RELEASE NOTES FOR KOHA 26.05.02

04 Aug 2026

Koha is the first free and open source software library automation
package (ILS). Development is sponsored by libraries of varying types
and sizes, volunteers, and support companies from around the world. The
website for the Koha project is:

• Koha Community

Koha 26.05.02 can be downloaded from:

• Download

Installation instructions can be found at:

• Koha Wiki
• OR in the INSTALL files that come in the tarball

Koha 26.05.02 is a bugfix/maintenance release.

It includes 3 enhancements, 54 bugfixes, and 8 bugfixes.

System requirements

You can learn about the system components (like OS and database) needed for running Koha on the community wiki.

Security bugs

• 30233 Remote code execution in user-supplied regex
  

  This change refactors the regular expression handling for Batch Item Modification, MARC Modification templates, and Callnumber splitting. It moves from Perl’s traditional compile-time regular expression handling to a more dynamic (but restrictive) run-time regular expression handling more similar to Python’s “sub” regex method. This functions to reduce vulnerabilities to code injection into Koha’s Perl backend.

• 42471 /cgi-bin/koha/suggestion/suggestion.pl Multiple Parameters Stored Cross-Site Scripting
• 42746 Stored SQL injection via unvalidated ‘agefield’ in automatic_item_modification_by_age (C4::Items::ToggleNewStatus)
• 42747 Stored SQL injection via patroncard layout image_name (patroncards/edit-layout.pl -> create-pdf.pl)
• 42749 SQL injection in acqui/parcels.pl via the orderby parameter (ORDER BY direction) reaching C4::Acquisition::GetInvoices
• 42847 SIP authentication ignored after initial successful connection
• 42866 SQL Injection in Koha/AdditionalContents.pm search_for_display via the patron lang value (stored / second-order, executed on issue-slip print, unvalidated string context, no placeholder)
• 43019 OPAC pages limited to library are readable by unauthenticated users

Bugfixes

About

Other bugs fixed

• 42453 “About Koha” breaks if Elasticsearch is used but unavailable

Accessibility

Other bugs fixed

• 42231 Fix accessibility issues in OPAC summary table
  

  This fixes some accessibility issues on the patron’s OPAC summary section: Form elements must have labels.

  • Checked out “Renew” checkbox: adds a hidden label for screen readers
  • Add note pop-up window for “Report a problem” (when the AllowCheckoutNotes
    system preference is enabled): adds a hidden label for screen readers

  It also hides the item title on the report a problem and suspend hold pop-up windows.

Acquisitions

Critical bugs fixed

• 42702 Acquisitions: Cancel order link on parcel.pl absorbs following HTML into href

Other bugs fixed

• 41070 No warning when filling no fund while importing in a basket from a file
  

  This fixes an issue when adding an order to a basket using the “From a new file” option.

  When adding an order from the staged file there was no warning if you didn’t select the fund in either the “Select to import” or “Default accounting details” tabs.

  Now there is a warning if you don’t select a fund: “Some funds are not defined in item records”.

• 41709 GIR segment data should be encoded in EDI ORDERsSponsored by OpenFifth
• 41803 Improvements to consistency in basket groups template
  

  This change makes updates to the basket groups template:

  • Action buttons in the basket group table’s “actions” column now
    have the class “btn btn-default btn-xs” (previously they were larger,
    yellow buttons, now they are smaller buttons with a light grey
    background)
  • Action buttons now have icons
  • Export action: there is now a dropdown list of export
    options (CSV and PDF)
  • Edit and delete actions: now use a class instead of an ID as a hook –
    this prevents duplicate element IDs on the page.
  • Generate EDIFACT order action: when there is no EDIFACT configuration,
    the action button is disabled and the error message is in a tooltip.
  • Warning messages styled as standard Bootstrap alerts

  Sponsored by Athens County Public Libraries

• 42645 ModSuggestion: FallbackToSMSIfNoEmail ignores EmailFieldPrimary/EmailFieldPrecedenceSponsored by OpenFifth

Architecture, internals, and plumbing

Other bugs fixed

• 42802 kohastructure.sql needs adjustments for mariadb 12.3

Cataloging

Other bugs fixed

• 40225 The –send-all option in the stockrotation job fails if there are no items to rotate at all
• 42531 Repeatable field values with long text do not wrap on staff record detail page
• 42846 Koha::Database::DataInconsistency typo for biblioitemnumber in MARC

Circulation

Other bugs fixed

• 41889 /checkouts?checked_in=1 errors when patron_id is null
• 42659 Multiple numbers and parts shown incorrectly on checkin screen

Command-line Utilities

Other bugs fixed

• 42640 Script search_for_data_inconsistencies.pl should use binmode UTF-8

ERM

Other bugs fixed

• 42825 ERM Local Title – Start date (started_on) not saved for package resources
  

  This fixes adding a title to a package when creating a new title for ERM – the start date for the title was not saved (ERM > eHoldings > Titles > New title > Packages > Add new package).

Hold requests

Other bugs fixed

• 42357 Holds table is missing patron name
  

  This fixes the holds table for a bibliographic record in the staff interface. It now shows the patron’s name in addition to the patron’s card number.

  (Use existing system HidePatronName system preference to hide patron names, for example for privacy reasons at circulation desks.)

• 42909 Suspend class missing from suspended holds on request.pl
  This fixes the holds table for a record in the staff interface to restore the “suspend” class to the table row for suspended holds, allowing styling by libraries.

ILL

Other bugs fixed

• 42397 ILL batches logged under ‘ILL’ action_logs modulename cause conflict with ILL requests
  

  This fixes an issue where ILL batch activity was incorrectly mixed with ILL request logs, causing a 500 error when viewing affected ILL requests.

• 42582 Uncaught TypeError on Place request with partner libraries when no z39.50 service is set

Installation and upgrade (command-line installer)

Critical bugs fixed

• 42795 Bug 40658 breaks CLI for 25.11

OPAC

Critical bugs fixed

• 42654 Regression: Section missing from OPAC course reserve detail page
  

  This fixes the course reserves page and navigation in the OPAC so that if a course has a value in the section field, then this value is now shown on the OPAC course detail page after the course name in the page title, breadcrumb, and main heading.

  Example: Course reserves for ‘Course name’ – Section

Other bugs fixed

• 42159 With OPACAuthorIdentifiersAndInformation information lacking from field 110/111
  

  This fixes the “Author information” tab in the OPAC details page so that it now shows information from authority records where:
  – the authority record 024 has identifier data, and
  – the identifiers option is selected for the OPACAuthorIdentifiersAndInformation system preference.

  The “Author information” tab now shows the authority record information where it is used in a bibliographic record’s 110 (Corporate name) and 111 (Meeting name).

• 42202 IndependentBranches shouldn’t filter public libaries in OPAC search, news, and most popular
  This fixes the OPAC library location filtering for logged in patrons when IndependentBranches is used.Logged in patrons now see the same options for library locations as unauthenticated patrons, for example:
  – Library pulldown for “All libraries” for the main search (OpacAddMastheadLibraryPulldown system preference)
  – Advanced search “Location and availability” option
  – Most popular from filter (OpacTopissue system preference)
  – News selector (OpacNewsLibrarySelect system preference)Previously, the library location options were not shown when a patron was logged in. This made no sense, as unauthenticated user can see all the libraries. (A logged in patron could also do a search and then filter by any library location.)
• 42721 Update OPACAuthorIdentifiersAndInformation description and identifier labels shown in the OPAC
  The fixes the OPACAuthorIdentifiersAndInformation system preference description so that identifiers are listed in alphabetical order.It also updates the identifier labels in the system preference description and what is shown in the OPAC:
  – ScopusID –> Scopus ID
  – WIKIDATA ID –> Wikidata ID

Patrons

Critical bugs fixed

• 42734 autoMemberNumValue syspref has no formal UI
  

  Superlibrarians can now view and manage the autoMemberNumValue system preference directly from the Patrons preferences page, allowing them to correct a runaway patron cardnumber counter without requiring vendor support. A caution note clarifies that the setting is automatically managed and should only be modified by experienced administrators, with warnings about the risk of duplicate cardnumbers and third-party account access if set incorrectly.

Other bugs fixed

• 42611 Javascript error on readingrec.pl when no reading history

REST API

Other bugs fixed

• 36988 PUT for patrons requires full borrowers permission, but should only require ‘edit_borrowers’
• 42739 OPAC ratings.js: Add CSRF-TOKEN header to fetch call

Reports

Critical bugs fixed

• 42360 SQL Injection in reports/acquisitions_stats.pl via Filter parameter
• 42363 SQL Injection in reports/catalogue_stats.pl via the Line request parameter
• 42368 SQL Injection in reports/issues_avg_stats.pl via the Filter request parameter (unvalidated string context, no placeholders)
• 42369 SQL Injection in reports/bor_issues_top.pl via the Filter request parameter (unvalidated string context, no placeholders)
• 42735 SQL Injection in reports/issues_stats.pl via PeriodTypeSel / PeriodDaySel / PeriodMonthSel / Filter parameters (unvalidated string context, no placeholders)

Other bugs fixed

• 12757 Integers in saved SQL report ODT export prepended with single quoteSponsored by OpenFifth
• 42550 JS error on saved SQL reports page when there are no reports
• 42803 Regression in Reports > Items with no checkouts (reports/catalogue_out.pl)

SIP2

Critical bugs fixed

• 42664 Changes to SIP2 accounts may not applied immediately

Staff interface

Other bugs fixed

• 42116 e.preventDefault is a function, needs parentheses
• 42535 Remove useless “news_delete” javascript in staff interface
• 42666 Next button in Item types and Patron categories does not work

System Administration

Other bugs fixed

• 42128 Move JS code from admin-icon-selection.inc to a separate .js fileSponsored by Athens County Public Libraries
• 42141 Design pattern introduced in 40191 does not work in staff SIP configuration
• 42641 JavaScript errors on patron attribute types admin page
  

  This fixes the “Patron attribute types” page (Administration > Patrons and circulation > Patron attribute types). The standard table was not showing correctly because of JavaScript errors. The table was not showing the standard navigation and other table elements:
  . “Showing X to X of X entries” (above and below the table)
  . Search filter
  . Export options
  . Sorting controls for the columns

Templates

Other bugs fixed

• 42707 Malformed Bootstrap dropdown in reports output
  

  This fixes the formatting of the patron card number (cardnumber) column in reports. It now uses the “dropdown-item” class and is formatted the same as other dropdown lists, such as borrowernumber.

  Sponsored by Athens County Public Libraries

Test Suite

Other bugs fixed

• 42862 bookingsModalDatePicker_spec.ts is failing

Z39.50 / SRU / OpenSearch Servers

Other bugs fixed

• 42321 Z3950/SRU Search should handle empty results from search targets better

Enhancements

I18N/L10N

Enhancements

• 40610 Update OPAC templates to improve ease of translationSponsored by Athens County Public Libraries

SIP2

Enhancements

• 42002 SIP screen msg regexp can’t be empty

Serials

Enhancements

• 42078 Allow vendor ID searches on serial subscription vendor search page

Documentation

The Koha manual is maintained in Sphinx. The home page for Koha
documentation is

• Koha Documentation
  As of the date of these release notes, the Koha manual is available in the following languages:
• English (USA)
• French (80%)
• German (85%)
• Greek (91%)
• Hindi (61%)

The Git repository for the Koha manual can be found at

• Koha Git Repository

Translations

Complete or near-complete translations of the OPAC and staff
interface are available in this release for the following languages:

Partial translations are available for various other languages.

The Koha team welcomes additional translations; please see

• Koha Translation Info

For information about translating Koha, and join the koha-translate
list to volunteer:

• Koha Translate List

The most up-to-date translations can be found at:

• Koha Translation

Release Team

The release team for Koha 26.05.02 is

• Release Manager: Pedro Amorim
• QA Manager: Lisette Scheer
• QA Team:
  • Marcel de Rooy
  • Martin Renvoize
  • Jonathan Druart
  • Laura Escamilla
  • Lucas Gass
  • Tomás Cohen Arazi
  • Lisette Scheer
  • Nick Clemens
  • Paul Derscheid
  • Emily Lamancusa
  • David Cook
  • Matt Blenkinsop
  • Andrew Fuerste-Henry
  • Brendan Lawlor
  • Pedro Amorim
  • Kyle M Hall
  • Aleisha Amohia
  • David Nind
  • Baptiste Wojtkowski
  • Jan Kissig
  • Katrin Fischer
  • Thomas Klausner
  • Julian Maurice
  • Owen Leonard
  • Lucas Gass
• Documentation Manager: Aude Charillon
• Documentation Team:
  • Philip Orr
  • Caroline Cyr La Rose
  • David Nind
  • Marion Durand
• Translation Manager: Jonathan Druart
• Wiki curators:
  • George Williams
  • Thomas Dukleth
• Release Maintainers:
  • 26.05 — Lucas Gass
  • 25.11 — Baptiste Wojtkowski
  • 25.05 — Wainui Witika-Park

Credits

We thank the following libraries, companies, and other institutions who are known to have sponsored
new features in Koha 26.05.02

We thank the following individuals who contributed patches to Koha 26.05.02

We thank the following libraries, companies, and other institutions who contributed
patches to Koha 26.05.02

We also especially thank the following individuals who tested patches
for Koha

We regret any omissions. If a contributor has been inadvertently missed,
please send a patch against these release notes to koha-devel@lists.koha-community.org.

Revision control notes

The Koha project uses Git for version control. The current development
version of Koha can be retrieved by checking out the main branch of:

• Koha Git Repository

The branch for this version of Koha and future bugfixes in this release
line is 26.05.x-security.

Bugs and feature requests

Bug reports and feature requests can be filed at the Koha bug
tracker at:

• Koha Bugzilla

He rau ringa e oti ai.
(Many hands finish the work)

Autogenerated release notes updated last on 04 Aug 2026 13:51:55.