #      If you disagree, please look at BZ 25778 and BZ 43159.
+    local PERL5LIB=$PERL5LIB
+    local KOHA_HOME=$KOHA_HOME
 
     adjust_paths_git_install $name
     PERL5LIB=$PERL5LIB:$KOHA_HOME/installer:$KOHA_HOME/lib/installer

docs/teams.yaml

@@ -1565,30 +1565,31 @@ team:
     qa_manager:
       name: Martin Renvoize
     qa:
+      - name: Jonathan Druart
+      - name: Andrew Fuerste-Henry
       - name: Marcel de Rooy
       - name: Martin Renvoize
-      - name: Jonathan Druart
+      - name: Kyle M Hall
+      - name: Paul Derscheid
       - name: Laura Escamilla
       - name: Lucas Gass
-      - name: Tomás Cohen Arazi
-      - name: Lisette Scheer
       - name: Nick Clemens
-      - name: Paul Derscheid
-      - name: Emily Lamancusa
-      - name: David Cook
-      - name: Matt Blenkinsop
-      - name: Andrew Fuerste-Henry
-      - name: Brendan Lawlor
-      - name: Pedro Amorim
-      - name: Kyle M Hall
-      - name: Aleisha Amohia
-      - name: David Nind
-      - name: Baptiste Wojtkowski
-      - name: Jan Kissig
       - name: Katrin Fischer
+      - name: Baptiste Wojtkowski
+      - name: David Cook
+      - name: Lisette Scheer
+      - name: Emily Lamancusa
+      - name: Jan Kissig
       - name: Thomas Klausner
-      - name: Julian Maurice
+      - name: Brendan Lawlor
+      - name: David Nind
+      - name: Tomás Cohen Arazi
+      - name: Pedro Amorim
       - name: Owen Leonard
+      - name: John Vinke
+      - name: Matt Blenkinsop
+      - name: Alex Carver
+      - name: Victor Grousset
     documentation:
       name: David Nind
     documentation_team:
@@ -1671,3 +1672,82 @@ team:
       name: David Nind
     newsletter:
       name: Michael Kuhn
+  26.11:
+    manager:
+      name: Pedro Amorim
+    manager_assistants:
+      - name: Tomás Cohen Arazi
+      - name: Martin Renvoize
+    maintainer:
+      - version: 26.05
+        name: Lucas Gass
+      - version: 25.11
+        name: Baptiste Wojtkowski
+      - version: 25.05
+        name: "Wainui Witika-Park (Catalyst IT)"
+      - version: 24.11
+        name: Fridolin Somers
+    maintainer_assistants:
+      - version: 26.05
+        name: Jacob O'Mara
+      - version: 25.05
+        name: Alex Buckley & Aleisha Amohia (Catalyst IT)
+    qa_manager:
+      name: Lisette Scheer
+    qa:
+      - name: Lucas Gass
+      - name: Laura Escamilla
+      - name: Kyle M Hall
+      - name: Baptiste Wojtkowski
+      - name: Victor Grousset
+      - name: David Cook
+      - name: Andrew Fuerste-Henry
+      - name: Brendan Lawlor
+      - name: Thomas Klausner
+      - name: Paul Derscheid
+      - name: Jan Kissig
+      - name: Jacob O'Mara
+      - name: Nick Clemens
+      - name: Tomás Cohen Arazi
+      - name: Marcel de Rooy
+      - name: Emily Lamancusa
+      - name: Aleisha Amohia
+      - name: Martin Renvoize
+      - name: David Nind
+    security_manager:
+      - name: David Cook
+    te:
+      - area: Elasticsearch/OpenSearch
+        name: Fridolin Somers
+      - area: SIP2
+        name: Kyle M Hall
+      - area: EDI
+        name: Kyle M Hall
+      - area: POS
+        name: Martin Renvoize
+    bugwrangler:
+      - name: Michaela Sieber
+      - name: Laura Escamilla
+    documentation:
+      name: Aude Charillon
+    documentation_team:
+      - name: Caroline Cyr La Rose
+      - name: David Nind
+      - name: Philip Orr
+    meeting_facilitator:
+      - name: Paul Derscheid
+    ktd:
+      - name: Tomás Cohen Arazi
+      - name: Jonathan Druart
+    wiki:
+      - name: Thomas Dukleth
+      - name: George Williams
+    website:
+      - name: Lawrence O'Regan-Lloyd
+    newsletter:
+      name: Michael Kuhn
+    social_media:
+      name: David Nind
+    accessibility_advocates:
+      - name: Laura Escamilla
+      - name: Brendan Lawlor

installer/data/mysql/db_revs/240600014.pl

@@ -4,7 +4,7 @@ use Koha::Installer::Output qw(say_warning say_success say_info);
 return {
     bug_number  => "33363",
     description =>
-        "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggetions",
+        "Split suggestions_manage into three separate permissions for creating, updating, and deleting suggestions",
     up => sub {
         my ($args) = @_;
         my ( $dbh, $out ) = @$args{qw(dbh out)};

installer/data/mysql/db_revs/251200059.pl

@@ -28,9 +28,17 @@ return {
             }, undef, $local_number_map_id
             );
 
-            my $index_name = $Koha::SearchEngine::Elasticsearch::BIBLIOS_INDEX;
+            # We do want to update the mappings in the DB in case ES gets switched on
-            my $indexer    = Koha::SearchEngine::Elasticsearch::Indexer->new( { index => $index_name } );
+            # but just skip the ES engine update if ES not enabled
-            $indexer->update_mappings();
+            my $searchengine =
+                $dbh->selectrow_array(q|SELECT value FROM systempreferences WHERE variable = 'SearchEngine'|);
+            if ( $searchengine eq 'Elasticsearch' ) {
+                my $index_name = $Koha::SearchEngine::Elasticsearch::BIBLIOS_INDEX;
+                my $indexer    = Koha::SearchEngine::Elasticsearch::Indexer->new( { index => $index_name } );
+                $indexer->update_mappings();
+            } else {
+                say $out "ES disabled, mappings not updated";
+            }
             say $out "Updated ES mappings to make local-number sortable";
         } elsif ( !defined $local_number_map_id ) {
             say_warning( $out, "No mapping defined for local-number" );

installer/data/mysql/db_revs/260500001.pl

@@ -0,0 +1,21 @@
+use Modern::Perl;
+use Koha::Installer::Output qw(say_warning say_success say_info);
+
+return {
+    bug_number  => "42764",
+    description => "Fix typo in reports_dictionary.report_area column comment",
+    up          => sub {
+        my ($args) = @_;
+        my ( $dbh, $out ) = @$args{qw(dbh out)};
+
+        $dbh->do(
+            q{
+            ALTER TABLE `reports_dictionary`
+            MODIFY COLUMN `report_area` varchar(6) DEFAULT NULL
+                COMMENT 'Koha module this definition is for (Circulation, Catalog, Patrons, Acquisitions, Accounts)'
+        }
+        );
+
+        say_success( $out, "Fixed typo in reports_dictionary.report_area column comment" );
+    },
+};

installer/data/mysql/db_revs/260501000.pl

@@ -0,0 +1,7 @@
+use Modern::Perl;
+
+return {
+    bug_number  => undef,
+    description => 'Koha 26.05.01 release',
+    up          => sub { },
+    }