July 2026 - Koha-bugs - lists.koha-community.org

[Bug 42044] New: Automatically update LDR/5 for modified records
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42044 Bug ID: 42044 Summary: Automatically update LDR/5 for modified records Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: MARC Bibliographic data support Assignee: koha-bugs(a)lists.koha-community.org Reporter: januszop(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org According to https://loc.gov/marc/bibliographic/bdleader.html, the 5th byte of the leader, Record status, could/should be system generated: "System-Generated Elements - Following Leader elements are usually system generated: [...] 05 Record status" Same for authority records. At present, Koha does not automatically update LDR/5 after a record has been modified. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 22

[Bug 39600] New: Paginate (and modernize) OPAC ILL requests table
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39600 Bug ID: 39600 Summary: Paginate (and modernize) OPAC ILL requests table Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: tadeusz(a)sosnierz.com QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com OPAC ILL table, as opposed to the Staff ILL table is using server-side rendering with no pagination. This proposes bringing it in line with its Staff equivalent, porting it to API+datatables and getting all the associated goodies along with it. Patch incoming. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 80

[Bug 40167] New: Curbside pickups - Show link if not configured
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40167 Bug ID: 40167 Summary: Curbside pickups - Show link if not configured Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Circulation Assignee: koha-bugs(a)lists.koha-community.org Reporter: tomascohen(a)gmail.com QA Contact: testopia(a)bugs.koha-community.org CC: gmcharlt(a)gmail.com, kyle.m.hall(a)gmail.com Right now, it displays a warning message when you navigate to Circulation > Curbside pickups, but don't have them configured for the current branch. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 14

[Bug 35553] New: No RENEWAL notice sent if renewed via OPAC without an all libraries notice
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35553 Bug ID: 35553 Summary: No RENEWAL notice sent if renewed via OPAC without an all libraries notice Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Notices Assignee: koha-bugs(a)lists.koha-community.org Reporter: lucas(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org To recreate: 1. Turn on RenewalSendNotice 2. In k-t-d delete copy the 'All libraries' RENEWAL notice to CPL. 3. Delete the all libraries notice. 4. Checkout an item from CPL, to a CPL patron, while logged in as CPL. 5. Make sure that patron's message pref are set so they will receive a RENEWAL notice. 6. Go to the OPAC account for that patron and renew the item. 7. The item is renewed but no notice is sent. 8. Check the logs and see something like: No circulation RENEWAL letter transported by email at /kohadevbox/koha/C4/Letters.pm line 603. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 2

[Bug 40901] New: koha-common.service bundles all sub-daemons under one systemd service instead of per-instance services
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40901 Bug ID: 40901 Summary: koha-common.service bundles all sub-daemons under one systemd service instead of per-instance services Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: tristin.stagg(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 217

[Bug 42375] New: Add OpenTelemetry to Koha
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42375 Bug ID: 42375 Summary: Add OpenTelemetry to Koha Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org We should add option support for OpenTelemetry instrumentation to Koha for tracing, metrics, and observability. Koha has no request-level observability. When a page is slow or a SIP connection hangs, the only option is manually correlating timestamps across Apache logs, Plack logs, MySQL slow-query logs, and syslog. This is painful, cumbersome, and often inaccurate or impossible. For example, the apache and plack logs aren't written to until the process is complete, so we can't use that to know which process/request has gone haywire and had to be killed. The closest we've come is to use strace to try divining what the process was doing based on the SQL queries we see in the strace output. Scripts can silently trigger hundreds ( or even hundreds of thousands ) of SQL queries for a single request. Without per-request profiling in production, these can go unnoticed until they cause outages ( Bug 42373 is an example of that ). Starman worker memory leaks and pool exhaustion are diagnosed post-mortem, not proactively. SIP2 is a black box. No per-message latency, no pool utilization metrics, and no trace linking SIP operations to underlying DB calls. Existing profiling tools (NYTProf et al) can't be used in production. Ideas: * Koha::Middleware::OpenTelemetry — Plack middleware creating a root span per request with HTTP semantic convention attributes plus Koha-specific context (koha.instance, koha.interface, koha.borrowernumber). Gated behind an OpenTelemetryEnabled system preference — zero cost when off. * DBI/DBIC span wrapping — child spans for database calls with query counts, timing, and sanitized statements. * Subsystem instrumentation SIP2, connex, background jobs, external HTTP calls. * External stuff like memcached, elastic, zebra, etc? Need to see what's out there for monitoring these already. * RED metrics per interface, worker pool gauges, connection pool utilization for plack/starman, sip, et al All configuration should follow standard OTel environment variables (OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_TRACES_SAMPLER, etc.). We might even add OpenMetrics support if necessary, but I think OpenTelemetry is a good first step. OpenTelemtry creates metrics, but OpenMetrics does not do things like observability. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 5

[Bug 42358] New: Add support to Plack::Middleware::SizeLimit
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42358 Bug ID: 42358 Summary: Add support to Plack::Middleware::SizeLimit Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org It seems like Plack::Middleware::SizeLimit would be useful to allow higher max requests while keeping memory usage down. It should be implemented in an optional manner. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 3

[Bug 42351] New: Add header for tracing API requests
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42351 Bug ID: 42351 Summary: Add header for tracing API requests Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: kyle(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com For debugging purposes, it would be useful to have Koha generate a UUID and send it in a header with each API request. It seems that X-Request-ID is a commonly used header. It might be useful to also send a header that indicates that Koha itself is making the request since X-Request-ID may imply that, but isn't explicit. Maybe we add an X-Koha-Origin header with a value of "koha", or maybe a single header with a more Koha-specific name like X-Koha-Request-ID. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 4

[Bug 42874] New: z3950_auth_search is loosing index parameter
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42874 Bug ID: 42874 Summary: z3950_auth_search is loosing index parameter Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Cataloging Assignee: koha-bugs(a)lists.koha-community.org Reporter: bibliothek(a)th-wildau.de QA Contact: testopia(a)bugs.koha-community.org CC: m.de.rooy(a)rijksmuseum.nl Target Milestone: --- When adding an authority from within creating/editing a biblio the index param, which identifies the initial MARC field to fill can get lost when using z39.50 search: - when using pagination from a results list - when clicking Try another search is used. To recreate: - edit f.e. 262: /cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=262 - go to tab 7 and create a new 700 field (click on icon next to ADDED ENTRY--PERSONAL NAME - click on the icon te search for an authority (next to Personal name input field - check that the popup has a param like &index=tag_700_subfield_a_13631_9534947903 - click create new authority * - click Z39.50/SRU search * - on a result list every 'import' button still has index (via hovering the import button) - click on Go to page 1 - see result list again BUT the 'import' buttons do not have index param anymore - click back in browser to be on the former result list - click 'try another search' - check that new URL does not have index param anymore * all URLs still have the param index Importing one of the results without the index param would not update and link the biblio you originally edited -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 7

[Bug 43030] New: Add generic own-resource (self-access) authorization to the REST API
by bugzilla-daemon＠bugs.koha-community.org 08 Jul '26

08 Jul '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43030 Bug ID: 43030 Summary: Add generic own-resource (self-access) authorization to the REST API Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: REST API Assignee: koha-bugs(a)lists.koha-community.org Reporter: martin.renvoize(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: tomascohen(a)gmail.com Target Milestone: --- This patch adds a generic mechanism for REST API endpoints to allow access to a caller's own resources without requiring the broader module permission (for example, a staff member managing their own lists, or viewing/editing their own patron record, without list_borrowers/edit_borrowers). Today, authorization is all-or-nothing: an endpoint's x-koha-authorization block requires a specific module permission, with no way to grant reduced access based on ownership of the record. Several controllers (Lists, AdvancedEditorMacro, Patrons/Password, Patrons/SelfRenewal) work around this today with inconsistent, ad hoc ownership checks that do not share a common implementation. This patch introduces: - Koha::Object->is_owned_by($patron) and Koha::Objects->owned_by($patron), a shared ownership interface implemented per class (identity based for Koha::Patron, owner field based for Koha::Virtualshelf) - An allow-owner flag on x-koha-authorization, checked in Koha::REST::V1::Auth, that admits an authenticated caller lacking the module permission when the resource is their own - Koha::REST::Plugin::Objects integration so objects.find and objects.search enforce/scope by ownership automatically, without each controller reimplementing the check, and while continuing to support paging, embeds, and existing query parameters - Write path guards so a caller admitted only via ownership cannot create a resource owned by someone else or reassign ownership away from themselves Permission continues to take priority: a caller who holds the module permission is unaffected and retains full, unrestricted access exactly as today. Ownership is only consulted for callers who lack the permission. Initial scope covers the Lists (virtualshelves) and Patrons endpoints, chosen to exercise both ownership shapes (owner field and identity match). Other existing ad hoc self checks are left as follow up work. Test plan: 1. Apply the patches and run the test suite for the affected modules: prove t/Koha/Object.t t/Koha/Objects.t t/db_dependent/Koha/Virtualshelves.t t/db_dependent/Koha/Patrons.t t/db_dependent/api/v1/patrons.t t/db_dependent/api/v1/lists.t 2. As a staff user without any list/shelf permission, confirm GET /api/v1/lists returns only your own lists, and GET /api/v1/lists/{id} succeeds for your own list and returns 403 for someone else's 3. As a staff user without borrowers permissions, confirm GET and PUT /api/v1/patrons/{patron_id} succeed for your own patron_id and return 403 for another patron_id 4. As a staff user with the relevant module permission, confirm both endpoints behave exactly as before (full, unrestricted access) 5. Confirm creating/updating a list while lacking the module permission cannot set the owner field to another patron -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14