# RELEASE NOTES FOR KOHA 24.11.08
26 Aug 2025
Koha is the first free and open source software library automation
package (ILS). Development is sponsored by libraries of varying types
and sizes, volunteers, and support companies from around the world. The
website for the Koha project is:
- [Koha Community](https://koha-community.org)
Koha 24.11.08 can be downloaded from:
- [Download](https://download.koha-community.org/koha-24.11.08.tar.gz)
Installation instructions can be found at:
- [Koha Wiki](https://wiki.koha-community.org/wiki/Installation_Documentation)
- OR in the INSTALL files that come in the tarball
Koha 24.11.08 is a bugfix/maintenance release.
It includes 20 enhancements, 180 bugfixes.
**System requirements**
You can learn about the system components (like OS and database) needed for running Koha on the [community wiki](https://wiki.koha-community.org/wiki/System_requirements_and_recommendations).
#### Security bugs
- [39906](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39906) Add bot challenge (in Apache layer)
- [40538](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40538) XSS in hold suspend modal in staff interface
>Fixes XSS vulnerability in suspend hold modal and suspend hold button by refactoring the Javascript that creates the HTML.
- [40579](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40579) CSV formula injection protection
## Bugfixes
### About
#### Critical bugs fixed
- [40370](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40370) about.pl should NOT say "Run the following SQL to fix the database"
#### Other bugs fixed
- [38988](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38988) If JobsNotificationMethod is not STOMP the about page shows as if there was a problem
>This fixes the messages displayed in About Koha "Server information" and "System information" tabs, depending on whether the RabbitMQ service is running and the options for the JobsNotificationMethod system preference. Previously, an error message was shown in the system information tab when the "Polling" option was selected and RabbitMQ was not running, when it shouldn't have.
>
>Expected behavour:
>- RabbitMQ running:
> . STOMP option: message broker shows as "Using RabbitMQ", no warnings in the system information tab
> . Polling option: message broker shows as "Using SQL polling", no warnings in the system information tab
>- RabbitMQ not running:
> . STOMP option: message broker shows as "Using SQL polling (Fallback, Error connecting to RabbitMQ)", error message shown in the system information tab
> . Polling option: message broker shows as "Using SQL polling", no warnings in the system information tab
- [40022](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40022) Release team 25.11
### Accessibility
#### Other bugs fixed
- [39209](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39209) Cookie consent banner should be 'focused' on load
- [40165](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40165) Incomplete logic for controlling display of OPAC language footer
**Sponsored by** *Athens County Public Libraries*
### Acquisitions
#### Critical bugs fixed
- [39754](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39754) Cannot scroll EANs when clicking 'Create EDIFACT order' in a basket
- [39878](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39878) EDIFACT vendor account records sets default port incorrectly for FTP
>This fixes the default upload and download ports when creating an EDI account (Koha administration > Acquisition parameters > EDI accounts > New account).
>
>If:
>- FTP is selected, it now defaults to port 21 (instead of port 22).
>- SFTP is selected, it defaults to port 22.
#### Other bugs fixed
- [39572](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39572) Create EDIFACT order button no longer forces librarians to review EAN to select
>This fixes the EDIFACT order confirmation message for a basket so that the EAN information is now included on the confirmation page ([a basket for a vendor] > Create EDIFACT order > [select EAN from dropdown list], with the BasketConfirmations system preference set to 'always ask for conformation').
>
>Previously, the `Create EDIFACT order` action would take librarians to a page to select the EDI Library EAN. Now, the EANs are included in a dropdown list for the action. This removed the chance to review the selected EAN to confirm it was correct. In addition, some libraries have dozens of Library EANs, making the button dropdown list cumbersome to use.
### Architecture, internals, and plumbing
#### Critical bugs fixed
- [34070](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34070) background_jobs_worker.pl floods logs when it gets error frames
#### Other bugs fixed
- [37305](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37305) Remove C4::Biblio::prepare_marc_host and use Koha::Biblio->generate_marc_host_field in preference
**Sponsored by** *Open Fifth*
- [38149](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38149) Make ESLint config compatible with version 9 and have ESLint and Prettier installed by default
>This fixes the Koha ESLint configuration (used for finding JavaScript errors) so that it is compatible with ESLint v9, changes the packages used so that ESLint and prettier are installed by default, and tidies some files that require updating after the prettier upgrade.
- [38167](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38167) ESLint: migrate config to flat format + cleanup some node dependencies
- [38546](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38546) prettierrc should set tabWidth and useTabs
>This fixes Koha's Prettier code formatter configuration file (.prettierrc.js) to set the default indentation to four spaces.
- [38770](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38770) Remove @vue/cli-service and babel
>This removes unused dependencies following the move from webpack to Rspack (Bug 37824 - added to Koha 24.11). They were blocking upgrading ESLint and Node.js
- [38966](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38966) Wrong POD in Koha/CoverImages.pm and Koha/Acquisition/Order/Claims.pm
- [38998](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38998) Cannot edit default SMTP server config when not using DB
- [39213](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39213) CGI::param called in list context from cataloguing/moveitem.pl
- [39214](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39214) Mock preferences in t/db_dependent/Koha/Session.t for subtest 'test session driver'
- [39392](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39392) Atomic update README references wrong file extension
- [39567](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39567) Move form-submit js into js includes files
>This moves form-submit JavaScript from individual template files and adds it to the global JavaScript include files for the staff interface and OPAC.
- [40003](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40003) Warning generated when creating a new bib record
>This removes an unnecessary warning from the logs when creating a new bibliographic record, and updates the tests.
- [40030](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40030) HTML should be escaped when viewing system preferences diff in Log viewer
- [40079](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40079) C4::Scrubber "note" profile should allow for list (ul, ol, li, dl, dt, and dd) HTML tags
>This adds unordered, ordered, and description list tags (
, ,
,
,
, and
) to the HTML that is allowed in notes fields (for example, course reserves staff and public notes).
- [40087](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40087) Remove unused C4::Scrubber profiles "tag" and "staff"
>This removes unused "tag" and "staff" scrubber profiles from the code for the scrubber module.
- [40242](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40242) Typo in Quotes module
>This fixes a typo in the code for the quote of the day tool (there were two =>).
- [40261](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40261) Tidy `build-git-snapshot`
- [40277](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40277) Warn in C4::Koha::GetAuthorisedValues()
>This fixes the cause of an unnecessary warning message[1] in the logs when searching the OPAC when not logged in. (This warning was occurring when the OpacAdvancedSearchTypes system preference was set to something other than "itemtypes", for example "loc".)
>
>[1] Warning message:
>[WARN] Use of uninitialized value $branch_limit in concatenation (.) or string at ...
### Cataloging
#### Critical bugs fixed
- [39848](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39848) Users without edit_catalogue permission can delete the record if no items remain from the batch item deletion tool
#### Other bugs fixed
- [19113](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19113) Barcode value builder not working with numeric branchcode
>This fixes the generation of item barcodes, where the autoBarcode system preference is set to "generated in the form yymm0001" and the library code is either a number or alphanumeric value. This automatically generated barcode format didn't work in this case, and the number generated would not automatically increment.
- [25015](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25015) Staff with 'Edit Iitems' permission currently can not edit Items attached to a fast add framework
- [31019](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31019) UNIMARC field help link when cataloging - update default URL
>This fixes the default UNIMARC field documentation link for the basic MARC editor - the help link now goes to https://www.ifla.org/g/unimarc-rg/unimarc-updates/. IFLA no longer provides field-level documentation pages for the UNIMARC format (as at December 2024), and the previous default links no longer work.
>
>It also:
>- makes minor formatting changes to improve consistency with the
> advanced editor:
> . the help link text is now [?], instead of ?
> . adds hover text for [?] - "Show help for this tag"
> . adds some additional spacing before the indicator fields
> . removes the '-' before the tag title
>- updates the MarcFieldDocURL system preference description
- [38895](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38895) In advanced editor, the fixed data helpers put '#' instead of space in record content
**Sponsored by** *Ignatianum University in Cracow*
- [39293](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39293) Remove box around subfield tag in basic editor
**Sponsored by** *Chetco Community Public Library*
- [39544](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39544) New / New record generates warnings in log
- [39570](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39570) Add item form includes itemnumber while adding a new item
**Sponsored by** *Chetco Community Public Library*
- [39871](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39871) Clearing item statuses with batch item modification tool does not work correctly
>This fixes a bug with the Batch item modification tool. Previously, if library staff tried to clear the items' not-for-loan, withdrawn, lost, or damaged status using the Batch item modification tool, the fields would not be cleared correctly. Depending on the database settings, the job might fail completely and the items wouldn't be modified at all, or else the status would be cleared, but the status date (such as withdrawn_on or itemlost_on) would not be cleared. Now the tool can be used to clear those fields, just like any other non-mandatory field.
- [40128](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40128) StripWhitespaceChars can create empty subfields
### Circulation
#### Critical bugs fixed
- [33284](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33284) checkout_renewals table retains checkout history in violation of patron privacy
>With the introduction of more fine-grained renewals tracking in "Checkout renewals should be stored in their own table", we inadvertently missed applying patron anonymization preferences.
>
>This bug corrects that by adding logic to ensure we follow a patrons preference for removing this data.
#### Other bugs fixed
- [31167](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31167) Only mark due dates in the past red on overdues report
>This fixes the overdues report (Circulation > Overdues > Overdues) so that when the "Show any items currently checked out" filter is selected, the due date is only shown in red for overdue items. Currently, the due date is in red for all items.
**Sponsored by** *Athens County Public Libraries*
- [37334](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37334) Cannot filter holdings table by status
>This restores the ability to filter the holdings table by status. This was lost when the holdings table was upgraded to use the REST API (added to Koha 24.05 by bug 33568).
- [39919](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39919) Overdues with fines report has incorrect title, breadcrumbs, etc.
**Sponsored by** *Athens County Public Libraries*
### Command-line Utilities
#### Critical bugs fixed
- [31124](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31124) koha-remove fails to remove long_tasks queue daemon, so koha-create for same user fails
>This development makes `koha-remove` stop all worker processes before attempting to remove the instance's UNIX user.
- [39694](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39694) `es_indexer_daemon.pl` doesn't use batch_size in DB poll mode
#### Other bugs fixed
- [23883](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23883) sip_cli_emulator.pl - typo in parameter name
- [38760](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38760) koha-mysql doesn't work with encrypted database connection
**Sponsored by** *Karlsruhe Institute of Technology (KIT)*
- [39250](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39250) Add archive_purchase_suggestions.pl to cron.daily commented
- [39301](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39301) pseudonymize_statistics.pl script generates too many background jobs
- [39961](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39961) koha-create doesn't start all queues
>This fixes the koha-create and koha-disable package commands so that they start and stop all the background job worker queues (including long_tasks).
- [40144](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40144) `sip_cli_emulator.pl` warnings
### Course reserves
#### Other bugs fixed
- [39078](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39078) Incorrect variable checks in course reserve details template
**Sponsored by** *Athens County Public Libraries*
### Database
#### Other bugs fixed
- [40109](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40109) Path to fix_invalid_dates.pl is incorrect in fix_invalid_dates.pl and search_for_data_inconsistencies.pl
>This fixes a path in a hint in the search for data inconsistencies script (search_for_data_inconsistencies.pl) - misc/cronjobs/fix_invalid_dates.pl should be misc/maintenance/fix_invalid_dates.pl.
### ERM
#### Other bugs fixed
- [38794](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38794) AggregatedFullText description should be Aggregated full text
>This fixes the authorized value description for AggregatedFullText in the ERM_PACKAGE_CONTENT_TYPE category. It updates the description from "Aggregated full" to "Aggregated full text".
- [39346](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39346) Only 20 additional fields can be added to an agreement
>This fixes adding a new agreement in the ERM module, where there are more than 20 additional fields. All additional fields are now listed, not just the first 20.
### Hold requests
#### Other bugs fixed
- [37650](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37650) Fix warn and remove FIXME in circ/returns.pl
- [39912](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39912) RealTimeHoldsQueue should be rebuilt when a holds pickup location is changed
- [40118](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40118) Regression - 'Holds to pull' library filters don't work
- [40122](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40122) 'Holds to pull' library filters don't work if library name contains parenthesis
>This fixes the holds to pull page so that the dropdown library filter works if the library name contains parenthesis (Circulation > Holds and bookings > Holds to pull).
### I18N/L10N
#### Other bugs fixed
- [38823](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38823) The word 'Reports' in ERM menu is not translatable
- [38900](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38900) Translation script explodes without a meaningful error when an "incorrect" structure is found
>This fixes the translation script so that it now provides a more meaningful error when updating a language that has incorrect strings. It now identifies exactly where the problem comes from, making it easier to fix the problem.
>
>An example of the updated error message:
>
> gulp po:update --lang LANG
> ..
> Incorrect structure found at ./koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt:230: '