The digital scholarship infrastructure that universities and research libraries depend on just took a significant leap forward. On May 28, 2026, the DSpace community officially released DSpace 10, a major version that fuses the best of the traditional repository model with CRIS (Current Research Information System) capabilities, and delivers a raft of critical security patches that every system administrator should care about deeply.
If you manage IT services for a university library, run a research data repository, or are responsible for keeping your institution’s scholarly output discoverable and preserved, read on. This post walks you through everything: what DSpace is, what is truly new in version 10, who needs to act now, and how to execute the upgrade safely.
What Is DSpace?
DSpace is the world’s most widely deployed open-source digital repository platform. Developed and stewarded by a global community with backing from LYRASIS, it powers institutional repositories, research data archives, and open-access collections at hundreds of universities, national libraries, and research organizations worldwide—from MIT to institutions across Africa, Asia, and Latin America.
At its heart, DSpace is a turnkey, BSD-licensed digital asset management system built for the long-term preservation, management, and dissemination of digital content. It handles virtually every format: journal articles, theses and dissertations, research datasets, images, video, audio, and beyond. Its core capabilities include rich metadata management, granular access control, integration with persistent identifiers (DOIs, handles), OAI-PMH harvesting for interoperability, and powerful search and discovery.
The Modern Architecture
Since version 7, DSpace has operated as a clean two-tier architecture:
Java-Powered Backend
A robust REST API built on Spring Boot, exposing all repository operations. Data is persisted in PostgreSQL; full-text indexing and discovery run on Apache Solr.
Angular-Powered Frontend
A modern, responsive single-page application (SPA) with Server-Side Rendering, designed for accessibility, speed, and broad customization via a theming system.
Ecosystem Integrations
Native connectors to ORCID, OpenAIRE, ROR, CrossRef, and Sherpa/RoMEO—placing your repository squarely within the global open-science fabric.
Community-Driven & Free
No vendor lock-in. Full source code on GitHub. An active global community contributes features, fixes, translations, and support through forums and mailing lists.
This architecture gives institutions the freedom to customize deeply—branding, workflows, metadata schemas, integrations—while benefiting from a hardened, battle-tested foundation maintained by a worldwide contributor base.
What’s New in DSpace 10?
DSpace 10.0 is the most feature-rich release in the platform’s history. The headline story is the ongoing merger with DSpace-CRIS, a widely deployed community extension that transforms a repository into a full-fledged research information hub. But the improvements go far deeper than features alone.
The DSpace-CRIS Merger Continues
DSpace-CRIS has long allowed institutions to model not just content but the full research ecosystem: researchers, grants, projects, organizational units, and the relationships between them. Version 10 brings a significant tranche of those capabilities natively into DSpace, including enhancements to the authority framework, nested metadata groups, entity relationships, and more. The boundary between “repository” and “CRIS” is dissolving—deliberately.
New User & Administrative Features
Edit Items in Submission Mode
A new “Edit” menu on every Item page lets authorised users amend an existing record using the familiar submission form—no more backend workarounds for simple corrections.
Metadata-Level Security Controls
Individual metadata fields can now be toggled public or private per record. Ideal for researcher profiles where an email address or date of birth should remain hidden from public view.
Shared Workspaces
Collections can now enable shared workspaces, allowing multiple submitters to collaborate on in-progress submissions—a huge win for research teams and graduate programs.
UI-Based Submission Form Configuration
Select and assign submission forms to collections directly from the Angular admin UI via a dropdown. No more editing backend XML configuration files for this common task.
Custom URLs for Items
Replace UUID-based paths with human-readable, SEO-friendly permanent links. Custom URLs can be set manually or auto-generated from metadata—a significant boost for discoverability.
Social Sharing Bar
An optional sharing toolbar can now be enabled on homepages, search results, and item pages, letting users instantly share content to social networks and via email.
Built-in Content Management
The homepage header, footer, news section, and End User Agreement can all be edited directly through an admin UI with full HTML/Markdown support and multi-language translations.
Audit Trails
A configurable auditing system logs all changes to DSpace objects. Administrators can inspect and filter logs—essential for compliance, data governance, and institutional accountability.
Enhanced File Access Controls
A new download panel on item pages, plus the option to allow authors to access and download their own restricted or embargoed files—without needing administrator intervention.
Nested Metadata Groups
Group related metadata fields together—coupling author names with their affiliations, for instance—using new “group” and “inline-group” input types in submission forms.
Unified DOI Handling + Crossref
DSpace-generated DOIs are consistently stored in dc.identifier.doi; publisher DOIs in dc.relation.hasversion. A new doi-migrate command normalises legacy data. Crossref registration is now natively supported.
Dataset Entity Type
A first-class Dataset entity model has been added, strengthening DSpace’s position as a research data repository—not just a publications archive.
Asynchronous Batch Deletion
Large-scale deletions of Communities, Collections, and Items now run as background jobs, dramatically improving performance and preventing UI timeouts on high-volume repositories.
Catch-All Email for Development
Configure all outgoing emails to be routed to fixed “catch-all” recipients in development and staging environments—preventing accidental emails to real users during testing.
Critical Security Fixes
Beyond features, DSpace 10.0 is a mandatory security upgrade for any institution that has not already applied the recent patch releases. The following vulnerabilities have been addressed:
Security Advisories Resolved in DSpace 10.
Critical
CVE-2026-27739 (Angular SSR SSRF): A critical Server-Side Request Forgery vulnerability in Angular Server-Side Rendering. DSpace 10 upgrades to a patched Angular version and introduces the new ui > baseUrl configuration setting as an additional layer of protection.
Critical
CVE-2025-66516 / CVE-2025-54988 (Apache Tika XXE): A critical XML External Entity injection vulnerability in Apache Tika prior to 3.2.2, potentially exploitable by users with submitter privileges. All sites should run ./dspace filter-media -f -p "Text Extractor" after upgrading to purge potentially affected extracted text files.
High
GHSA-9×82-rm84-c6x7 (RCE in LDN/COAR Notify): Remote Code Execution possible via Velocity templates in Linked Data Notifications when COAR Notify is enabled.
Moderate
GHSA-9qm4-rh6w-pq5x & GHSA-v66x-68f2-pxf5 (Path Traversal): Path traversal vulnerabilities in LDN message generation and Curation Task Reporter output paths when COAR Notify is enabled.
Moderate
CVE-2025-53621 & CVE-2025-53622 (SAF Import XXE + Path Traversal): XXE injection and path traversal via Simple Archive Format imports. LDAP authentication has also been migrated to Spring LDAP to eliminate insecure JNDI usage.
Important note on backporting: Several of these security fixes were backported to DSpace 9.3, 8.4, and 7.6.7. However, DSpace 10.0 is the only release that combines all patches and all the new features. Running a patched older version remains a stopgap, not a long-term strategy.
DSpace 10.0 is the first release to make a clear institutional statement: your repository is not just a file cabinet—it is a living research intelligence hub.
Who Should Upgrade to DSpace 10?
The short answer: every institution running DSpace should plan for this upgrade. But the urgency and rationale differ by situation.
Urgent For – Institutions on Legacy 5.x or 6.x
If your repository still runs a pre-Angular version, it is fully end-of-life for both feature development and security support. You are exposed. Upgrading is not optional, it is a matter of institutional risk management.
Urgent For- Sites Exposed to COAR Notify or High-Privilege Submitters
The RCE vulnerability in LDN and the Apache Tika XXE flaw make DSpace 10.0 (or a patched 9.3/8.4) a security imperative for repositories with those features enabled or with open submission workflows.
Highly Recommended For- Universities Adopting a CRIS Model
If your library needs to connect publications, researchers, grants, and projects into a unified research intelligence system, DSpace 10’s native CRIS entities and authority framework provide this out-of-the-box.
Highly Recommended For-Libraries Burdened by IT Overhead
If your team spends hours editing backend XML to update a submission form or change homepage text, the new UI-driven administration in DSpace 10 will reclaim significant staff time.
Recommended
Recommended For -Research Data Repositories
The new Dataset entity type, nested metadata support, and enhanced access controls make DSpace 10 a significantly stronger platform for managing research data alongside traditional publications.
Recommended For- High-Volume Repositories
If deletions or batch operations routinely time out or degrade performance, the new asynchronous batch processing in DSpace 10 offers immediate, tangible relief.
A note for smaller, stable sites: Institutions on a recent, patched 9.x release with minimal customization and no pressing feature needs may choose a measured timeline. However, DSpace 10.0 represents the supported long-term path; delaying too long creates a larger, riskier migration gap.
How to Upgrade to DSpace 10
The DSpace team has designed the upgrade path to be as smooth as possible: you can upgrade from any prior version, and data migrations are handled automatically by Flyway on the backend. That said, careful preparation is everything. A staging environment run is non-negotiable.
Prerequisites
Before anything else, verify your server environment meets DSpace 10’s updated requirements:
| Component | Requirement | Notes |
|---|---|---|
| Java / JDK | JDK 21+ | Upgraded from JDK 17; minimum version enforced at build time |
| Node.js | v20.19+, v22.x, or v24.x | Required by Angular 20; earlier versions will not build |
| Angular | Angular 20 | Major version upgrade; review breaking changes carefully |
| PostgreSQL | Supported recent version | Flyway handles schema migrations automatically on first start |
| Apache Solr | Compatible version | Search core may need to be cleared and reindexed after upgrade |
| Apache Maven | Supported recent version | For compiling the backend source |
The Upgrade Roadmap
Read the Official Documentation First
Before touching anything, read the official Upgrading DSpace guide and the Installing DSpace page. The release notes list important breaking changes, especially around Angular standalone components and the new frontend baseUrl configuration.
Back Up Everything—Absolutely Everything
This is not a formality. Create verified backups of:
- Your full PostgreSQL database (pg_dump)
- The entire asset store (where bitstreams live)
- All configuration directories, custom themes, and local overlays
- Your existing Solr index cores
Upgrade the Backend (REST API)
Download the DSpace 10.0 backend source from GitHub (dspace-10.0 release tag). Carefully merge your local customizations and local.cfg into the new configuration structure—pay attention to DOI metadata mapping changes (publisher DOIs now belong in dc.relation.hasversion). Build with Maven, then run:
# Run the automatic database schema migration ./dspace database migrate # After upgrade: recreate text-extracted files (security measure) ./dspace filter-media -f -p "Text Extractor"
Upgrade the Frontend (Angular UI)
Download the corresponding dspace-angular 10.0 release. This step is mandatory; many bug fixes and security patches only work when both backend and frontend are on version 10. Key changes to make:
- Add the new
ui > baseUrlsetting inconfig.production.ymlmatching yourdspace.ui.url(required for SSR and CVE-2026-27739 mitigation) - Remove all
standalone: truedeclarations from custom Angular components (Angular 20 breaking change) - Update your theme configuration to the new 10.x format
- Rebuild with the required Node.js version and restart your server or PM2 process
Reindex Solr
DSpace 10.0 includes schema changes to the Solr search core. You will need to clear and fully reindex for search to function correctly:
# Clear the existing Solr search core and reindex all content ./dspace index-discovery -b
On large repositories, this process takes time. Schedule it during low-traffic hours and monitor progress.
Test Thoroughly on Staging—Before Going Live
Run the complete upgrade on a staging server first. Test the following specifically:
- Submission forms: verify the new UI-based configuration works for your collections
- Custom URLs: confirm existing handles and custom paths resolve correctly
- Themes and UI customizations: check for visual regressions
- All external integrations: ORCID, DOI providers, LDAP/Shibboleth authentication
- Solr search and faceted discovery on a representative data sample
- File downloads, access controls, and embargoes
Alternative: Fresh Install + Data Migration
For institutions with complex customizations or major infrastructure changes, the DSpace team recommends installing DSpace 10 fresh on a new server and migrating your data across. See the official Migrating DSpace to a new server guide. This approach often produces a cleaner result and makes it easier to validate the migration in isolation.
Conclusion
DSpace 10.0 is a landmark release that reflects years of community investment and strategic vision. By progressively absorbing the DSpace-CRIS feature set, the platform is evolving from a document archive into a comprehensive, interconnected research intelligence system, one that connects people, outputs, projects, and organizations in a semantically rich, navigable hub.
The security fixes alone justify immediate action for many sites. The productivity gains from UI-driven administration will repay the upgrade effort for library IT teams within weeks. And the long-term trajectory—toward a unified open-source CRIS/repository platform—means that institutions upgrading now are investing in a foundation that will serve them for the next decade of digital stewardship.
Plan your upgrade, test it carefully, and join the community. The DSpace ecosystem is as active and welcoming as it has ever been.
