RELEASE NOTES FOR KOHA 25.05.09

02 Apr 2026

Koha is the first free and open source software library automation
package (ILS). Development is sponsored by libraries of varying types
and sizes, volunteers, and support companies from around the world. The
website for the Koha project is:

• Koha Community

Koha 25.05.09 can be downloaded from:

• Download

Installation instructions can be found at:

• Koha Wiki
• OR in the INSTALL files that come in the tarball

Koha 25.05.09 is a bugfix/maintenance release.

It includes 12 enhancements, 33 bugfixes.

System requirements

You can learn about the system components (like OS and database) needed for running Koha on the community wiki.

Security bugs

• 41261 XSS vulnerability in opac/unAPI
  

  This change validates the inputs to “unapi” so that any invalid inputs will result in a 400 error or a response containing valid options for follow-up requests.

• 41594 Can access invoice-files.pl even when AcqEnableFiles is disabled
• 42048 Reflected XSS in patron search saved link

• 41261 XSS vulnerability in opac/unAPI

  This change validates the inputs to “unapi” so that any invalid inputs will result in a 400 error or a response containing valid options for follow-up requests.

• 41594 Can access invoice-files.pl even when AcqEnableFiles is disabled
• 42048 Reflected XSS in patron search saved link

Bugfixes

Acquisitions

Critical bugs fixed

• 41591 XSS vulnerability via file upload function for invoices

Other bugs fixed

• 41420 Syntax error in referrer in parcel.tt

  This fixes the URL for the “Cancel order and catalog record” link when receiving an order for an invoice – the referrer section of the URL was missing.

Architecture, internals, and plumbing

Critical bugs fixed

• 41617 CSV export from item search results – incorrect spaces after comma separator causes issues

  This fixes the CSV export from item search results in the staff interface (Search > Item search> Export select results (X) to CSV).

  It removes extra spaces after the comma separator, which causes issues when using the CSV file with some applications (such as Microsoft Excel).

Other bugs fixed

• 40995 Patron search autocomplete adds extraneous spacing and punctuation when patron lacks surname
• 41076 Perltidy config needs to be refined to not cause changes with perltidy 20250105

  26.05.00

Cataloging

Other bugs fixed

• 34879 ./catalogue/getitem-ajax.pl appears to be unused
• 41475 500 error when placing a hold on records with multiple 773 entries
• 41588 Link from 856$u breaks with leading or trailing spaces

  If a 856$u for a record had spaces before or after the URL, the link shown on the record page on the OPAC and staff interface (under ‘Online resources’) did not work.

  Depending on the browser, either nothing happened, or an error was shown that the site wasn’t reachable.

  Examples that previously caused links not to work (without the quotes):
  – ” koha-community.org”
  – “koha-community.org ”
  – ” koha-community.org “

Circulation

Other bugs fixed

• 41055 Missing accesskey attribute for print button (shortcut P)

  Sponsored by Koha-Suomi Oy

ERM

Other bugs fixed

• 41001 Dismissing the “Run now” modal breaks functionality

I18N/L10N

Other bugs fixed

• 41689 “Staff note” and “OPAC” message types in patron files untranslatable

ILL

Other bugs fixed

• 41465 Unauthenticated request does not display ‘type’ correctly
• 41478 AutoILLBackendPriority – Unauthenticated request shows backend form if wrong captcha
• 41512 ILLCheckAvailability stage table doesn’t render

  This fixes creating ILL requests when the ILLCheckAvailability system preference is used – the checking for availability was not completed and the table was not shown.

Notices

Other bugs fixed

• 40960 Only generate a notice for patrons about holds filled if they have set messaging preferences

  Currently, if a patron has not set any messaging preferences for notifying them about holds filled, a print notice is still generated.

  With this change, a notice is now only generated for a patron if their messaging preferences for ‘Hold filled’ are set. This matches the behavor for overdue and hold reminder notices.

OPAC

Critical bugs fixed

• 41662 CSRF-vulnerability in opac-patron-consent.pl.

Other bugs fixed

• 41128 ratings.js creating “undefined” text for screen readers and print output

Patrons

Other bugs fixed

• 41040 Empty patron search from the header should not trigger a patron search

  This fixes the “Search patrons” option in the staff interface menu bar. Currently, clicking “Search patrons” and then the arrow (without entering a value) automatically performs a search.

  With this change, a patron search is now no longer automatic. If you don’t enter anything, or don’t select any options, you are now prompted (using a tooltip) to enter a patron name or card number.

  NOTE: This is a change in behavour from what you may be used to.

• 41752 Guarantor first name and guarantor surname mislabeled in system preferences

REST API

Other bugs fixed

• 40219 Welcome Email Sent on Failed Patron Registration via API

  This fixes patron registrations using the API – a welcome email notice was sent even if there were validation failures.

SIP2

Other bugs fixed

• 41458 SIP passes UID instead of GID to Net::Server causing error

  This fixes an error that may occur when starting the SIP server: “…Couldn’t become gid ““: Operation not permitted…”. Koha was passing an incorrect value to the Net::Server “group” parameter.

Serials

Other bugs fixed

• 36466 Incorrect date value stored when “Published on” or “Expected on” are empty

  Editing a serial and removing the dates in the “Published on” and “Expected on” fields generated a 500 error (Serials > [selected serial] > Serial collection).

  This fixes the error and:
  – Sets the data in the database to NULL
  – Shows the dates as “Unknown” in the serial collection table for the “Date published” and “Date received” columns
  – Changes any existing 0000-00-00 dates in the database to NULL (for existing installations)

Staff interface

Critical bugs fixed

• 41593 Authenticated SQL Injection in staff side suggestions

Other bugs fixed

• 41422 New FilterSearchResultsByLoggedInBranch doesn’t fully translate

  This fixes the translatability of the text shown when the FilterSearchResultsByLoggedInBranch system preference is enabled, and also the check and what is shown only works when not translated.

• 41679 Stock rotation repatriation modal can conflict with holds modal

System Administration

Critical bugs fixed

• 41431 Circulation rule notes dropping when editing rule

  This fixes editing circulation and fine rules with notes – notes are now correctly shown when editing, and are not lost when saving the rule.

  Previously, if you edited a rule with a note, it was not displayed in the edit field and was removed when the rule was saved.

  Sponsored by Koha-Suomi Oy

Other bugs fixed

• 19690 Smart rules: Term “If any unavailable” is confusing

Templates

Other bugs fixed

• 41361 Incorrect markup in category code confirmation modal

  This fixes the “Confirm expiration date” dialog box that is shown when changing an individual patron’s category:

  • The “No” option now works.
  • It is now formatted using our standard Bootstrap 5 styles.

  Sponsored by Athens County Public Libraries

• 41764 ISSN hidden input missing from Z39.50 search form navigation

  This fixes the Acquisitions and Cataloging Z39.50 search forms so that the pagination works when searching using the ISSN input field.

  When you click the next page of results, or got to a specific result page, the search now works as expected – it remembers the ISSN you were searching for, with “You searched for: ISSN: XXXX” shown above the search results, and search results shown.

  Previously, the ISSN was not remembered, and “Nothing found. Try another search.” was shown, and no further search results were shown.

  Sponsored by Athens County Public Libraries

Test Suite

Other bugs fixed

• 41449 Reserves.t may fail when on shelf holds are restricted

Enhancements

Accessibility

Enhancements

• 39706 Accessibility: Missing text alternative for the star rating.

Architecture, internals, and plumbing

Enhancements

• 36674 Lazy load api-client JS files

Authentication

Enhancements

• 37711 IdP auto-register should work on the staff interface

  The ‘auto-register’ feature can now be enabled in the staff interface.

  Previously, this functionality was only available in the OPAC and could not be used from the staff side.

  Sponsored by ByWater Solutions

Command-line Utilities

Enhancements

• 40722 Add logging to reset of elastic mappings files when rebuilding elastic

MARC Bibliographic data support

Enhancements

• 29733 MARC21: Link 7xx linking fields to marc21_linking_section.pl value builder in sample frameworks
• 40272 Add an alert for incorrect (MARC21) fixed-length control fields

  This proposal adds an alert when opening the MARC basic editor while a control field (005-008) has an incorrect length.

OPAC

Enhancements

• 18148 Make list of lists in OPAC sortable

  When reviewing a list of public or private lists in the OPAC, users can now sort the list of lists by “List name” or “Modification date” in ascending or descending order.

• 41655 Local OPAC covers are not displayed in OPAC lists
  This fixes a regression where the local cover images were no longer displayed in lists in the OPAC and staff interface. With this fix, the local cover images are back in the lists in both interfaces.

Patrons

Enhancements

• 30568 Make patron name fields more flexible
• 32581 Update dateexpiry on categorycode change

Plugin architecture

Enhancements

• 40827 Update plugin wrapper to include context for method=”report”

  This enhancement updates the plugin wrapper to include the reports menu and have the breadcrumbs list reports instead of admin or tools when method=”report”

REST API

Enhancements

• 39816 Allow embedding days_late in baskets

  This development adds the ability to embed information on late days on the basket objects retrieved from the API.

Documentation

The Koha manual is maintained in Sphinx. The home page for Koha
documentation is

• Koha Documentation
  As of the date of these release notes, the Koha manual is available in the following languages:

• English (USA)

• French (80%)
• German (89%)
• Greek (93%)
• Hindi (63%)

The Git repository for the Koha manual can be found at

• Koha Git Repository

Translations

Complete or near-complete translations of the OPAC and staff
interface are available in this release for the following languages:

Partial translations are available for various other languages.

The Koha team welcomes additional translations; please see

• Koha Translation Info

For information about translating Koha, and join the koha-translate
list to volunteer:

• Koha Translate List

The most up-to-date translations can be found at:

• Koha Translation

Release Team

The release team for Koha 25.05.09 is

• Release Manager: Lucas Gass

• QA Manager: Martin Renvoize

• QA Team:

  • Marcel de Rooy
  • Martin Renvoize
  • Jonathan Druart
  • Laura Escamilla
  • Lucas Gass
  • Tomás Cohen Arazi
  • Lisette Scheer
  • Nick Clemens
  • Paul Derscheid
  • Emily Lamancusa
  • David Cook
  • Matt Blenkinsop
  • Andrew Fuerste-Henry
  • Brendan Lawlor
  • Pedro Amorim
  • Kyle M Hall
  • Aleisha Amohia
  • David Nind
  • Baptiste Wojtkowski
  • Jan Kissig
  • Katrin Fischer
  • Thomas Klausner
  • Julian Maurice
  • Owen Leonard

• Documentation Manager: David Nind

• Documentation Team:

  • Philip Orr
  • Aude Charillon
  • Caroline Cyr La Rose

• Translation Manager: Jonathan Druart

• Wiki curators:

  • George Williams
  • Thomas Dukleth

• Release Maintainers:

  • 25.11 — Jacob O’Mara
  • 25.05 — Laura Escamilla
  • 24.11 — Fridolin Somers
  • 22.11 — Wainui Witika-Park (Catalyst IT)

• Release Maintainer assistants:

  • 25.11 — Chloé Zermatten
  • 24.11 — Baptiste Wojtkowski
  • 22.11 — Alex Buckley & Aleisha Amohia

Credits

We thank the following libraries, companies, and other institutions who are known to have sponsored
new features in Koha 25.05.09

We thank the following individuals who contributed patches to Koha 25.05.09

We thank the following libraries, companies, and other institutions who contributed
patches to Koha 25.05.09

We also especially thank the following individuals who tested patches
for Koha

We regret any omissions. If a contributor has been inadvertently missed,
please send a patch against these release notes to koha-devel@lists.koha-community.org.

Revision control notes

The Koha project uses Git for version control. The current development
version of Koha can be retrieved by checking out the main branch of:

• Koha Git Repository

The branch for this version of Koha and future bugfixes in this release
line is 25.05.x-security.

Bugs and feature requests

Bug reports and feature requests can be filed at the Koha bug
tracker at:

• Koha Bugzilla

He rau ringa e oti ai.
(Many hands finish the work)

Autogenerated release notes updated last on 02 Apr 2026 15:20:53.