Open OnDemand version 4.2 is now available as 4.2.2. Thank you to all of the community members who contributed code, suggestions, bug reports, documentation, and other assistance across the project, including the 9 first-time contributors across several core Open OnDemand GitHub repositories.
We’d like to recognize the following folks for their contributions to the 4.2 release:
Andrej Čermák, CESNET
James Willis, SciNet- University of Toronto
Michael Robbert, Colorado School of Mines
Robin Karlsson, CSC – IT Center for Science
Evan Felix, Pacific Northwest National Laboratory
Harshit Soora, University of Maryland
Kristen Finch and Carolina Ternero, University of Washington
This release focuses on significant accessibility improvements aligned with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standard, in advance of the April 2027 compliance deadline under Title II of the Americans with Disabilities Act. It also includes new OS support, dependency updates, and several behavior changes.
Changes that May Impact Your Site the Most:
Support for Ubuntu 22.04 has been removed. Support for Debian 13 and Ubuntu 26.04 has been added.
Links now open in the current tab by default . Previous versions opened some links in a new tab.
The Active Jobs extended details panel now opens above or beside the table rather than inline to support screen reader navigation.
Debian and Ubuntu repository signing has changed from SHA1 to SHA512. If you are not using OnDemand’s release packages, please update your repository configuration to use the new DEB-GPG-KEY-ondemand-SHA512 key. See the release notes for details.
Dependency Updates:
Passenger 6.1.2
NGINX 1.28.0
ondemand-dex 2.45.1
Several Highlights of 4.2:
Accessibility improvements. Version 4.2 includes accessibility enhancements across the dashboard and core applications, including additional keyboard navigation support, improved labeling for form items and icons, additional regions and landmarks, improved focus handling on auto-updating pages, contrast improvements for links and buttons, and an improved screen reader alerting experience.
Accessibility Conformance Report (ACR). An ACR has been created for version 4.2 documenting Open OnDemand’s conformance with the WCAG 2.1 AA standard. It is available at openondemand.org/accessibility.
Software Bill of Materials. Open OnDemand 4.2 includes a Software Bill of Materials (SBOM) in an industry-standard format, outlining OS-level software dependencies. The SBOM is published in a dedicated OSC repository titled open-ondemand-sbom.
OOD_WORKFLOW_SYNC_KEY for Project Manager workflows. Launchers within a workflow now receive a unique alphanumeric key per run, which makes it easier to synchronize launchers and safely read and write data without overwriting between runs.
Edit links hidden when downloads are disabled. For centers with download_enabled: false, the Files App and Project Directory tables will no longer display edit links. This prevents users from exporting file contents through the editor.
Interactive App popovers persist under hover and focus. App preview popovers in the Interactive Apps list now remain open while hover or focus is within the trigger or popover, which allows users to click links inside the popover.
PBSPro cluster_info API support. The System Status page now supports PBSPro clusters.
Finally, we recommend testing the upgrade in a development or test environment before deploying to production. Step-by-step upgrade instructions for version 4.2.2 are available in the release notes.
Open OnDemand 4.2.3 is now available. Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.
Release Overview
This release contains security fixes, bug fixes, and dependency updates. For a full list of changes, pleasesee the changelog. To compare versions 4.2.2 and 4.2.3, please see this comparison link.
Special Note
VNC-based interactive desktop apps will once again open in a new tab. Version 4.2.2 introduced a change to open links in the current tab as part of our accessibility improvements to Open OnDemand (OOD). Based on community feedback, this behavior negatively affected the VNC desktop experience, so we have reverted the change for VNC apps specifically. All other links will continue to open in the current tab.
Breaking Changes and Changes That Will Affect Your Site
Sites using OIDC authentication must explicitly set oidc_crypto_passphrase in ood_portal.yml before upgrading. As part of the fix for CVE-2026-55171, Open OnDemand no longer provides a default value forOIDCCryptoPassphrase. If this value is not set, Apache will start but will be unable to apply new configurations from ood_portal.yml, meaning the CVE mitigation will not take effect and your site will remain vulnerable. This failure is silent because Apache will continue running on its old configuration without obvious interruption, so check your logs to confirm configurations were applied successfully. If you missed this step before upgrading, you can set the value after the fact and reconfigure.
RHEL-based sites not using Puppet to install OOD should update access to /var/log/ondemand-nginx using a filesystem ACL (FACL). As part of the fix for CVE-2026-55169, OOD now changes the ownership of this directory on RHEL systems, which may remove access for staff members who previously had it. Debian packages and Puppet-managed installs already handle this correctly and are not affected. The command to do this is setfacl -m g:groupname:rx /var/log/ondemand-nginx where groupname needs to be replaced with the actual group.
Security
Resolved CVE-2026-55171. As mentioned above, the default oidc_crypto_passphrase is predictable and unsafe to use. Therefore, OOD no longer provides the default. httpd/apache2 will start, but the CVE mitigation will not take effect, and your site will remain vulnerable. The decision to include a fix for this security vulnerability in a patch was made in conjunction with the Open OnDemand Technical Governance Committee. Thank you to @kazeruch for reporting this vulnerability.
Resolved CVE-2026-55172. The session storage directory now has multiple checks to ensure it is created by the user and owned by the user, falling back to cookies if these checks fail. Previous versions lacked sufficient checks of this directory. Thank you to @irateChiapet for reporting this vulnerability and working with us on the fix.
Resolved CVE-2026-55169. Previous versions allowed VNC passwords to be logged in access logs. This release resolves that issue on all systems and hardens that directory on RHEL systems by changing its ownership of `/var/log/ondemand-nginx`. For details and recommended site action, see the third bullet under “Breaking Changes and Changes That May Affect Your Site.” Thank you again to @irateChiapet for reporting this vulnerability and working with us on the fix.
Bug Fixes
Filenames with spaces now correctly link to the File Editor fixing previous behavior of broken links.
Fixed dynamic batch connect fields containing underscores. Fields using underscores in their token names were not being normalized correctly and failed to function as expected.
Fixed job hash not being saved in Project Manager workflows. A backend fallback now ensures the job hash is saved correctly, so data is not lost between runs.
Fixed interactive app menu border hover styling.
Navigation bar menus work correctly on MacOS/Safari previously fixing rendering behavior where links couldn’t be selected.
Display settings in Recently Used Apps now escape HTML.
Dependency Updates
We made many Ruby and NodeJS package updates in this patch. Please see the change log for details.
The ondemand-selinux package no longer requires a specific selinux-policy version, which improves compatibility across supported RHEL operating systems.
TLDR;
OIDC sites need to provide oidc_crypto_passphrase in ood_portal.yml
/var/log/ondemand-nginx is no longer accessible by regular users.
Open OnDemand 4.2.4 is now available. Thank you to all community members who contributed code, suggestions, bug reports, and other assistance across the project.
This release includes several bug fixes and dependency updates. For a full list of changes, please see the changelog. To compare versions 4.2.3 and 4.2.4, please see this comparison link.
TLDR;
Fixed dynamic form issues that affected multi-cluster setups.
Better proxy support for app initialization.
Fixed Apps navigation bar dropdown spacing
Bug Fixes
Fixed account name confusion in dynamic forms. When working across multiple clusters, form options like auto_accounts and auto_queues could associate with the wrong account due to name collisions.
Application initialization now works better behind proxies. Apps now use relative URLs for initialization, which means Open OnDemand will respect your existing proxy scheme. This fixes startup issues for sites running behind reverse proxies.
Stopped form option loop from freezing browsers. In some configurations, the option-for dynamic form feature could create recursive loops where changing one field would trigger another, which would trigger the first, and so on. This has been fixed.
Job Composer script editing is working again. Users were unable to modify job scripts in Job Composer.
Cleaned up spacing in the Apps navigation dropdown for a cleaner look.
Dependency Updates
We’ve updated many dependencies in this patch. Please see the changelog for the full list of updates.
Open OnDemand 4.2.5 is now available. Thank you to all of the community members who contributed code, suggestions, bug reports, and other assistance across the project.
Due to the high severity rating of a recently reported security advisory, we are issuing this patch release outside of our regular release schedule. This is consistent with our updated Versioning Policy, which allows for off-cycle patches to address security vulnerabilities rated above moderate.
Release Overview
This release includes several bug fixes, a security fix, and a dependency update. For a full list of changes, please see the changelog. To compare versions 4.2.4 and 4.2.5, please see this comparison link.
TLDR;
Opening files above the file download limit now redirects to the nearest directory and displays an error message.
The download size setting now matches the name in our documentation (download_file_max). Your existing setting will keep working.
Uncached settings now correctly set their value when editing saved settings for interactive apps.
Batch Connect session cards now keep your selected tab when they refresh.
Changes That May Affect Your Site
If your site limits file download size, the configuration key has been changed from file_download_max to download_file_max, which aligns with existing documentation. If you already use the old name, no immediate action is required as both names will continue working for the remainder of the version 4.2 series. However we strongly recommend updating your configuration before the old name is removed in the next major or minor release. We recommend switching to the documented name. See the documentation for details.
Bug Fixes
Fixed redirect loops related to the the file download size limit. Previously, opening files above the download limit would redirect to the same path, resulting in a loop. Now they redirect to the closest directory and show an error message explaining the restriction
Fixed an issue that prevented uncached form attributes from saving custom values when editing saved settings.
Fixed an issue where tabs on interactive session cards switched when the card was updated. Cards now retain tab state during updates.
Security
Resolved GHSA-frjp-qp79-hc3g. Fixes specially crafted transfer requests that can execute commands on the web node. The fix changes how the Files app counts files during copy, move, and delete operations. We recommend that all sites upgrade as soon as possible. Thank you to @irateChiapet for reporting this.
Open OnDemand 4.2.6 is now available to Open OnDemand Support Program subscribers. This is the first release made available through our new early access (EA) program. It is only available to subscribers for now, and general availability is expected on December 10th. Subscribers can download the packages from the password-protected early access page. To learn more about the program, see the early access announcement. For more information about our Support Program, visit the Support Program page to learn more.
Thank you to everyone who contributed code, bug reports, and suggestions to this release. We have had an incredible amount of community contributions as part of this patch – thank you to @samoz83, @fodinabor, @najibna, @bedroesb, @JayDS22, @robinkar, and @GlazerMann.
TLDR;
4.2.6 is early access only. General availability is expected on December 10th.
Includes a security fix for GHSA-x67g-76xw-v22g. Non-subscribers can use a manual mitigation, described below.
File browser fixes, a restructured navbar, and a more compact announcement banner.
Includes ood_core 0.31.2 with Slurm, HTCondor, and LinuxHost fixes.
Security
This release addresses GHSA-x67g-76xw-v22g which allows certain files to execute javascript when viewed in the file browser. Only the 4.2 series is being patched for this vulnerability, though the mitigation applies to versions below that. Thank you to @robinkar for reporting this vulnerability and working with us to identify a fix.
Because this release is in early access, sites that are not Support Program subscribers cannot yet install the patched packages. In line with the access to patched binaries section of our security policy, we are providing a manual mitigation for these sites provided in the advisory: XSS in the file browser · Advisory · OSC/ondemand · GitHub
Changes That May Impact Your Site
The top navbar has been restructured to use Bootstrap’s standard markup. Sites with a customized navbar CSS should check that it still renders as expected
The announcement banner is now more space efficient
Bug Fixes
HTCondor: Fixed errors with Project Manager launcher submission
Fixed file browser navigation when Select All is checked
Fixed vague error messages in the File Browser
Fixed long favorite paths overflowing in the sidebar and path selector
Slurm: Fixed System Status ‘GPUs available’ errors caused by column truncation
Fixed LinuxHost username resolution
Optimizations and Improvements
Select All in the file browser can now be toggled with the Enter key
Failed file uploads now show the server’s error message
Rclone remotes are now sorted consistently across Rclone versions
HTCondor: added wallclock time, limit, and server time handling
Enforced a compatible interface across scheduler adapters