# Open OnDemand 4.0 Release

**URL:** <https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959>\
**Category:** Announcements\
**Created:** [January 13, 2025, 9:14pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959 "2025-01-13T21:14:28Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [January 13, 2025, 9:14pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/1 "2025-01-13T21:14:28Z")

</div>

**Open OnDemand 4.0 is now available**. Thank you to all of the community members who contributed code, suggestions, bug reports, and other assistance across the project.

We especially want to thank:

Leonard Wisniewski, Aday Bujeda, and Michael Reekie at Harvard University: Institute for Quantitative Social Science.

Robin Karlsson and Simon Westersund at CSC - IT Center for Science.

Please see the[Acknowledgements section in the release notes](https://osc.github.io/ood-documentation/latest/release-notes/v4.0-release-notes.html#acknowledgments) for more details on their contributions as well as those of other community members.

**Release Overview**

This release brings significant enhancements, new features, breaking changes, and dependency updates. Please see the Special Note and Breaking Changes for important notices about this release.

**Special Note**

We are releasing version 4.0 with four known bugs, two of which are fully related to the Project Manager. The Project Manager is turned off by default, so we hope this impact is minimal. We are actively working on the bug fixes and hope to have a 4.0.1 patch sooner than later. See below for more details on the bugs:

- [#4048](https://github.com/OSC/ondemand/issues/4048) The path\_selector widget continues to spin even after the directory options are shown. The impacted applications are batch connect apps, such as VS Code, and the Project Manager.

- [#4052](https://github.com/OSC/ondemand/issues/4052) The Project Manager template creation is broken. Only when creating a project from a template do issues arise. Creating a new project works as expected.

- [#4053](https://github.com/OSC/ondemand/issues/4053) The Project Manager icon picker is broken when creating a new project.

- [#4056](https://github.com/OSC/ondemand/issues/4056) The batch connect cards incorrectly display cores. For example, if a user submits a 4 core job, the job will run with 4 cores as selected, but it will only display 1 core. As a reference point for impact, we received one OSC support ticket from our hundreds of users.

**Breaking Changes or Changes That May Impact Your Site**

- Autoloading during initialization has been removed.

- Configurations whitelist and blacklist have been replaced.

- Batch connect form IDs are now lowercase.

- All configuration files must be root owned.

- NavConfig has been removed.

**Deprecations**

- POLL\_DELAY is replaced by documented configurations.

**Dependency Updates**

- Ruby 3.3 for RHEL 8 & 9 Only

- NodeJS 20

- Passenger 6.0.23

- NGINX 1.26.1

- ondemand-dex 2.41.1

**Several Highlights of New Features and Enhancements**

- Support for required announcements and additional support for dismissible announcements.

- Updates to the file editor interface for a seamless, consistent design.

- Enhanced XDMoD job efficiency widget with metrics for CPU, memory, and elapsed time.

- Users can now edit and delete saved settings for interactive applications, which improves control and customization.

- Interactive application forms can display additional text headers for better guidance.

- The nginx\_clean method now removes PUNs and files for disabled users, which enhances system operations.

**Additional Resources**

For a detailed list of changes, please refer to our[v4.0 Release Notes](https://osc.github.io/ood-documentation/latest/release-notes.html) or consult the[Changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#400---12-30-2024) for a complete overview of the release.

We recommend testing the upgrade on development or test environments before applying it to production systems. Please see the[Upgrade Instructions](https://osc.github.io/ood-documentation/latest/release-notes/v4.0-release-notes.html#upgrade-instructions) for step-by-step upgrade directions.

We extend our heartfelt thanks to all community contributors for their invaluable support in making this release possible.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [March 4, 2025, 6:11pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/2 "2025-03-04T18:11:22Z")

</div>

**Open OnDemand 4.0.1 is now available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**

This release contains several bug fixes, including the four known bugs from Open OnDemand 4.0.0. For a full list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#401---02-16-2025). To compare versions 4.0.0 and 4.0.1, please see this [link](https://github.com/OSC/ondemand/compare/v4.0.0...v4.0.1).

**Bug Fixes from Known 4.0 Bugs**

- The path\_selector widget, used in VS Code and the Project Manager, no longer spins indefinitely. Previously, the widget continued to spin even after directory options appeared.

- The Project Manager template creation now works correctly. Previously, only new projects could only be created.

- The Project Manager’s icon picker now functions as expected. Previously, icons could not be selected for projects.

- Batch connect cards now accurately display node and core allocations. Previously, they incorrectly showed only 1 core, regardless of the actual submission.

**Bug Fixes**

- Native VNC connection tabs now open as expected.

- The path\_selector widget correctly handles files with spaces, resolving URL encoding issues.

- OnDemand now properly accounts for usernames that are entirely numeric.

- Usernames with dots (‘.’) can now successfully launch applications.

- Applications with external URLs now function properly, with the menu bar using the external URL instead of a relative URL. This prevents unsafe redirects in OnDemand.

- The Files application now properly handles files containing non-UTF-8 characters.

- Open OnDemand packages now require proc-ps, correcting an issue with sites operating in containerized environments.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [April 8, 2025, 8:36pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/3 "2025-04-08T20:36:10Z")

</div>

**Open OnDemand 4.0.2 is now available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**

This release includes several bug fixes and usability improvements. For a full list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#402---03-25-2025). To compare versions 4.0.1 and 4.0.2, please see [this comparison link](https://github.com/OSC/ondemand/compare/v4.0.1...v4.0.2).

**Bug Fixes**

- File transfer failures now correctly display the error modal.

- Plugins now load correctly, resolving fatal errors in previous versions.

- Active navigation link colors now display as expected. Links can be reconfigured to custom colors.

- `bc_desktop` sessions now launch with a safer `PATH`, improving environment issues caused by `dbus-launch` and Python conflicts.

- The “Select Path” button in the `path_selector` widget now responds to internationalization (i18n).

- Empty title entries in `manifest.yml` files no longer cause issues in the navigation bar.

- Clusters with hyphens in their name now correctly respond to dynamic batch connect directives.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [April 24, 2025, 9:21pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/4 "2025-04-24T21:21:38Z")

</div>

**Open OnDemand 4.0.3 is now available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**  
This release includes a critical security fix and a few bug fixes. For a full list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#403---04-23-2025). To compare versions 4.0.2 and 4.0.3, please see [this comparison link](https://github.com/OSC/ondemand/compare/v4.0.2...v4.0.3).

**Security**  
The Path Selector interactive widget was found to be vulnerable to Cross-Site Scripting (XSS) attacks when handling unsafe file names.

**This vulnerability has only been patched in versions 4.0.3 and 3.1.11. Open OnDemand versions 3.0.x will remain vulnerable.**

If you are unable to upgrade, you can still mitigate this risk by removing the `path_selector` widget from your interactive applications. To do this, simply edit the application’s `form.yml` and replace the widget with a basic `text_field` that does not include search or select capabilities. See documentation on the Path Selector [here](https://osc.github.io/ood-documentation/latest/how-tos/app-development/interactive/form-widgets.html#path-selector) and editing `form.yml` files [here](https://osc.github.io/ood-documentation/develop/how-tos/app-development/interactive/form.html#app-development-interactive-form).

**Bug Fixes**

- Shared interactive applications now correctly appear in the left menu panel on the My Interactive Apps page when the navigation bar has been customized.

- Icons are now cached in the browser to improve response times.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [June 17, 2025, 4:51pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/5 "2025-06-17T16:51:02Z")

</div>

**Open OnDemand 4.0.5 is available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**

This release includes several fixes shown below. For a full list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#405---05-27-2025). To compare versions 4.0.3 and 4.0.5, please see [this comparison link](https://github.com/OSC/ondemand/compare/v4.0.3...v4.0.5).

**Changes That May Impact Your Site the Most**

- **File Editor Size Limit.** The file editor will now only open files that are smaller than a configurable size limit. You can configure the maximum file size that can be opened by setting the `OOD_FILE_EDITOR_MAX_SIZE` environment variable. The default is 12 MB.
- **Passenger and Metrics Collection.** Passenger has been patched for reduced metrics collection due to efficiency impacts found by CSC - IT Center for Science. Previously, all PUNs paused every 5 seconds to collect data. This duration is now configurable through `OOD_OVERRIDE_PASSENGER_ANALYTICS_COLLECTION_SLEEP_TIME_SECONDS`, which defaults to 30 seconds. Additionally, each PUN operates on its own timer, improving overall system performance. Centers can revert to the previous behavior (synchronizing every 5 seconds) by defining the environment variable `OOD_OVERRIDE_PASSENGER_ANALYTICS_COLLECTION_RESTORE_UPSTREAM_BEHAVIOR`. Any defined value, even an empty string or `false`, is interpreted as true.

**Added**

- **Passenger Telemetry.** Passenger telemetry has been disabled by default. If needed, you can re-enable it by setting the `passenger_disable_anonymous_telemetry` configuration to `off` in `nginx_stage.yml`.
- **Encrypted Password Fields.** `password_field` form widgets are now encrypted when stored, enhancing security.

**Fixed**

- **Job Composer Fix.** The Job Composer now correctly handles erroneous input when creating templates, fixing issue [#3426](https://github.com/OSC/ondemand/issues/3426).
- **Dashboard Logging Fix.** The dashboard’s configuration class now uses `$stderr.puts` instead of `Rails.logger.warn` for error logging, as `Rails` was unavailable in this context, which caused errors.

---

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [June 18, 2025, 8:55am UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/6 "2025-06-18T08:55:15Z")

</div>

This is great, unfortunately this release is breaking the installation of 4.0.3 when using the ood-ansible project. Please see [Version 4.0.3 failed to installed since 4.0.5 has been released · Issue #4428 · OSC/ondemand](https://github.com/OSC/ondemand/issues/4428)

---

<div class="post-metadata">

**Author:** ![swesters](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/swesters/32/1106_2.png) [@swesters](https://discourse.openondemand.org/u/swesters)\
**Post date:** [June 18, 2025, 9:15am UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/7 "2025-06-18T09:15:02Z")

</div>

Thanks for summarizing the changes!

A small correction to the Passenger metrics collections, for completeness:

- 

> Passenger has been optimized for collecting metric data.

  - Actually Passenger was badly optimized, and now it has been patched to do _less metrics collection_, i.e., avoiding work, instead of doing it more efficiently.

- 

> Centers can restore the previous behavior (synchronizing every 5 seconds) by setting `OOD_OVERRIDE_PASSENGER_ANALYTICS_COLLECTION_RESTORE_UPSTREAM_BEHAVIOR` to `true`.

  - Actually, it doesn’t need to be `true`, but any value is interpreted as “trueish”. Also empty string or `false`, for example. So be sure to _not_ define this environment variable, if you wish to use the newly added performance improvements (this is the default).

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [June 18, 2025, 9:36pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/8 "2025-06-18T21:36:37Z")

</div>

Thanks for those findings, @swesters. I have updated my announcement with your comments.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [June 18, 2025, 9:41pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/9 "2025-06-18T21:41:16Z")

</div>

@xpillons Thanks for bringing this to our attention. I do apologize for this. I have a post coming soon spelling out a workaround and an internal discussion planned next week to prevent this from happening again.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [June 18, 2025, 10:05pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/10 "2025-06-18T22:05:34Z")

</div>

**Open OnDemand is currently experiencing dependency resolution issues with Debian and Ubuntu packages following recent version updates**. This makes it challenging to install older versions, such as 4.0.2 or 4.0.3, and it affects our Ansible automation since it is not configured to handle this scenario.

The current recommended workaround is to manually install the desired older versions by explicitly specifying the package versions for `ondemand`, `ondemand-nginx`, and `ondemand-passenger`.

For example, to install Open OnDemand version 4.0.3, use:

```auto
apt install ondemand=4.0.3 ondemand-nginx=1.26.1.p6.0.23.ood4.0.1 ondemand-passenger=6.0.23.ood4.0.1

```

**Special Note: RHEL packages are not affected by this issue.**

We apologize for any inconvenience this may cause and appreciate your patience as we work to improve our release process to prevent this from occurring again.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [July 11, 2025, 8:37pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/11 "2025-07-11T20:37:21Z")

</div>

Closed on July 11, 2025, 8:37pm UTC



---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [July 11, 2025, 9:31pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/12 "2025-07-11T21:31:47Z")

</div>

**Open OnDemand 4.0.6 is available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project. **A special thank you to CSC** for alerting us to a **moderate security vulnerability** and collaborating with us to resolve it.

**Release Overview**

This release addresses important security concerns and includes several fixes listed below. For a full list of changes, please refer to the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#406---07-10-2025). To compare versions 4.0.5 and 4.0.6, please view this [comparison link](https://github.com/OSC/ondemand/compare/v4.0.5...v4.0.6).

**Security**

Resolved CVE-2025-53636, a vulnerability that allowed users to perform a denial-of-service (DoS) attack by flooding log files with errors via the shell application. The shell application now restricts log output and properly manages scenarios where the terminal remains open but the WebSocket connection is inactive.

**Fixes**

- Updated SELinux policies to ensure compatibility with Munge on EL9, resolving a “Permission Denied” error encountered when connecting to the Munge socket.

- Adjusted Debian package dependencies for `ondemand-nginx` and `ondemand-passenger`, resolving installation issues that prevented older versions of OnDemand from being installed.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [September 9, 2025, 7:10pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/13 "2025-09-09T19:10:15Z")

</div>

**Open OnDemand 4.0.7 is available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project. A special thank you to **@AndyUEA** for alerting us to a security vulnerability and collaborating with us to resolve it. A special thank you as well to the folks mentioned below for their contributions to the new adapters compatible with Open OnDemand.

**Release Overview**  
This release addresses important security concerns and introduces several new adapters compatible with Open OnDemand. For a full list of changes, please refer to the [4.0.7 changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#407---08-14-2025).

The difference between versions 4.0.6 and 4.0.7 was an ood\_core upgrade. To view the details, navigate to the [ood\_core repository comparison link](https://github.com/OSC/ood_core/compare/v0.27.1...v0.29.0).

**Enhancements**  
Three new adapters have been added to support various schedulers:

- **HTCondor** — thank you to **@fodinabor**

- **PSI/J** — thank you to **@tat-ohmura**

- **Coder/OpenStack** — thank you to **@andrejcermak**

**Bug Fixes**  
Interactive apps now correctly handle scripts that utilize `pipefail`, resolving issues where certain job scripts would terminate prematurely.

**Security**  
Resolved **CVE-2025-58435** , VNC interactive apps now correctly rotate passwords for higher versions of TurboVNC, fixing an issue where noVNC passwords could not be rotated on newer TurboVNC versions. This patch applies to **TurboVNC ≥ 3.1.2**.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [November 19, 2025, 10:56pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/14 "2025-11-19T22:56:54Z")

</div>

**Open OnDemand 4.0.8 is available.** Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**  
This release focuses on patching two security vulnerabilities. For a full list of changes, please refer to [the 4.0.8 changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#408---11-03-2025). To compare versions 4.0.7 and 4.0.8, please view [this comparison link](https://github.com/OSC/ondemand/compare/v4.0.7...v4.0.8).

**Security**

- **CVE-2025-64185:** Open OnDemand RPMs on RHEL 8 systems erroneously created two gem directories with world-writable (777) permissions. This release patches the issue by ensuring these directories are now owned by `root:root` and set to `755` permissions. Thank you to **@bviviano** for identifying the vulnerability and bringing it to our attention.

- **CVE-2025-62724:** Previous releases were vulnerable to a TOCTOU flaw that allowed files outside the allowlist to be included when downloading zip directories. This release remediates that vulnerability. Thank you to **@robinkar** for reporting this vulnerability and working with us on the fix.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [December 17, 2025, 9:41pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/15 "2025-12-17T21:41:01Z")

</div>

This post provides a security update regarding a CVE affecting Open OnDemand 4.0.x.

The Apache proxy configuration allows sensitive headers to be passed to origin servers. As a result, a malicious user could create an origin server on a compute node and record these headers when unsuspecting users connect.

This vulnerability, documented in `CVE-2025-66029`, is patched in the upcoming Open OnDemand version 4.1 release. Because sufficient workarounds exist for versions 4.0.x, we will not be backporting this change to that release series.

Additional details, including the workaround, are available in the [CVE section of the Open OnDemand](https://github.com/OSC/ondemand/security/advisories/GHSA-2cwp-8g29-9q32) repository.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [March 4, 2026, 5:21pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/16 "2026-03-04T17:21:28Z")

</div>

**Open OnDemand 4.0.9 is now available**. Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**

This release consists of the resolved CVE listed below. For a list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#409---2026-02-13). To compare versions 4.0.8 and 4.0.9, please see [this comparison link](https://github.com/OSC/ondemand/compare/v4.0.8...v4.0.9).

**Security:**

- **Resolves CVE-2026-26002**. This version resolves a security issue related to malicious input when navigating to directories.

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [March 4, 2026, 5:22pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/17 "2026-03-04T17:22:42Z")

</div>

**Open OnDemand 4.0.10 is now available.** Two patch updates are being released today for the 4.0 series.

Special note: This patch backports an **expedited fix** from the 4.1.x series addressing a compatibility issue between the Open OnDemand **Shell app** and **Firefox 148**. The issue impacts shell access for sites using that browser version.

For a list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#4010---2026-03-03). To compare versions 4.0.9 and 4.0.10, please see [this comparison link](https://github.com/OSC/ondemand/compare/v4.0.9...v4.0.10).

---

<div class="post-metadata">

**Author:** ![moffatsadeghi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/moffatsadeghi/32/2122_2.png) [@moffatsadeghi](https://discourse.openondemand.org/u/moffatsadeghi)\
**Post date:** [April 30, 2026, 7:43pm UTC](https://discourse.openondemand.org/t/open-ondemand-4-0-release/3959/18 "2026-04-30T19:43:48Z")

</div>

**Open OnDemand 4.0.11 is now available**. Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.

**Release Overview**

This release includes several bug and security fixes. For a full list of changes, please see the [changelog](https://github.com/OSC/ondemand/blob/master/CHANGELOG.md#4011---2026-04-29). To compare versions 4.0.10 and 4.0.11, please [see this comparison link](https://github.com/OSC/ondemand/compare/v4.0.10...v4.0.11).

**Bug Fixes**

- Fixed URL encoding for filenames containing special characters such as `#` and `+` in the Files app, resolving broken edit and download links for those files. Path handling for encoded filenames in the `path_selector` was also corrected as part of this fix.

**Security**

- This version resolves a security issue where the HSTS header, which tells browsers to always use a secure HTTPS connection rather than plain HTTP, was not always being set in `NGINX`. Previously this could be missed depending on your configuration, so we’ve made it unconditional. **Thank you to @karcaw for identifying this issue and submitting the PR that fixed it.**
- Resolved CVE-2026-44371. In previous versions, specially crafted filenames can execute javascript in the file browser. This has been fixed in this release. **Thank you to @irateChiapet for reporting this vulnerability and working with us on the fix.**

**Dependency Notes**

These packages have known security alerts, but the patched versions require compatibility breaking changes, so they are not included in this patch release. **The fixes are included in Open OnDemand 4.2, which is planned for mid-May.**

- `Handlebars` 4.7.7
- `Rails` 7.1.6 (including `ActiveSupport`, `ActiveStorage`, `ActiveRecord`, `ActionPack`, and `ActionView`)
- `Braces` 2.3.2
- `Lodash` 4.17.21 (dev dependency)
- `qs` 6.13.0
- `Sinatra` 3.2.0
- `rexml` 3.4.0

**Special Note**

**This is expected to be the final 4.0 patch release** since the next scheduled 4.0 patch window falls outside the support and backporting period [defined in our versioning policy](https://github.com/OSC/ondemand/blob/master/VERSIONING_POLICY.md#backporting-and-support). We may still consider critical bug fixes or security patches if needed.