Major bug fixes include:

• JSPUI security fixes: 
  • [MEDIUM SEVERITY] Cross-site scripting (XSS injection) is possible in JSPUI search interface (in Firefox web browser). (DS-2736
  Google Scholar fix:
  • Google Scholar metadata did not guarantee proper ordering of authors (DS-2679)
    [LOW SEVERITY] Possible to access files attached to "in-progress" submissions via a direct link (DS-2614 - requires a JIRA account to access for two weeks, and then will be public). : This vulnerability could allow anyone in the world to download a file attached to an "in-progress" submission if they are provided with a direct link to that file (from either UI). While a direct file link would be very hard to "guess" or stumble upon, this could allow an individual with deposit rights to make available content which has not been approved by local DSpace administrators. This vulnerability has at least existed since 5.0, but may effect versions as old as 3.0.
    • Discovered by Pascal-Nicolas Becker of Technische Universität Berlin
      
    someone to embed dangerous Javascript code into links to search results. If a user was emailed such a link and clicked it, the javascript would be run in their local browser. This vulnerability has existed since DSpace 3.x 
    • Discovered by Genaro Contreras
      
  • [LOW SEVERITY] Expression language injection (EL Injection) is possible in JSPUI search interface. (DS-2737 - requires a JIRA account to access for two weeks, and then will be public): This vulnerability could allow someone to obtain information from the site/server using JSP syntax. This vulnerability has existed since DSpace 3.x
    • Discovered by Genaro Contreras
      
• Google Scholar fix:
  • Google Scholar metadata did not guarantee proper ordering of authors (DS-2679)
• Search / Browse fixes (Discovery/Solr) for JSPUI and XMLUI:
  
  • Resolved a significant memory leak when searching/browsing (gradual leak) (DS-2869)
  • Resolved a significant memory spike when reindexing (only triggered when running "index-discovery" with no arguments) (DS-2832)
  • Fixes to allow fielded or boolean searches to work once again (DS-2699, DS-2803)
  Discovery / Solr fixes:
  • Solr logging was broken. It did not properly log to the "[dspace]/log/solr.log" files (DS-2790)
• OAI-PMH fixes:
  • Upgraded the XOAI library to 3.2.10 to resolve several issues
  • OAI did not support harvesting by date (YYYY-MM-DD) without a time (DS-2524, DS-2542) 
  • OAI getRecord was wrongly including all virtual sets (DS-2573)
  • OAI was ignoring the "dspace.oai.url" setting in "oai.cfg" (DS-2744)
• REST API fixes:
  • /handle not reflecting updates (DS-2692)

  • /collections/<id>/items ignores offset parameter (DS-2719)

  • login/logout thread safety (DS-2830)

• Deposit/Submission fixes:

  • Fix issue where if PubMed server is down submission lookup fails (DS-2813)

  • JSPUI: Allow reviewers to upload files (DS-2814)

• Minor fixes to XMLUI Mirage2 theme