SobekCM Repository Community Help
SobekCM Repository

SobekCM Current Version Notes

 

These are notes for version 5.2.0 which was released to the open source community on September 23rd, 2026.

How to install the latest SobekCM

Release notes on previous versions of SobekCM can be found here.

Summary

SobekCM 5.2.0 introduces several new features focused on communication, collection management, localization, security, and system reliability. Libraries can now publish targeted news banners to selected audiences, with scheduling and dedicated News Administrator roles. Collection administrators gain more control over which metadata fields appear in search results, while expanded web-skin directives and significant localization improvements provide a more consistent multilingual experience throughout the system.

This release also adds substantial new protections against automated crawlers, AI scrapers, and abusive traffic, including adaptive rate limiting, improved bot identification, expiring resource URLs, and emergency access controls. User administration has also been expanded with account deactivation, protected system accounts, and additional options for institutions using SSO. User registration can also be configured to screen robots via Cloudflare Turnstile. Normally, you will hardly notice it, but if the system suspects a robot registration, they will be presented with a captcha before they can submit.

Behind the scenes, SobekCM 5.2.0 includes numerous reliability and concurrency fixes, improved Solr input handling, expanded automated Playwright testing, post-upgrade smoke testing, and new monitoring and exception-analysis infrastructure. Together, these changes improve the stability, security, manageability, and day-to-day experience of SobekCM for both repository administrators and users.

 

New Features

Site News & Administration

In this version, we added the ability to display news banners to selected users of your digital library. We are interested to see how you utilize this new feature. If you want some help setting it up for the first time, please reach out to us!

  1. Added the ability to set an HTML-based news banner on your site and control the audience, including a start and end date.
  2. Once users close a banner, it will not be shown to them again.
  3. If you choose to show the banner to anonymous users, they will receive a cookie to keep it closed.
  4. Added the ability to assign one or more News Administrators to manage the news.

 

Rate limiting & crawler/bot controls

With the large number of AI crawlers and scrapers joining the already large number of search-engine robots, we wanted to ensure your legitimate users continue to get the best access to your materials, so we added rate limiting and crawler controls to the software. We are continually reviewing the thresholds set on these limiters and tweaking them as we go.

  1. Added a new rate limiter for anonymous users viewing item content and JPEG2000 image pulls, with a higher limit for logged-in users and a separate burst allowance.
  2. Added sustained-scraping protection, an hourly site-wide robot limit (separate from the per-bot list), a "come back later" response for search-engine bots instead of a hard block, and a /16-range uber-ban for abusive ranges.
  3. URLs used to serve files associated with your digital objects now expire at different rates, depending on the file type and restriction level (streaming vs. download vs. restricted).
  4. Added an emergency "require login to view items" switch for use under active bombardment.
  5. Improved bot/search-engine identification from user-agent strings.
  6. Added ability to use Cloudflare Turnstile on the registration forms

 

Collection Management

  1. Per-collection result fields — In the Results tab of each collection, you can choose which metadata fields appear in the result views.
  2. Auto-created institution aggregations now inherit the same facets, result views, result fields, and permissions as any other new collection, instead of a bare stub row.

 

Web Skin Management

  1. New directives can be used in the header and footer to provide links for users to change the UI language: <%LANG=xx%>.
  2. A new directive, <%HELP%>, was added to the header which simply writes the word "Help" in the current UI language.
  3. When managing a single web skin, the header/footer copy button now works correctly.
  4. Corrected CKEditor <li> artifacts.

 

User Management and Login

  1. User account activation status — User administrators can now deactivate an account, which prevents that account from logging in.
  2. Some accounts can be flagged as SystemUser, and those accounts cannot be deactivated. These are accounts generally used for hosting administration or automatic monitoring.
  3. Controls were added for agencies that utilize the recently added SSO options and wish to remove the standard SobekCM login functionality. We can hide self-registration and the local login option while keeping a hidden /my/logon/local path for trusted system accounts.

 

Localization and Translations

  1. When users change their language, the language preference is now stored in the session, making it harder to silently drop back into the default language.
  2. With each request, we check the session language selection first, then the user's preference if they are logged in, and finally the preferences advertised by the browser to select the language for that request.
  3. Another round of translations was added, including:
    1. item menu strip labels,
    2. "edit content" links,
    3. common buttons,
    4. instance/aggregation display names,
    5. brief-results metadata values,
    6. multi-part subject terms, and
    7. facet/search-term labels.
  4. Fixed aggregation administration issues when adding or copying home-page text in a specific language.

 

Other Improvements

Reliability / bug fixes

  1. Fixed an OverflowException from oversized page/sort values in URLs (auto-fixed from a production exception).
  2. Added a built-in missing-page fallback when missing.html itself can't be read (auto-fixed from a production exception).
  3. Added redirects to the first valid VID when a BibID-only or bad-VID URL points to a deleted or missing volume.
  4. Added new sobekcm:ExcludeFile METS behavior to keep specific files (e.g., manifest.json) out of METS/downloads while allowing them to remain in the resource folder (#83).
  5. Fixed various concurrency issues.
  6. Fixed assorted checkbox UI glitches.
  7. Improved Solr text-search input sanitization (auto-fixed from a production exception).
  8. Corrected admin home pages for user, news, and portal (and any combination of those) admins

 

Infrastructure / Operations

  1. Added a new monitoring database sink (IMonitoring) for capturing events, allowing us to better monitor the health of your instances and any rate-limiting thresholds reached.
  2. Added additional Playwright tests for smoke testing and QA testing before releases.
  3. Smoke tests now automatically run after instance upgrades.
  4. New infrastructure receives exceptions, analyzes their causes, and creates pull requests for review by our developers.