All pull requests

Pull requests

• [Port to dtq-dev] Say Personal Access Token in the token e-mail

  #1614·jr-rk opened Nov 2, 2026·1 of 2 tasks·

  ·

• [Port to dtq-dev] Make the Czech submission form store the same values as the English one

  #1613·jr-rk opened Nov 2, 2026·1 of 2 tasks·

  ·

• [Port to dtq-dev] Expose repository description properties for the Terms of Service page

  #1612·jr-rk opened Nov 2, 2026·1 of 2 tasks·

  ·

• [Port to dtq-dev] Return 400 instead of 500 on anonymous licence download

  #1611·jr-rk opened Nov 2, 2026·1 of 2 tasks·

  ·

• Add a Docker deploy guide for CLARIN-DSpace v9

  #1592·milanmajchrak opened Oct 29, 2026Collaborator·9 of 10 tasks·

  ·

• ci: build Docker images on push to dtq-dev-767-base

  #1591·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] Backport GHSA-5xvx ItemExport path fix from upstream (DSpace#13085)

  #1590·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] Backport GHSA-4783-qprq-45x8 process authz from upstream (DSpace#13109)

  #1589·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base][v7→v9 adapted] fix(security): deny reads of ownerless CLARIN user records and anonymous CLARIN searches (port of #1492)

  #1588·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base][v7→v9 adapted] Fix 1083 finding 11: check READ + anonymous licence in clarinusermetadata manage/zip (port of #1558)

  #1587·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base][v7→v9 adapted] reject request-a-copy for a bitstream not in the item (dspace-customers#1092) (port of #1520)

  #1586·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base][v7→v9 adapted] fix(security): filter unreadable items/bitstreams from public usage statistics (port of #1540)

  #1585·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Fix dspace-customers#1083 R02: do not expose submitter e-mail in public handles/magic (port of #1531)

  #1584·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Fix dspace-customers 1083 R38: reject DOCTYPE in uploaded CMDI (port of #1533)

  #1583·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Fix dspace-customers 1083 R68: escape metadata in RefBox display text (port of #1534)

  #1582·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Fix dspace-customers 1083 R42: make previewContents admin-only (port of #1535)

  #1581·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Fix dspace-customers 1083 finding 6: limit server file upload to admins (port of #1536)

  #1580·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] Fix dspace-customers 1083 finding 9: check READ on the item resolved from the handle (port of #1557)

  #1579·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/fix: repair stale non-zero local.files.size in ItemFilesMetadataRepair (port of #1522)

  #1578·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Add missing authorization to workflow step link subresources (port of #1385)

  #1577·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/fix(workflow): allow workflow item expunge only for administrators (port of #1539)

  #1576·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] Fix dspace-customers 1083 V5: escape the identifier in the OAI GetRecord Solr query (port of #1543)

  #1575·Kasinhou opened Oct 29, 2026·

  ·
  

• [dtq-dev-9-base] UFAL/Fix dspace-customers#1083 V7: check bulk-access-control target uuids however they are spelled (port of #1544)

  #1574·Kasinhou opened Oct 29, 2026·

  ·
  

• fix(security): honor metadata.hide in CSV exports and add XPath regression tests

  #1562·Kasinhou opened Oct 27, 2026·

  ·
  3

  

• fix(security): block SSRF in OAI-ORE harvest ingestion (GHSA-qff6)

  #1561·Kasinhou opened Oct 27, 2026·

  ·
  5