# RELEASE NOTES FOR KOHA 24.11.08 26 Aug 2025 Koha is the first free and open source software library automation package (ILS). Development is sponsored by libraries of varying types and sizes, volunteers, and support companies from around the world. The website for the Koha project is: - [Koha Community](https://koha-community.org) Koha 24.11.08 can be downloaded from: - [Download](https://download.koha-community.org/koha-24.11.08.tar.gz) Installation instructions can be found at: - [Koha Wiki](https://wiki.koha-community.org/wiki/Installation_Documentation) - OR in the INSTALL files that come in the tarball Koha 24.11.08 is a bugfix/maintenance release. It includes 20 enhancements, 180 bugfixes. **System requirements** You can learn about the system components (like OS and database) needed for running Koha on the [community wiki](https://wiki.koha-community.org/wiki/System_requirements_and_recommendations). #### Security bugs - [39906](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39906) Add bot challenge (in Apache layer) - [40538](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538) XSS in hold suspend modal in staff interface >Fixes XSS vulnerability in suspend hold modal and suspend hold button by refactoring the Javascript that creates the HTML. - [40579](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40579) CSV formula injection protection ## Bugfixes ### About #### Critical bugs fixed - [40370](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40370) about.pl should NOT say "Run the following SQL to fix the database" #### Other bugs fixed - [38988](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38988) If JobsNotificationMethod is not STOMP the about page shows as if there was a problem >This fixes the messages displayed in About Koha "Server information" and "System information" tabs, depending on whether the RabbitMQ service is running and the options for the JobsNotificationMethod system preference. Previously, an error message was shown in the system information tab when the "Polling" option was selected and RabbitMQ was not running, when it shouldn't have. > >Expected behavour: >- RabbitMQ running: > . STOMP option: message broker shows as "Using RabbitMQ", no warnings in the system information tab > . Polling option: message broker shows as "Using SQL polling", no warnings in the system information tab >- RabbitMQ not running: > . STOMP option: message broker shows as "Using SQL polling (Fallback, Error connecting to RabbitMQ)", error message shown in the system information tab > . Polling option: message broker shows as "Using SQL polling", no warnings in the system information tab - [40022](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40022) Release team 25.11 ### Accessibility #### Other bugs fixed - [39209](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39209) Cookie consent banner should be 'focused' on load - [40165](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40165) Incomplete logic for controlling display of OPAC language footer **Sponsored by** *Athens County Public Libraries* ### Acquisitions #### Critical bugs fixed - [39754](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39754) Cannot scroll EANs when clicking 'Create EDIFACT order' in a basket - [39878](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39878) EDIFACT vendor account records sets default port incorrectly for FTP >This fixes the default upload and download ports when creating an EDI account (Koha administration > Acquisition parameters > EDI accounts > New account). > >If: >- FTP is selected, it now defaults to port 21 (instead of port 22). >- SFTP is selected, it defaults to port 22. #### Other bugs fixed - [39572](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39572) Create EDIFACT order button no longer forces librarians to review EAN to select >This fixes the EDIFACT order confirmation message for a basket so that the EAN information is now included on the confirmation page ([a basket for a vendor] > Create EDIFACT order > [select EAN from dropdown list], with the BasketConfirmations system preference set to 'always ask for conformation'). > >Previously, the `Create EDIFACT order` action would take librarians to a page to select the EDI Library EAN. Now, the EANs are included in a dropdown list for the action. This removed the chance to review the selected EAN to confirm it was correct. In addition, some libraries have dozens of Library EANs, making the button dropdown list cumbersome to use. ### Architecture, internals, and plumbing #### Critical bugs fixed - [34070](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34070) background_jobs_worker.pl floods logs when it gets error frames #### Other bugs fixed - [37305](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37305) Remove C4::Biblio::prepare_marc_host and use Koha::Biblio->generate_marc_host_field in preference **Sponsored by** *Open Fifth* - [38149](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38149) Make ESLint config compatible with version 9 and have ESLint and Prettier installed by default >This fixes the Koha ESLint configuration (used for finding JavaScript errors) so that it is compatible with ESLint v9, changes the packages used so that ESLint and prettier are installed by default, and tidies some files that require updating after the prettier upgrade. - [38167](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38167) ESLint: migrate config to flat format + cleanup some node dependencies - [38546](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38546) prettierrc should set tabWidth and useTabs >This fixes Koha's Prettier code formatter configuration file (.prettierrc.js) to set the default indentation to four spaces. - [38770](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38770) Remove @vue/cli-service and babel >This removes unused dependencies following the move from webpack to Rspack (Bug 37824 - added to Koha 24.11). They were blocking upgrading ESLint and Node.js - [38966](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38966) Wrong POD in Koha/CoverImages.pm and Koha/Acquisition/Order/Claims.pm - [38998](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38998) Cannot edit default SMTP server config when not using DB - [39213](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39213) CGI::param called in list context from cataloguing/moveitem.pl - [39214](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39214) Mock preferences in t/db_dependent/Koha/Session.t for subtest 'test session driver' - [39392](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39392) Atomic update README references wrong file extension - [39567](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39567) Move form-submit js into js includes files >This moves form-submit JavaScript from individual template files and adds it to the global JavaScript include files for the staff interface and OPAC. - [40003](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40003) Warning generated when creating a new bib record >This removes an unnecessary warning from the logs when creating a new bibliographic record, and updates the tests. - [40030](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40030) HTML should be escaped when viewing system preferences diff in Log viewer - [40079](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40079) C4::Scrubber "note" profile should allow for list (ul, ol, li, dl, dt, and dd) HTML tags >This adds unordered, ordered, and description list tags (