Skip to main content
OJS for Everyone Logo
OJS for EveryoneThe Practical GuidebookRSYN Research LLP

OJS 3.5.0.4 — Release Highlights

Status: ✅ Released — Current stable release
Release date: 2025
LTS Candidate: Yes — PKP is evaluating 3.5.0.4 for Long-Term Support designation

This page summarises the key improvements introduced in OJS 3.5.0.4 compared to earlier 3.5.0.x releases.

Full guide available

For a step-by-step upgrade guide to this version, see the OJS 3.5.0.x → OJS 3.5.0.4 Migration Guide.

Security Improvements​

  • Hardened file upload validation — malicious file extensions are now rejected at multiple validation layers
  • XSS fix in search — a reflected cross-site scripting vulnerability in the search interface has been patched
  • Dependency updates — JavaScript and PHP dependencies with known CVEs have been updated
  • CSRF strengthening — CSRF token validation tightened on additional form endpoints

Bug Fixes of Note​

AreaWhat Was Fixed
PDF.js ViewerNow renders correctly on HTTPS sites with strict Content Security Policy headers
CrossRef bulk depositFixed failures for journals whose ISSNs contain special characters
COUNTER 5 reportsEliminated duplicate rows in TR_J1 reports for multi-galley articles
OAI-PMHDeleted records now return the correct datestamp in ListIdentifiers responses
Plugin manager"Install from file" now works for ZIP archives larger than 20 MB
Reviewer notifications"Send a copy to self" preference is now respected
User exportBulk user export no longer includes unintended inactive accounts
Submission wizardMissing metadata fields for certain locale configurations restored

Improvements​

  • Job queue stability — background job worker is more resilient under high submission load
  • REST API extension — new GET /submissions/{id}/publications/{pubId}/galleys endpoint
  • Accessibility — improved WCAG 2.1 AA compliance on the reviewer interface
  • Email templates — updated default invitation email templates

Why 3.5.0.4 as LTS?​

PKP targets a Long-Term Support designation for a 3.5.x release to give institutions a stable, well-supported version for 2–3 years. OJS 3.5.0.4 is the current LTS candidate because:

  • It resolves all known critical and high-severity bugs from the 3.5.0 series
  • It ships the security hardening needed for production deployments
  • PHP 8.1+ and MySQL 8.0+ requirements are now well-established in the ecosystem
  • The plugin ecosystem has largely caught up to OJS 3.5 compatibility

Check the PKP Roadmap for the official LTS announcement.

If you are running any earlier OJS version: