The source code for this book is hosted in GitHub: https://github.com/ortus-solutions/commandbox-docs. You can freely contribute to it and submit pull requests. The contents of this book is copyright by Ortus Solutions, Corp and cannot be altered or reproduced without author's consent. All content is provided "As-Is" and can be freely distributed.

• The majority of code examples in this book are done in cfscript.

External Trademarks & Copyrights

Flash, Flex, ColdFusion, and Adobe are registered trademarks and copyrights of Adobe Systems, Inc. Railo is a trademark and copyright of Railo Technologies, GmbH. Lucee is a trademark and copyright of Lucee Association Switzerland.

Notice of Liability

The information in this book is distributed “as is”, without warranty. The author and Ortus Solutions, Corp shall not have any liability to any person or entity with respect to loss or damage caused or alleged to be caused directly or indirectly by the content of this training book, software and resources described in it.

Contributing

We highly encourage contribution to this book and our open source software. The source code for this book can be found in our GitHub repository where you can submit pull requests.

Charitable Proceeds

15% of the proceeds of this book will go to charity to support orphaned kids in El Salvador - http://www.harvesting.org/. Please donate and purchase the printed version of this book as every book sold can help a child for almost 2 months.

Shalom Children's Home

Shalom Children’s Home (http://www.harvesting.org/) is one of the ministries that is dear to our hearts located in El Salvador. During the 12 year civil war that ended in 1990, many children were left orphaned or abandoned by parents who fled El Salvador. The Benners saw the need to help these children and received 13 children in 1982. Little by little, more children came on their own, churches and the government brought children to them for care, and the Shalom Children’s Home was founded.

Shalom now cares for over 80 children in El Salvador, from newborns to 18 years old. They receive shelter, clothing, food, medical care, education and life skills training in a Christian environment. The home is supported by a child sponsorship program.

We have personally supported Shalom since 2006; it is a place of blessing for many children in El Salvador that either have no families or have been abandoned. This is good earth to seed and plant.

Luis Fernando Majano Lainez

Luis Majano is a Computer Engineer with over 15 years of software development and systems architecture experience. He was born in San Salvador, El Salvador in the late 70’s, during a period of economic instability and civil war. He lived in El Salvador until 1995 and then moved to Miami, Florida where he completed his Bachelors of Science in Computer Engineering at Florida International University. Luis resides in Houston, Texas with his beautiful wife Veronica, baby girl Alexia and baby boy Lucas!

He is the CEO of Ortus Solutions, a consulting firm specializing in web development, ColdFusion (CFML), Java development and all open source professional services under the ColdBox and ContentBox stack. He is the creator of ColdBox, ContentBox, WireBox, MockBox, LogBox and anything “BOX”, and contributes to many open source ColdFusion projects. He is also the Adobe ColdFusion user group manager for the Inland Empire. You can read his blog at www.luismajano.com

Luis has a passion for Jesus, tennis, golf, volleyball and anything electronic. Random Author Facts:

• He played volleyball in the Salvadorean National Team at the tender age of 17

• The Lord of the Rings and The Hobbit is something he reads every 5 years. (Geek!)

• His first ever computer was a Texas Instrument TI-86 that his parents gave him in 1986. After some time digesting his very first BASIC book, he had written his own tic-tac-toe game at the age of 9. (Extra geek!)

• He has a geek love for circuits, microcontrollers and overall embedded systems.

• He has of late (during old age) become a fan of running and bike riding with his family.

Keep Jesus number one in your life and in your heart. I did and it changed my life from desolation, defeat and failure to an abundant life full of love, thankfulness, joy and overwhelming peace. As this world breathes failure and fear upon any life, Jesus brings power, love and a sound mind to everybody!

“Trust in the LORD with all your heart, and do not lean on your own understanding.” – Proverbs 3:5

Brad Wood

Brad grew up in southern Missouri where he systematically disassembled every toy he ever owned which occasionally led to unintentional shock therapy (TVs hold charge long after they've been unplugged, you know). After high school he majored in Computer Science with a music minor at MidAmerica Nazarene University (Olathe, KS). Today he lives in Kansas City with his wife and three girls where he still disassembles most of his belongings (including automobiles) just with a slightly higher success rate of putting them back together again.) Brad enjoys church, all sorts of international food, and the great outdoors.

Brad has been programming CFML since 2001 and has used every version of CF since 4.5. He first fell in love with ColdFusion as a way to easily connect a database to his website for dynamic pages. Brad blogs at (http://www.codersrevolution.com) and likes to work on solder-at-home digital and analog circuits with his daughter as well as building projects with Arduino-based micro controllers.

Brad's CommandBox Snake high score is 141.

Contributors

• Jorge Reyes - ColdBox Aficionado

CommandBox Manual - Version 6.0.0

Welcome to the CommandBox Manual. CommandBox is a standalone, native tool for Windows, Mac, and Linux that will provide you with a Command Line Interface (CLI) for developer productivity, tool interaction, package management, embedded CFML server, application scaffolding, and sweet ASCII art. It seamlessly integrates to work with any of Ortus Solutions *Box products, but it is also open for extensibility for any ColdFusion (CFML) project as it is written in ColdFusion (CFML) using our concepts of CommandBox Commands.

Versioning

CommandBox is maintained under the Semantic Versioning guidelines as much as possible. Releases will be numbered with the following format:

<major>.<minor>.<patch>.<buildID>

And constructed with the following guidelines:

• Breaking backward compatibility bumps the major (and resets the minor and patch)

• New additions without breaking backward compatibility bumps the minor (and resets the patch)

• Bug fixes and misc changes bumps the patch

License

CommandBox is open source and bound to the APACHE LICENSE, VERSION 2.0

• Copyright by Ortus Solutions, Corp

• CommandBox is a registered trademark by Ortus Solutions, Corp

Info The CommandBox Websites, Documentation, logo and content have a separate license and they are a separate entity.

Discussion & Help

The CommandBox help and discussion group can be found here: https://community.ortussolutions.com/c/communities/commandbox/

Reporting a Bug

We all make mistakes from time to time :) so why not let us know about it and help us out. We also love pull requests, so please star us and fork us: https://github.com/ortus-solutions/commandbox

• https://ortussolutions.atlassian.net/browse/COMMANDBOX

Professional Open Source

CommandBox is professional open source software backed by Ortus Solutions, Corp offering services like:

• Custom Development

• Professional Support & Mentoring

• Training

• Server Tuning

• Security Hardening

• Code Reviews

• Much More

Resources

• Official Site: http://www.ortussolutions.com/products/commandbox

• Source Code: https://github.com/ortus-solutions/commandbox

• Ortus Community Forum: https://community.ortussolutions.com/c/communities/commandbox/14

• Bug Tracker: https://ortussolutions.atlassian.net/browse/COMMANDBOX

• Twitter: @ortussolutions

• Facebook: https://www.facebook.com/ortussolutions

• Google+: https://google.com/+OrtusSolutions

• Vimeo Channel: http://vimeo.com/channels/commandbox

HONOR GOES TO GOD ABOVE ALL

Because of His grace, this project exists. If you don't like this, then don't read it, it's not for you.

"Therefore being justified by **faith**, we have peace with God through our Lord Jesus Christ: By whom also we have access by **faith** into this **grace** wherein we stand, and rejoice in hope of the glory of God." Romans 5:5

Java 17 Support

Java 17 was a breaking change for Java users as it now blocks illegal reflective access. Both Adobe and Lucee have been slow to address this. Lucee 5.3.10 mostly seems to run on Java 17, but only the public beta of ColdFusion 2023 (Fortuna) supports Java 17. You may want to start testing Java 17 out, so the CommandBox CLI and its servers seem to have basic support for running on Java 17 now. Note, you may need to add additional JVM args to any servers based on the specific Java libraries you use.

Library Updates

We've bumped library versions such as Redhat Undertow to stay current with recent CVE fixes.

Override package install paths

If you have a project and want all packages of a certain type to use a different-than-normal default install location, you can override each package type just for that project. Create an installPathConventions key in the containing package's box.json which is an object containing keys for each package type you wish to override package install paths for.

{
  "installPathConventions" : {
    "modules" : "../lib/modules",
    "mvc" : "../lib/framework",
    "testing" : "they-will-never-find-it-here-lol/"
  }
}

Read more: https://commandbox.ortusbooks.com/package-management/installing-packages/installation-path

ls --tree

You can get recursive file listings now in a tree view by using the --tree flag

ls --tree

Tree Print Helper

In task runners and custom commands, you can now tap into the same tree printer that the "package list" and "ls --tree" use to output your own ASCII trees.

print.tree(  [
	'Ortus Solutions' : [
		'Products' : [
			'Open Source' : {
				'ColdBox MVC' : {},
				'CommandBox CLI' : {},
				'ContentBox CMS' : {}
			},
			'Commercial' : {
				'ForgeBox Pro' : {},
				'CommandBox Pro' : {},
				'TimeBox BMP' : {}
			}
		],
		'Services' : {
			'Consulting' : {},
			'Training' : {},
			'Design' : {}
		}
	]
] )

which outputs

└─┬ Ortus Solutions
  ├─┬ Products
  │ ├─┬ Open Source
  │ │ ├── CommandBox CLI
  │ │ ├── ContentBox CMS
  │ │ └── ColdBox MVC
  │ └─┬ Commercial
  │   ├── ForgeBox Pro
  │   ├── TimeBox BMP
  │   └── CommandBox Pro
  └─┬ Services
    ├── Training
    ├── Design
    └── Consulting

Read More: https://commandbox.ortusbooks.com/task-runners/printing-tree

Column Print Helper

There is also a print helper method for task runners and custom commands as well as a CLI command you can use that accepts an array or list of simple values and prints them in a column format based on the widest value and the available terminal width.

ls --simple | printColumns

Read More: https://commandbox.ortusbooks.com/task-runners/task-output/printing-columns

unansi Command

This command will accepted piped text and strip any ANSI formatting from it. Especially useful if piping the text to a native OS binary which doesn't handle formatting well.

package list | unansi

clipboard Command

We've introduced a new command for piping text onto your native operating system's clipboard.

echo "Hello World!" | clipboard
Copied to clipboard!

Release Notes

Here's the full list of all the changes in CommandBox 5.9.0.

CommandBox is a standalone, native Command Line Interface (CLI), Package Manager, Embedded CFML Server and Read Eval Print Loop (REPL) aimed to help ColdFusion (CFML) developers become more productive through automation, dependency management, command line-based tools, and ASCII snake games.

Features at a Glance

CommandBox is an amalgamation of many different tools and borrows concepts from NPM, Grunt/Gulp, Maven, Bower, and Node. Features include:

• Command Line for ColdFusion (CFML)

• Operating System integration for executing commands

• Ability to create and execute commands built using ColdFusion (CFML)

• ForgeBox integration for cloud package management and installations

• ColdBox Platform, TestBox, and ContentBox CMS Integrations

• Integrated servlet server with rewrite capabilities

• Ability to create command recipes and execution

• REPL (Read-Evaluate-Print-Loop) console for immediate ColdFusion

  (CFML) interaction

• Ability to interact with user via CLI and create workflows and

  installers

• Ability to execute workflows and tasks

• Built-in Help system

This is a very small release with two changes.

• Update to Lucee 5.4.3.2

• Update bundled JRE to 11.0.20+8

Note Lucee 5.4.3.2 contains critical security patches which are outlined here:

https://dev.lucee.org/t/lucee-critical-security-alert-august-15th-2023-cve-2023-38693/12893

The new Lucee version affects the core CLI runtime as well as the default server you get when running "server start" with no cfengine specified. Possible compatibility issues related to the major bump in Lucee version:

• This Lucee version does not include Hibernate, so the Ortus Hibernate extension is installed. We will stop doing this in 6.0

• This Lucee version has strict XML parsing settings on by default which may affect any servers you start which parse XML containing DTDs.

If you do run into XML errors, this code may help you in your Application.cfc, which allows DTDs, but still disallows XML external entities (XEE).

this.xmlFeatures={
	externalGeneralEntities: false,
	disallowDoctypeDecl: false
};

Release notes

Task

• COMMANDBOX-1609 Update bundled JRE to 11.0.20+8

• COMMANDBOX-1610 Update to Lucee 5.4.3.2

Check Out The New Stuff

The notable updates include:

• Updated version of JBoss Undertow, which contains security fixes

• Updated version of Lucee to 5.3.10 which also contains library security updates

• New "artifacts prune" command to remove older artifacts that haven't been used recently

• Improved "upgrade" command which can also update new jars (you'll be able to use this in the NEXT update!)

• Support for PFX cert file for server SSL

And here are the full release notes:

New Feature

update coldbox resources to support api resources

artifacts prune command

Bug

Use user.home instead of user.dir to test case sensitivity

Cursor position get's off-track when using a multiselect with content that exceeds the terminal size

Improvement

Task

In this section you will find the release notes for each version we release under this major version. If you are looking for the release notes of previous major versions use the version switcher at the top left of this documentation book. Here is a breakdown of our major version releases.

• Versions 6.x - Feb 2024 -

• Versions 5.x - Mar 2020 - August 2023

• Versions 4.x - Jun 2018 - Sept 2019

• Versions 3.x - Feb 2016 - Nov 2017

• Versions 2.x - June 2015 - Nov 2015

• Versions 1.x - Feb 2015

Release notes

Bug

COMMANDBOX-1475 Server shutdowns aren't always done cleanly

COMMANDBOX-1474 Don't prompt on already-running server when terminal isn't interactive

COMMANDBOX-1472 Globber copyTo() command mishandles *nix leading slash

COMMANDBOX-1470 preServerStart can no longer affect server.json env var replacements

COMMANDBOX-1467 Servers can no longer override rest mappings

COMMANDBOX-1465 Corruption in interactive job output

COMMANDBOX-1464 Can't set XNIO socket settings or Sequence types

COMMANDBOX-1463 Command chaining has a code path where "job" variable is not defined

COMMANDBOX-1462 cfpm breaks in single server mode

Improvement

COMMANDBOX-1473 Allow Undertow's resource manager file system watcher to be disabled

COMMANDBOX-1468 Customize Undertow's enabled SSL protocols

Task

COMMANDBOX-1476 Update to Lucee 5.3.9.141 stable

web.xml Overrides

When you start an Adobe or Lucee CF Engine, the WAR CommandBox uses has a stock web.xml baked into it. Sometimes you may want to add custom servlets, servlet mappings, etc into your server. You can override the stock web.xml in part or in total with a file of your own which you specify in the server.json like so:

{
  "app" : {
    "webXMLOverride" : "path/to/web-override.xml"
  }
}

More info here:

https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/web.xml-overrides

Funky Parameters

In addition to quoting parameter values, parameter names can also be quoted. This is useful when setting keys into settings or JSON files that have spaces, hyphens or special characters. Each of these examples are now supported:

# quoted string
package set foo."bar.baz"=bum

# bracketed string
package set foo[bar.baz]=bum

# quoted, bracketed string
package set foo["bar.baz"]=bum

More info here:

https://commandbox.ortusbooks.com/usage/parameters

Library updates

Lucee Server has been updated to 5.3.8.201 and JBoss Undertow has been updated to 2.2.10.Final. The Lucee update, as usual, applies to the CLI as well as the default server you get when you run server start.

Smarter Jar Endpoint

When you install a Jar via HTTP URL and the version number is baked into the URL, the jar endpoint now makes more assumptions about what the version of the package is that allows it to optimize the update checks and eliminate unnecessary downloads.

More info here:

https://commandbox.ortusbooks.com/package-management/code-endpoints/jar-via-http#semantic-versioning

ask and confirm commands

Here are some fun commands for user interactivity in the shell. You can use these as part of a recipe or a nice "one-liner".

ask

The ask command is similar to the ask() method in Task Runners. It requires an interactive terminal and will ask the user a question and return their answer. It is meant to be changed with other commands.

set color=`ask "favorite Color? "`
echo "you said ${Setting: color not found}"

or with default values

ask question="Who is cool? " defaultResponse="Balbino!"

or with masked input

ask question="What is your password? " mask=*

Or fun stuff like this

ask "Secret phrase: " | assertEqual "mockingbird" || echo "access denied!" && exit 1

confirm

The confirm command will ask the user a yes/no question and return a passing or failing exit code from the command based on the answer.

confirm "do you want to update your packages? " && update

Remember the && operator will only execute the second command if the first command returns an exit code of 0.

More info here:

https://commandbox.ortusbooks.com/helpful-commands/ask-and-confirm

server prune command

You can easily forget all servers which have not been started for a certain period of time with the server prune command. It accepts the number of days that need to have passed since a server was last started in order to prune it.

server prune days=30

# Skip the confirmation check
server prune --force

More info here:

https://commandbox.ortusbooks.com/embedded-server/manage-servers#prune-old-servers

Release Notes

Here are the full release notes for CommandBox 5.4.0

Bug

COMMANDBOX-1364 Cancelling a prompt with active job doesn't clear job logs

COMMANDBOX-1361 Param tab completion is off-by-one when piping

COMMANDBOX-1360 Can't list files in directory with brackets ( [ or ] ) in the name

COMMANDBOX-1356 forgebox timeout is too small when publishing packages

COMMANDBOX-1354 dir command returns no results in drive root

COMMANDBOX-1353 Summary over 200 chars in box.json causes error when publishing

COMMANDBOX-1352 Addition of Apache logging classes breaks 3rd party libs using it

COMMANDBOX-1350 Installing a system module as one-off command doesn't clear wirebox metadata cache

COMMANDBOX-1348 Commenting server rules doesn't work correctly in text files

COMMANDBOX-1346 CommandDSL doesn't handle struct args

COMMANDBOX-1344 create a server prune command

COMMANDBOX-1339 Server start can hang when CF engine blows up

COMMANDBOX-1338 Tab complete doesn't work after a pipe

COMMANDBOX-1337 Working dir of server custom menu items doesn't default properly

COMMANDBOX-1336 Error when setting failing exist code in Task Runner

COMMANDBOX-1334 updating commandbox to 5.3.1 via Homebrew breaks with a java error

COMMANDBOX-1333 Rewrite rule with query string doubles up question mark

COMMANDBOX-1332 printTable column validation breaks with spaces in list

COMMANDBOX-1330 Directory listing not showing folders properly when names are numeric

COMMANDBOX-1230 Certain Java installs fail version check

Improvement

COMMANDBOX-1366 ask and confirm command to capture user input from shell

COMMANDBOX-1365 Improve version handling in JAR endpoint

COMMANDBOX-1351 Update to Lucee 5.3.8

COMMANDBOX-1347 Support dots in struct keys with set/show/clear commands

COMMANDBOX-1342 printTable custom header names for non-array input

COMMANDBOX-1331 Add printTable check for data with no columns

COMMANDBOX-1329 Sort column names in printTable --debug

New Feature

COMMANDBOX-1362 Set env vars directly in server.json for local one-off overrides

COMMANDBOX-1011 Support web.xml Overrides

Task

COMMANDBOX-1363 Update to Undertow 2.2.10.Final

In this section you will find the release notes for the 5.x version of CommandBox.

• Version 5.9.1 - August 2023

• Version 5.9.0 - May 2023

• Version 5.8.0 - April 2023

• Version 5.7.0 - December 2022

• Version 5.6.0 - September 2022

• Version 5.5.2 - May 2022

• Version 5.5.1 - May 2022

• Version 5.4.2 - October 2021

• Version 5.4.1 - September 2021

• Version 5.4.0 - August 2021

• Version 5.3.0 - May 2021

• Version 5.2.1 - Dec 2020

• Version 5.2.0 - Nov 2020

• Version 5.1.1 - June 2020

• Version 5.1.0 - May 2020

• Version 5.0.0 - Mar 2020

• There is a fix for a regression introduced in 5.4.0 where updating the version of a CF engine doesn't work without forgetting the server first.

• There is also an important security improvement to CommandBox servers. Thanks to Abram Adams for reporting this to Ortus so we could address it.

Release notes

Note, the details of the security improvement have been tracked privately.

Bug

COMMANDBOX-1382 Java path shows up twice in "server info --verbose"

COMMANDBOX-1381 Updating server in-place keeps old web.xml path

COMMANDBOX-1375 recipe with multiple "install" instructions fails

Improvement

COMMANDBOX-1380 Add additional interceptData to server interceptors

COMMANDBOX-1379 Update to WireBox 6.5.2

COMMANDBOX-1376 Immediately activate modules after installation

COMMANDBOX-1349 Improve multiselect DSL

Story

COMMANDBOX-1120 Add JSON and Properties output for info command

There are a lot of new features in CommandBox 6. Here's an overview of the biggest ones. Check out the release notes for the full list.

Multi-Site Servers

This one is huge. It's the hallmark feature of CommandBox 6 and allows you to easily run as many web sites (with different web roots) in a single CommandBox server. This finally gives you the same behavior you get with Adobe ColdFusion and IIS or Lucee/Tomcat and Apache with mod_cfml. CommandBox has had built-in ModCFML support for a while, but it still needed a web server in front to work fully. CommandBox Multi-Site gives you a fully powered web server that allows you to define as many separate web sites as you like, each with COMPLETE configuration control, all inside a single server process.

• Rewrites

• web aliases

• security profile

• HTTP/SSL/AJP bindings

• SSL Certs

• welcome files

• MIME types

• GZIP settings

• Basically everything can currently configure under the "web" object of your server.json can be set on a per-site basis!

CommandBox is now truly a One-Stop-Shop for running your apps from development to production. You don't need Apache, Nginx, IIS, or Tomcat!

{
  "name": "commandbox-multi-site",
  "web": {
    "bindings": {
      "HTTP": {
        "listen": "80"
      }
    }
  },
  "sites": {
    "site1": {
      "hostAlias": "site1.com",
      "webroot": "site1"
    },
    "site2": {
      "hostAlias": "site2.com",
      "webroot": "site2"
    },
    "site3": {
      "hostAlias": "site3.com",
      "webroot": "site3"
    }
  }
}

Read more here: https://commandbox.ortusbooks.com/embedded-server/multi-site-support

Enhanced Server Bindings

Going hand-in-hand with our Multi-Site features, is the ability to bind to more than one HTTP port, more than one SSL port and more than one AJP port. You can configure proper host name matching on any binding, and even have multiple SSL certs. This new feature is available not only for Multi-Site but also for single site servers. The new server bindings come with a new JSON syntax in the server.json (we still support the old one too)

{
    "web" : {
        "bindings" : {
            "HTTP" : {
                "listen" : "10.10.0.123:8080",
                "host" : "site.com,site2.net"
            }
        }
    }
}

Read more here: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/bindings

SSL SNI Support

Going hand-in-hand with our enhanced server bindings, is the ability not only to be able to specify multiple SSL certs per site, but also multiple SSL certs per SSL binding. CommandBox automatically enables SNI (Server Name Indication) which will choose the proper cert based on the incoming host name. With support for PEM files, DER formats, and PFX formats, this really opens up a lot of capabilities.

Read more here: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/bindings#ssl-sni-support

Rewrite Maps

We added a popular feature from Apache's mod_rewrite called rewrite maps. This allows you to create a simple text file of values you can reference in your rewrite rules to map incoming URL values to another value.

{
  "web" : {
    "rules":[
      "rewrite-map( name=myMap, file='/path/to/myMap.txt' case-sensitive=false )",
      "regex-nocase( '^/foo/(.*)$' ) -> rewrite( 'index.cfm?page=%{map:myMap:$[1]|99}' )"
    ]
  }
}

Read more here: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/server-rules/rewrites-map

Publish command directly uploads to S3

This is a nice little productivity enhancement. When you run the publish command, the CLI will now directly upload your zip file to S3 instead of sending it to ForgeBox first. This improves the speed and efficiency of your deployments.

Add a proxy server rule alias

This is a simple one. If you want to create a simple reverse proxy to a single back-end server, we've created an alias for the existing load-balanced-proxy() handler called just proxy which accepts a single host with less verbosity.

proxy( 'http://localhost:8085' )

Read more here: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/server-rules/rule-examples

Specify Package and Server scripts as an array

You're already familiar with specifying package scripts and server scripts in your box.josn and server.json as a string containing one or more commands. Instead of using && for multiple commands, you can also do this by specifying an array of strings instead of a string like so:

{
  "name" : "My Package",
  "scripts" : {
      "build" : [
          "!grunt build",
          "testbox run",
          "run-script generateAPIDocs",
          "bump --patch && publish"
       ],
  }
}

This can be much more readable for multiple commands. Note, this is functionality equivalent to using &&, which means any erroring command will stop execution.

Read more here: https://commandbox.ortusbooks.com/package-management/package-scripts#running-multiple-commands

ColdBox, TestBox and ContentBox commands are now modules

CommandBox still bundles helpful scaffolding commands for your favorite MVC framework Testing framework, and CMS, but these commands are no longer part of the core CommandBox source code. We've given them new life as independent modules. They are installed by default, but they now have their own lifecycle and can get releases at any time. You can view and update them with the rest of your system modules.

list --system
update --system

Read more here: https://commandbox.ortusbooks.com/package-management/system-modules

Adobe CF Script Alias

CommandBox adds a /cf_scripts/scripts alias for you any time you start an Adobe CF server. This alias points to the same folders in the root of the Adobe WAR. If you set a custom scripts src path in the CF administrator then you'll want to ensure CommandBox uses the expected alias. There is now a setting called web.adobeScriptsAlias which allows you to control the public, web-accessible path to the scripts folder that CommandBox creates for you. And better yet, if you're using CFConfig, will automatically update the Adobe script source setting to match and vice versa.

Read more here: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/adobe-cfpm#script-alias

CommandBox Pro Config settings auto-sync

As a perk of CommandBox pro, once you log into the CLI with your ForgeBox Pro account, your config settings will now automatically sync to and from ForgeBox. This is a great way to keep multiple CLI instances across computers up to date.

Read more here: https://commandbox.ortusbooks.com/config-settings/setting-sync#automatic-sync-of-settings

Release Notes

Here are the full release notes for CommandBox 6.0.0

Bug

COMMANDBOX-1590Some server.json config options unavailable as environment variables

COMMANDBOX-1598Runwar doesn't load servlet filter mappings correct in web.xml override

COMMANDBOX-1604 semantic version parsing ignores part of pre-release IDs with hyphen

COMMANDBOX-1608 Stackoverflow when using serverinfo system setting expansion in a server script

COMMANDBOX-1613 Lucee Light Engine

COMMANDBOX-1615 Installing package crashes when PackageService cannot delete tmp folder

New Feature

COMMANDBOX-1589 Add a `proxy` server rule alias to `load-balanced-proxy` which takes in one item instead of an array.

COMMANDBOX-1592 Add Rewrite Map feature similar to Apache

COMMANDBOX-1593 Multi-Site mode

COMMANDBOX-1611 CommandBox Pro users get config auto sync

Improvement

COMMANDBOX-1477 box install <package>: constrain to version already defined in box.json

COMMANDBOX-1572 Publish command directly upload to S3

COMMANDBOX-1591 Allow the scripts key under the server.json and box.json to use an array of scripts to run under the same script key name

COMMANDBOX-1594 XML formatting in print helper can kick in a bad time

COMMANDBOX-1595 Allow control over undertow' s transferMinSize

COMMANDBOX-1599Provide way to escape literal colon (:) command parameter name

COMMANDBOX-1600Remove contentbox, coldbox, etc modules from the core

COMMANDBOX-1603Customize Adobe cf scripts alias

Task

COMMANDBOX-1609Update bundled JRE to 11.0.22+7

COMMANDBOX-1610Update to Lucee 5.4.4.38

Bundled System Modules

To be more useful, CommandBox now bundles the following system modules

• commandbox-cfconfig

• commandbox-dotenv

• commandbox-update-check

They will be automatically installed (or updated) when you start the CLI for the first time. You can still update or uninstall them, just like any system module. Note: If you have any of these modules currently linked into the CommandBox core, any uncommitted changes will be overwritten when you upgrade box. Please unlink the repos first before upgrading.

The CommandBox Update Check modules can be disabled if you don't like it via

config set modules.commandbox-update-check.enable=false

It will also automatically obey the offlineMode Config Setting.

Custom MIME Types

CommandBox will automatically set the content type in the HTTP response for common static file types. If you come across a file extension that doesn't have the correct type, you can set it like so in your server.json:

server set web.mimeTypes.log=text/plain

Which creates the following

{                            
    "web":{                             
        "mimeTypes":{                  
            "log":"text/plain"      
        }
    }
} 

In the above example, hitting a file such as foo.log would come back with a text/plain content type header.

This setting will override any <mime-mapping> tag in your web.xml file.

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/mime-types

Config and Module Sync

If you are authenticated to ForgeBox in the CLI, you can synchronize your config settings to and from your ForgeBox account. This is a great way to get up and running on a new PC or keep multiple CommandBox installs in sync. In addition to synchronizing your Config Settings, this feature will also track your installed system modules, such as CFConfig, etc.

config sync push

This command will push your local settings and modules up to your ForgeBox account.

config sync push

By default, the settings are "merged" so new local settings will be added to ForgeBox, but nothing will be removed. To remove config that only exists on ForgeBox, you can use the --overwrite flag to force a full sync.

config sync pull

This command will pull your settings and modules from your ForgeBox account and set/install them locally.

config sync pull

By default, the settings are "merged" so missing settings will be added locally, and missing system modules will be installed, but nothing will be removed. To remove config and modules that only exist locally, you can use the --overwrite flag to force a full sync. This will remove local config settings and uninstall local system modules which were not on ForgeBox.

config sync diff

This command will not change anything, but gives you a full report of all settings which are different between your local CommandBox CLI and ForgeBox. It will show you "Remote Only," "Local Only," and "Changed" settings and modules. Use this to see what you're about to change before pushing or pulling.

config sync diff

Read More: https://commandbox.ortusbooks.com/config-settings/setting-sync

onServerInitialInstall interceptor

This is the same as onServerInstall, but it only runs the VERY FIRST time a CF engine is installed. This is helpful if you want to install Lucee extensions or ACF modules and only need to do it the first time. This interceptor is easier than using onServerInstall and inspecting the installDetails.initialInstall flag.

Case Sensitivity of Web Server

This has been an experimental feature of CommandBox servers for a while, but we've finalized the feature and added a proper setting to enable it in server.json. By default, the web server in CommandBox will follow the case sensitivity of the underlying file system. So, when on Windows /FiLe.TxT will still load an actual file called /file.txt. But on Linux, the case in the browser would need to match that of the file system. CommandBox allows you to force case sensitivity to be ON or OFF for a server, overriding the server's file system.

Forcing Case sensitivity

To force CommandBox's web server to be case sensitive, even on operating systems like Windows, use the following setting. There is a nominal performance benefit in doing this, and it can allow a Windows CommandBox server to mimic a Linux server for testing.

server set web.caseSensitivePaths=true

Forcing Case Insensitivity

To force CommandBox's web server to be case insensitive, even on operating systems like Linux, use the following setting. There is a nominal performance overhead in doing this, and it can allow a Linux CommandBox server to mimic a Windows IIS server. In this mode, CommandBox will use an internal cache of file system lookups to improve performance. If there are two files of the same name using different case, then you will get whatever file is found first.

server set web.caseSensitivePaths=false

Read More: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/case-sensitivity-of-web-server

Support for PFX cert files

If using CommandBox's SSL, you can now use a PFX file (PKCS #8 format) which contains the public and private key in one file.

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/ssl-certs

Case Insensitive Server Rule Predicates

Most of the Server Rule predicates are case-sensitive, which poses a problem when using them for security on Windows since they will only match one specific spelling of a folder or file. We have added "-nocase" versions of several popular predicates which perform case-insensitive checks.

• regex-nocase()

• path-suffix-nocase()

• path-prefix-nocase()

• path-nocase()

• equals-nocase()

• contains-nocase()

Server Rule Reverse Proxy handler supports SSL

Undertow's reverse-proxy() handler would not connect to a back-end server using SSL. We've given up on RedHat fixing this any time soon, and added a new load-balanced-proxy() handler which works with SSL.

load-balanced-proxy({'https://reports1.mydomain.com','https://reports2.mydomain.com'})

REPL Improvements

Due to long-standing bugs in the Lucee evaluate() function that seem like they'll never get fixed, we've finally put a workaround in the REPL, which captures the return value of member functions chained to literals and expressions using closures. Ex:

CFSCRIPT-REPL: "test".len()
4
CFSCRIPT-REPL: [1,2,3].each( (i)=>echo(i) )
123

Per-Server Preferred Browser Setting

There is already a Config Setting for the preferred browser when opening up sites. You can now customize this on a per-server basis with this server.json setting

server set preferredBrowser=firefox
server open

New Server Console Log Layouts

You can now control the Log4j appender layout for CommandBox servers, which includes formats such as JSON, which allows your server logs to be automatically imported into Elastic Search

server set runwar.console.appenderLayout=JSONTemplateLayout

Read More: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/console-log-layout

New forgebox version-debug command

There is a helpful command called forgebox version-debug which will show you what version of a package will be installed without actually installing it. It can also be useful to test a semver range and see what packages it matches.

Read More: https://commandbox.ortusbooks.com/package-management/installing-packages/debug-installation

Release Notes

Bug

COMMANDBOX-1537 Experimental feature force insensitive web server has stopped working in some cases

COMMANDBOX-1541 Hide Felix error messages in console on startup

COMMANDBOX-1542 Custom tray options calling box with space in path fail

COMMANDBOX-1550 Add load-balanced-proxy() handler to replace Undertow's broken reverse-proxy() because they refuse to fix it

COMMANDBOX-1551 Capture return value from some REPL expressions because Lucee refuses to fix evaluate()'s parser

COMMANDBOX-1552 Two instance of CLI cause class loading issues from OSGI bundles

COMMANDBOX-1559 server start port check doesn't take web.http.enable into accout

New Feature

COMMANDBOX-1434 CommandBox settings sync feature

COMMANDBOX-1539 Add onServerInitialInstall package/server script

COMMANDBOX-1540 Add `.webp` as a default mime type for CommandBox to support this new image format

COMMANDBOX-1543 Formalize setting for case sensitivity of web server

COMMANDBOX-1549 Add "nocase" versions of regex(), path-suffix(), path-prefix(), equals(), contains(), and path() predicates

COMMANDBOX-1555 Improve forgebox whoami command

COMMANDBOX-1556 Allow CommandBox to customize console appender Layout

COMMANDBOX-1562 New "forgebox version-debug" command

COMMANDBOX-1566 Bundle super helpful modules in box core

COMMANDBOX-1567 onConfigSettingSave and onEndpointLogin interception announcements

Improvement

COMMANDBOX-1034 Ability to pass file name to "more" command

COMMANDBOX-1345 Add a method in server.json to add MIME type mappings to Undertow

COMMANDBOX-1393 Improve message when starting second server with single server mode enabled

COMMANDBOX-1538 system setting serverinfo namespace use interceptdata if running inside of server script

COMMANDBOX-1544 Allow `web.webroot` to be changed in single server mode

COMMANDBOX-1545 Authentication failures don't send custom error pages

COMMANDBOX-1547 Add directory param to coldbox watch-reinit command

COMMANDBOX-1548 Support PKCS #8 format private keys

COMMANDBOX-1554 Allow preferredBrowser to be set on a per-server basis

COMMANDBOX-1557 Add file and directory completion to the ID param of the install command

COMMANDBOX-1558 Add installExtension() for commands and task runners to install Lucee extensions on the fly to the CLI

COMMANDBOX-1560 Update Lucee to 5.3.10.120 in CLI core

COMMANDBOX-1561 Improve upgrade command

COMMANDBOX-1564 Load libdirs in system classloader

COMMANDBOX-1565 Check for default branch of "main" in Git endpoint

Task

COMMANDBOX-1357 Try removing JAX API classes from runwar

COMMANDBOX-1546 Update to Undertow 2.2.22-Final

COMMANDBOX-1553 Update bundled JRE to jdk-11.0.18+10

COMMANDBOX-1563 Remove stopgap for COMMANDBOX-1459

Updated bundled Java libraries

• JLine - 3.19.0

• jGit - 5.11.0.202103091610-r

• Launch4j - 3.14

• JANSI - 2.3.2

Recursive jar scanning libDirs

When you configure libDirs for a server, CommandBox used to only load jar files found in the root. Now it will include sub directories which gives you more flexibility around how to install your jars.

New printTable Command

In the previous release, we introduced a new helper for printing ASCII Art tables in your custom commands and task runners. We've taken this a step further and wrapped the table printer utiilty in a new command so you can use it from the CLI directly. We've also expanded its functionality to accept ANY data in as JSON and it will marshall it into a query for you. This means it can be a query, an array of structs, an array or arrays, and more. You can now get quick and easy visualization of any data right from the CLI or in builds.

New sql command for on-the-fly manipulation of data

As if the previous command isn't cool enough, we've also added a new "sql" command which will also accept any sort of data as JSON, marshall it into a query object and allow you to alias, filter, order, and limit the rows on the fly using CFML's query of queries!

The sql command works very nicely with the new tablePrinter command, and truly makes JSON a first class citizen of the CommandBox CLI.

Small change to print.table() helper

We've made a small adjustment to the print.table() helper that was introduced in CommandBox 5.3.1 as follows. The old method signature is

And the new method signature is:

The parameters to the new printTable command matches the NEW method signature of the print.table() helper as well.

Format XML in REPL

When working with XML in the REPL, formatting is now applied when the XML is printed out to the console, making it easier to read (same as JSON)

Release Notes

Bug

Improvement

New Feature

Release Notes

Bug

Some installs unnecessarily write to the box.json

ConfigService::settingExists() fails in race conditions due to non-varscoped variables in JSONService

Improvement

Support excludePaths in watcher DSL and watch command

Ensure Adobe wars have a seeds.properties file

Add tab complete for "env clear" command

Ignore empty startScript on server start

ModCFML Support

ModCFML is a popular standard for running a CF server behind IIS or Apache web server and allowing your virtual hosts configured in the web servers to control the web root of the CF server so you can run more than one site on a single CF instance. CommandBox has historically only had a single web root per server, but now you can use a single CommandBox instance to power as many Adobe CF or Lucee Server sites as you like. CommandBox's ModCFML just needs to be enabled and can work with BonCode, mod_cfml or Nginx.

server.json

Read more here:

Log4j 1.x is gone!

CommandBox's core is now 100% free of 1.x versions of the Log4j library. Note, if you start an older Lucee server or any Adobe ColdFusion server, they may still have Log4j 1.x bundled with them.

Library updates

Many of the java libraries have been updated

• JRE-bundled version ships with Java 11.0.15+10

• Undertow updated to 2.2.17.Final

• Lucee updated to 5.3.9.133

• JGit updated to 5.13.0.202109080827-r

• JLine updated to 3.21.0

• Runwar updated to 4.7.4

• Log4j updated to 2.17.1

Set Java System Props directly in server.json

Does what it says. Looks like this:

server.json

JVM Args can be an array

JVM args and Runwar args can now be set an array of strings which prevents you from needing to escape or quote anything.

Old way (still works)

New way

Request Dumper

There is now a handy little handler you can put in your server rules to view a console dump of all the header data related to your request and response.

server.json

OpenJDK Downloads

assertFalse command

Opposite of assertTrue. Returns a passing (0) or failing (1) exit code whether falsy parameter passed. Truthy values are "yes", "true" and positive integers. All other values are considered falsy

assertNotEqual command

Opposite of assertEqual. Returns a passing (0) or failing (1) exit code whether both parameters DO NOT match. Comparison is case insensitive.

Better command chaining

You can have more than two chained commands, and the command chain will keep executing so long as the next part is compatible with the previous exit code. Ex:

cfpm improvements

• We now set the JAVA_HOME for the cfpm command if it doesn't exist

• An Adobe server no longer needs to be the default server for that web root

• If cfpm is run as part of a package or server script, it will default to the using the server currently doing something

box.exe finds Java better on Windows

Previous versions of Launch4j only used the Windows registry to find the installed version of java. The following environment variables are now also checked in this order to attempt to find a JRE to use.

• JAVA_HOME

• JRE_HOME

• JDK_HOME

• PATH

head Command

Does the same basic thing as the tail command, but it reads from the top of the file or input.

X-Forwarded-For support disabled by default

For better security, CommandBox servers will not automatically obey X-Forwarded-For HTTP headers unless you enable it.

Only enable this setting if your CommandBox server is behind a trusted proxy which always sets this header. Otherwise, a malicious client could spoof a trusted IP an bypass IP access control.

Relaxed semantic version parsing

Both of these commands will now do the same thing. The second one used to error with version not found.

XML Love

XML formatting is now a first-class citizen of the print helper and the REPL. You can pass a parsed XML doc and they will be formatted upon display.

Mac Tray Icon Disabled

Due to lack of Java 9+ support in the Java library that creates tray icons, we've disabled the tray icon by default on MacOS. If you want to brave the possibility of it not working or spilling errors in the console, you can re-enable it like so:

Hopefully when the library gets updated, we'll be able to re-enable the tray icon by default.

Release Notes

Here is the complete list of all tickets closed in this release

There are a number of pretty exciting new features and a pile of bug fixes. And as usual, input from the community via Pull Requests. Huge thanks to Pete Freitag, Kai Koenig, Matthew Clemente, Bobby Hartsfield, Scott Steinbeck, Daniel Mejia, and Miguel Mathus! Here's an overview of the new stuff in 5.2.0

Library Updates

We know library updates are boring, but they are important and we want you to know we take them seriously. Keeping up-to-date ensure you have the latest fixes and security updates from all the third-party libs we bundle in CommandBox.

Here's an overview of what we updated in CommandBox 5.2.0.

• Upgraded Runwar from 4.1.2 to 4.3.8

• Upgraded JBoss Undertow from 2.0.27.Final to 2.2.0

• Upgraded UrlRewritesFilter to Ortus fork 5.0.1 with custom fixes

• Upgraded jboss-logging from 3.2.1.Final to 3.4.1.Final

• Upgraded jboss-logging-annotations from 2.1.0 to 2.2.1.Final

• Upgraded JCabi Log from 0.18 to 0.18.1

• Upgraded Apache HttpClient from 4.2.6 to 4.5.12

• Upgraded Apache httpmime from 4.2.6 to 4.5.12

• Removed unused JOpt Simple 5.0-beta-1

• Removed unused Gson 1.2.3

The Undertow bump is a minor update, but a pretty big deal. Ortus sent three pull requests to the core Undertow project fixing bugs and adding predicate logging. All of our pulls were accepted and merged into the core Undertow project and released in the 2.2 release.

Read more about library updates here:

Server Security Profiles

This is a feature that we expect to grow in the future. We've started it out simple, yet powerful but left a lot of room to build on it. The two main goals here are

• Make CommandBox secure-by-default so a server shoved in production comes nice and locked down

• Makes it very easy for you to toggle off all the security stuff for development

CommandBox now has profiles you can assign to a server when you start it to configure the default settings. This is to provide easy secure-by-default setups for your production servers, and to make it easier to switch between a development mode and production mode.

There are 3 currently supported profiles. Custom profiles will be added as a future feature.

• Production - Locked down for production hosting

• Development - Lax security for local development

• None - For backwards compat and custom setups. Doesn't apply any web server rules

In production mode, CommandBox will block access to your CF admin to all external traffic, will block all common config files such as box.json or .env and will block, the "TRACK" and "TRACE" HTTP verbs

You can set the profile for your server in your server.json

Or you can specify it when starting the server like so:

If a profile is not set, CommandBox looks for an environment variable called "environment" or it checks to see if the site is bound on localhost to try and guess the correct profile for you.

We've also added some new flags in your server.json to fully customize how your profile behaves.

‌Read more about Server Profiles here:

Server Rules

This is huge-- probably the biggest chunk of work, and it's actually what makes the server profiles above even possible! It's always been possible to perform basic lock downs with a custom rewrite file, but we've exposed an amazing built-in functionality of Undertow called the Predicate language. It allows you to create ad-hoc rules that apply to your server to provide any of the following:

• Security - Block paths, IPs, or users

• URL rewrites - Rewrite incoming URLs to something different

• Modifying HTTP requests on the fly - Set headers, cookies, or response codes

An example of a server rule using Undertow's predicate language to block access to any box.json files looks like this:

One of the best things about these rules, is they don't have to be in a single monolithic XML file. Instead they can come from

• An array of ad-hoc definitions in your server.json file or config server defaults

• one or more external JSON or text file specified in your server.json or config server defaults

• Built in CommandBox server profiles (see above)

• Custom 3rd party CommandBox modules that contribute rules on-the-fly (time to get creative!)

Here's some examples of what can be in your server.json

CommandBox also registers some custom rules in Undertow you can use for your CF apps:

There are lots of new docs on this. Read more about Server Rules here:

Task Runner Lifecyle events

The more we use Task Runners for builds, scheduled tasks, and utilities, we've seen the need to have lifecyle events in the same manner as the preHandler and postHandler sort of stuff in ColdBox MVC. Now if a task runner has methods of this name, they will be executed automatically.

• preTask - Before any target in the task

• postTask - After any target in the task

• aroundTask - Wraps execution of any target in the task

• pre- Before a specific target

• post- After a specific target

• around - Wraps execution of a specific target

• onComplete - Fires regardless of exit status

• onSuccess - Fires when task runs without failing exit code or exception

• onFail - Fires if exit code is failing after the action is done (always fires along with onError, but does not receive an exception object). Use this to respond generally to failures of the job.

• onError - fires only if an unhandled exception is thrown and receives exception object. Use this to respond to errors in the task. Does not fire for interrupted exceptions

• onCancel - Fires when the task is interrupted with Ctrl-C

The lifecycle methods are very powerful and can be controlled via whitelist and blacklists to control what targets they execute for. "Around" events are very easy to use thanks to the use of closure. There's a lot more details in the docs.

Read more about Task Runner Lifecyle events here:

System Setting ${} Namespaces

The default namespace when using the $ {foo} system setting expansion syntax is box environment variable, Java system properties, and OS environment variables.

It is also possible to leverage built-in namespaces to allow expansions that reference:

• server.json properties

• box.json properties

• arbitrary JSON file properties

• Config settings (like the config show command)

• Server info properties (like the server info property=name command)

• Other properties in the same JSON file

This gives you a lot more power now to be able to create dynamic configuration in your JSON files and even from the command line. Here are some examples:

And one of the coolest things is this implementation is driven by a new onSystemSettingExpansion interception point and completely extendable! That means you can write a module that powers something hypothetical like this:

Read more about System Setting namespaces here:

GZip Compression Control

CommandBox has had the ability to enable/disable GZip compression in Undertow for a while. Now you can fully control when it activates based on the type or size of file, etc. This feature utilizes the same Undertow predicate language that we introduced above.

Read more about GZip Compression Control here:

Generic Watch Command

This is a fun one. There are some specific commands that make use of the Watcher library in CommandBox such as testbox watch and coldbox watch-reinit. However, there is also now a generic watch command that will run any arbitrary command of your choosing when a path matching your file globbing pattern is added/updated/deleted. Use this to build custom watchers on-the-fly without needing to touch any CFML code to write a Task Runner.

That command will echo out "config files updated!" every time a JSON file gets changed in the current directory. Here's a more complex one:

That one will list every new file that's added in this directory and all sub directories.

Read more about the generic watch command here:

Control Default Browser

There are a handful of features in CommandBox that will open URLs for you in your default browser. We've had requests to allow the browser in use to be customized, so we've reworked all of that logic, consolidating it in some places and now you can control what browser CommandBox uses. To change the default browser for all URL opening functions use this:

Supported browsers are:

• firefox

• chrome

• opera

• edge (Windows and Mac only)

• ie (Windows only)

• safari (Mac only)

• konqueror (Linux only)

• epiphany (Linux only)

And you can even dial in a browser on demand for the browse and server open commands.

Read more about setting the default browser here:

Miscellaneous

Here are some honorable mentions.

.htaccess rewrite flags

The CommandBox Tuckey rewrites allow an .htaccess file that uses the mod_rewrite style syntax of rewrites. Previously, use of flags such as these didn't work:L

Server restart from tray icon

We've added a "restart" option to the tray icon that does exactly what you think it does.

Trick for "cd"ing up directories

There's a new trick supported in CommandBox's shell that we've borrowed that allows you to change directories and go "up" more than one directory with less typing:

Pipe into standard input of native binaries

You can now pipe the output of a previous command in CommandBox directly to a native binary like so:

In this case, clip is a Windows binary that will read the standard input and place that text on the clipboard.

Breaking Changes

We work hard to make every CommandBox upgrade backwards compatible. There's a couple things that you may notice different in this release. They're both done to put security first and can be modified to get your original behavior back.

Since the CF Administrator is now blocked for traffic not coming from localhost when in production mode, you may need to explicitly open up the CF admin to make it accessible again if you needed it open to the public on a production server. Even with the profile set to production, you can activate just the CF admin like so:

The web server built into CommandBox will now only serve static files if their extension is found in a whitelist of acceptable files. This is to prevent prying eyes from hitting files they shouldn't be able to access on your server. The current list of valid extensions is:

If you have a common static file you need to serve, you can add your own custom extensions to the list like so:

And if you think we've missed an obvious one that deserves to be added to the default list, please let us know.

Release Notes

Here's the full list of tickets in the 5.2.0-RC.1 release.

Bug

New Feature

Task

Improvement

Sub-task

In this section you will find the release notes for the 4.x version of CommandBox.

• Version 4.8.0 - Sept 2019

• Version 4.7.0 - June 2019

• Version 4.6.0 - Mar 2019

• Version 4.5.0 - Dec 2018

• Version 4.4.0 - Nov 2018

• Version 4.3.0 - Oct 2018

• Version 4.2.0 - Aug 2018

• Version 4.1.0 - Jun 2018

• Version 4.0.0 - Jun 2018

This release was primarily to address a regression in 5.1.0 affecting Mac OS users who tried to start Lucee servers. If you see an error similar to this on a Lucee server and you're running a Mac and CommandBox 5.1.0, then this release will fix it for you.

lucee.runtime.exp.NativeException: mac os x is not a supported OS platform.

If you are upgrading from CommandBox 5.1.0, there are only a handful of tickets which are listed below. If you are updating from an earlier version of CommandBox, please check out our 5.0.0 and 5.1.0 release blogs.

Release notes

Bug

• [COMMANDBOX-1107] - Overzealous gitignore matching of parent directories when zipping up for ForgeBox storage

• [COMMANDBOX-1173] - Enabling SSL results in some CFHTTP requests to fail.

• [COMMANDBOX-1178] - writedump failing in Lucee

• [COMMANDBOX-1179] - File globbing matching partial file names

Improvement

• [COMMANDBOX-1181] - Allow for verbose startup without debug logging of requests

Java 14 support

Java 14 is now supported in CommandBox 5.1.0. In order to support Java 14, we had to stop using Pack200 which means the binary sizes have grown a little. The good news is CommandBox will start up a little faster on its first run since there's less to unpack now.

Start pure HTML Server

You can start up a lightweight server that only serves static files now with CommandBox.

server start cfengine=none

https://commandbox.ortusbooks.com/v/5.1.0/embedded-server/start-html-server

New CommandBox Light and CommandBox Thin Binaries

In pursuit of the smallest possible Docker images, we have CommandBox light which is built on Lucee Light. We also have a box "thin" binary you can swap out with the full self-extracting binary when using CommandBox in custom docker images. Check out Pete Freitag's Minibox image to see both of these in use in a super tiny 78 Meg docker image. More docs here:

https://commandbox.ortusbooks.com/v/5.1.0/setup/light-and-thin-binaries

Force working directory when starting

If you're using box in an integration where you want it to start up in a specific working directory, there is a new bootstrap CLI arg for that.

box -cliworkingDir=C:/my/path/here/

https://commandbox.ortusbooks.com/v/5.1.0/usage/execution#custom-working-directory

Server tray menu item custom commands

You've always been able to specify custom menu items in your server.json or global config settings, but we've kicked it up a notch. Not only can you contribute to existing sub menus now, you can execute arbitrary native commands synchronously or async.

{
    "trayOptions" : [
        {
            "label" : "Does the Internet work?",
            "action" : "run",
            "command" : "ping google.com"
        },
        {
            "label" : "Math is math!",
            "action" : "runAsync",
            "command" : "calc.exe"
        },
        {
            "label" : "Update dependencies",
            "action" : "runTerminal",
            "command" : "box update"
        }
    ]
}

Release Notes

Here's the full list of tickets closed down in the 5.1.0 release.

Bug

• [COMMANDBOX-1121] - Runwar deadlocks when using Lucee server warmup flag

• [COMMANDBOX-1122] - Server start console output isn't always formatted correctly

• [COMMANDBOX-1125] - Boolean env var causes error on server start

• [COMMANDBOX-1127] - Output of foreach can't be piped

• [COMMANDBOX-1133] - Lucee Extension install doesn't recognize Lucee Light

• [COMMANDBOX-1135] - Package unlink command misspelled parameter moduleDirectory as moduleDrectory

• [COMMANDBOX-1137] - Package link command misspelled parameter moduleDirectory as moduleDrectory

• [COMMANDBOX-1140] - Tab complete doesn't work on Windows paths with backslashes

• [COMMANDBOX-1144] - CommandBox Watcher shows error on Ctrl-C

• [COMMANDBOX-1148] - Extension management doesn't "recognize" a Lucee server started with --dryRun

• [COMMANDBOX-1151] - Downgrading a package with install doesn't work without --force

• [COMMANDBOX-1152] - The run command doesn't always seem to kill interactive binaries

• [COMMANDBOX-1154] - Relative paths incorrect in drive root on *nix

• [COMMANDBOX-1166] - Using a warPath of ./ gets normalized to "" and then ignored in subsequent starts

• [COMMANDBOX-1176] - native commands with * can fail due to missing regex escape

• [COMMANDBOX-1177] - Incorrect serverInfo for a server that hasn't started

New Feature

• [COMMANDBOX-1015] - Allow arbitrary actions for menu items

• [COMMANDBOX-1019] - Allow to start a pure HTML server

• [COMMANDBOX-1130] - Update ColdBox Templates to new standards

• [COMMANDBOX-1145] - Allow default working dir of box to be overridden

• [COMMANDBOX-1146] - Create box-thin binaries that don't bundle any libs

• [COMMANDBOX-1147] - Create CommandBox Light built that uses Lucee Light jar

• [COMMANDBOX-1153] - Add two new methods to commands for working with async futures: getCurrentThread() getThreadName()

• [COMMANDBOX-1170] - TestBox run commands now support the outputFormats argument to allow you to output post-test reports in many formats

• [COMMANDBOX-1171] - TestBox revamped UI for the CLI reporter

• [COMMANDBOX-1172] - Add Java info debug to box binary

Task

• [COMMANDBOX-1102] - Add Java version as info log

Improvement

• [COMMANDBOX-1080] - Provide way to disable server instance icon in MacOS dock

• [COMMANDBOX-1126] - Add --full flag to dir command to output full path

• [COMMANDBOX-1129] - Rework the server list command so it is more performant

• [COMMANDBOX-1132] - Bump to Lucee 5.3.6.61

• [COMMANDBOX-1134] - Tab complete for sort options in dir command

• [COMMANDBOX-1143] - Have the ProgressableDownloader send an Accept header

• [COMMANDBOX-1150] - Don't overwrite lucee-server.xml file when updating libs

• [COMMANDBOX-1155] - Auto-detect *unix distros with non-bash shells

• [COMMANDBOX-1156] - Copy lco files so Lucee server can start on CommandBox Light

• [COMMANDBOX-1168] - Reset console window title after `run` executes a process

Upgrade Compatibility

Even though this is a new major version, it should be very backwards compatible. CommandBox proper has no known backwards compatibility issues we're aware of, but note we've bumped libraries like Lucee Server, Undertow, and Java support, so you may notice differences due to these 3rd party lib updates. For example, one breaking change in Lucee 5.3 (which now powers your default server) is how page output buffer is handled.

You should be able to simply replace your box.exe binary and run it to get the same in-place upgrade you're used to. If you run into issue, you can try removing the "engine" folder in your ~/.CommandBox folder and try again. If you need to downgrade for any reason, replace the box binary with the old version, remove the "engine", "cfml", and "lib" folders in your CommandBox home and they will get re-created on the next run.

You may also notice the box binary is larger now. From 44 Megs up to 77 Megs. This is a regrettable byproduct of us turning off the Pack200 process we used to run against the Lucee jar. Lucee seems to have some bugs that causes it to re-download a bunch of OSGI bundles when we compress them and we can't figure it out, or get support on the matter, so for now we're just not compressing as much stuff. This was a huge blocker for anyone needing to run CommandBox on a PC with no external internet access as Lucee provides no mechanism to turn off it's auto-download behavior.

And finally, if you have installed any custom OSGI bundles into your CLI, they will be wiped by the upgrade process now. We didn't want to have to to do this, but Lucee has bugs that cause errors when doing in-place upgrades with the old OSGI bundles left in place and we couldn't get it fixed, so this was the only way to ensure in-place upgrades would "just work" without errors. We are leaving the Lucee engine folder, so any settings you may have put into your CLI should remain in place.

What's New?

There's a lot of new stuff in CommandBox 5.0.0. Here's an overview. One of the biggest new "features" is you can finally use CommandBox on Java 11+. This was not possible in CommandBox 4.x due to the version of Lucee not fully supporting newer versions of Java. Now that Lucee has been bumped to 5.3 (see below) you are free to leave java 8 behind for the CLI. Note if you're using CommandBox to start up older versions of Adobe CF or Lucee/Railo, you may still need to use java 8 specifically for your servers.

New Libraries

Let's start with the library updates. For the most part, all the jars we bundle are a "black box" but in reality, every update is usually for new features, fixes, or security patches. Here's an overview of the new libs:

• WireBox 5.6.2

• JLine 3.13.0

• Runwar 4.0.3 (major bump from 3.x)

• JBoss Undertow 2.0.27.Final (major bump from 1.x)

• JGit 5.5.1.201910021850-r

• Lucee 5.3.4.77("major" bump from 5.2)

• AdoptOpenJDK jdk-11.0.6+10 (In the JRE-included download) (major bump from 8.x)

New Features/Enhancements

You can now use user/pass or personal access token authentication when cloning Git repos over HTTPS. This has been tested with Github and Gitlab and is an alternative to SSH keys. Please check the docs, as Github and Gitlab both expect slightly different inputs.

install git+https://username:password@domain.com/user/repo.git
or
install git+https://AccessTokenHere@github.com/user/repo.git

There is a new Lex installation endpoint to help you acquire Lucee Extensions your app needs via the "install" command or a dependency in your box.json file. If the current directory has a Lucee server in it, CommandBox will install the extension file directly into your server's "deploy" folder (server context)

install lex:https://downloads.ortussolutions.com/ortussolutions/lucee-extensions/ortus-redis-cache/1.4.0/ortus-redis-cache-1.4.0.lex

The auto-install feature into your server will work on any Lex package, even one coming from ForgeBox:

// ForgeBox slug for Ortus Redis Extension
install 5C558CC6-1E67-4776-96A60F9726D580F1

Tuning your server is easier now. You can configure your Undertow worker-threads setting with first-class server.json property

server set web.maxRequests=200

Which gives you this in your server.json

{
  "web" : {
    "maxRequests" : 200
  }
}

We've also unlocked a method for you to set ANY valid Undertow option or XNIO option. So if Undertow supports it, you can configure it!

server set runwar.undertowOptions.ALLOW_UNESCAPED_CHARACTERS_IN_URL=true

server set runwar.XNIOOptions.WORKER_NAME=myWorker

We've added a new experimental feature that lets you create a batch file, powershell script, or bash shell script that directly starts a server with the exact settings that you get from "server start". This is for you to create super-optimzed startups in Docker or Service that bypass the CLI steps and "lock in" the settings. No server.json or CFConfig, or dotenv code will be processed, but you will have a fast streamlined start that is the same every time. Couple this with our new "dryRun" flag on server start that will unpack the CF engine, but not actually start the server, and you can create your customs start script like so:

server start --console --dryRun startScript=bash startScriptFile=startmebaby.sh

// Later directly from bash...

./startmebaby.sh

The Globber helper can now take more than one globbing pattern. This also means every built-in command in CommandBox that takes a globbing pattern, can now take a comma delimited list of patterns. We've also added an exclude list of globbing patterns to the dir command as well.

dir **.cfc,*.cfm
dir paths=modules excludePath=**.md --recurse
dir paths=samples sort="directory asc, name desc"

We've got a couple new handy commands to help you from the command line, "unique" (modeled after the Bash "uniq" command)

cat names.txt | unique
cat names.txt | unique --count

And "sort" (modeled after the Bash "sort" command)

cat names.txt | sort
cat names.txt | sort type=text
cat names.txt | sort type=numeric
cat names.txt | sort direction=desc

The "grep" command has received a "count" parameter if you just want the count of lines that match the regex (or no regex will count all lines)

dir **.cfc | grep --count

dir | grep .*\.md --count

The tray icon for your servers now has a new option under the "Open" menu that will open up the file system folder where the server home lives. This is nice for finding your CF Engine's log files.

Release Notes

There are a lot of bug fixes and even more enhancements I didn't cover above. You can read the full release notes here:

Sub-task

• [COMMANDBOX-1069] - Remove extra stashes on url paths when servlet init params starts with WEB-INF

Bug

• [COMMANDBOX-643] - Tray Icon not displaying on Debian8

• [COMMANDBOX-711] - X Window Errors

• [COMMANDBOX-812] - "Coldbox create resource" uses wrong paths on Windows

• [COMMANDBOX-941] - urlrewrite.xml has file size of 0 on docker restart but not regular start

• [COMMANDBOX-946] - CommandBox instances crashing because of TrayIcon rendering

• [COMMANDBOX-975] - CommandBox always reads STDIN even when in non-interactive mode

• [COMMANDBOX-980] - Using zsh exits out of CommandBox when running a binary command

• [COMMANDBOX-992] - Shebang scripts no longer work without .cfm extension

• [COMMANDBOX-1005] - If custom rewrite file is already in correct destination, runwar overwrites it as 0 bytes

• [COMMANDBOX-1008] - worker-threads setting no longer has any affect

• [COMMANDBOX-1009] - Tray icon not showing in Ubuntu 18.04

• [COMMANDBOX-1013] - Undertow error output when starting server

• [COMMANDBOX-1014] - [RUNWAR] Tray menu placeholders such as ${Setting: runwar.port not found} are not replaced in sub menus

• [COMMANDBOX-1022] - regex string index out of bounds exception

• [COMMANDBOX-1035] - URL Rewrites fire incorrect on URL containing a space

• [COMMANDBOX-1036] - Browser doesn't open when server start

• [COMMANDBOX-1037] - Host updater does not work

• [COMMANDBOX-1038] - Server doesn't stop on Windows

• [COMMANDBOX-1043] - ConcurrentModificationException with undertow?

• [COMMANDBOX-1048] - Restrict /dumprunwarrequest to be used only on Unit Testing

• [COMMANDBOX-1050] - Remove trailing slash from Adobe updates path

• [COMMANDBOX-1054] - Default command parameters don't work on commands in namespaces

• [COMMANDBOX-1061] - Command DSL has unexpected behavior with equals sign in positional tokens

• [COMMANDBOX-1062] - Tab complete for negated flags isn't complete

• [COMMANDBOX-1063] - box fails to open in vSphere Web Client console due to outdated JLine jar

• [COMMANDBOX-1068] - Server start doesn't correctly expand relative Java Home directory

• [COMMANDBOX-1070] - slashes into the servlet init param paths

• [COMMANDBOX-1071] - Tray icon doesn't disappear on Windows when server stops from CLI

• [COMMANDBOX-1076] - Install dependency from box.json with env var placeholder gets overwritten with actual value

• [COMMANDBOX-1077] - coldbox create resource command ignores specsDirectory argument

• [COMMANDBOX-1079] - foreach cannot be interrupted with Ctrl-C

• [COMMANDBOX-1081] - validate non-numeric exit codes from the "exit" command

• [COMMANDBOX-1089] - Task Runner's loadModule() fails on path with period

• [COMMANDBOX-1090] - Tasks don't treat return 1 and setExitCode( 1 ) the same

• [COMMANDBOX-1091] - When a task sets a failing exit code, no output is sent to console

• [COMMANDBOX-1092] - Commands that set a failing exit code don't raise proper exception

• [COMMANDBOX-1098] - foreach, grep, and sed only break on chr(10)

New Feature

• [COMMANDBOX-148] - Ability to install/uninstall box server services

• [COMMANDBOX-715] - Server command to explode server war but not start it

• [COMMANDBOX-1007] - Set any valid XNIO option

• [COMMANDBOX-1018] - Add generic feature to set any valid Undertow option

• [COMMANDBOX-1028] - Allow no rest mappings to be supplied

• [COMMANDBOX-1032] - Tab completion for task targets

• [COMMANDBOX-1052] - New TestBox commands: generate visualizer and generate browser

• [COMMANDBOX-1053] - Update ColdBox module templates for 5.0 standards

• [COMMANDBOX-1067] - Expose Undertow worker-threads setting with first-class server.json property

• [COMMANDBOX-1075] - Support HTTPS username/password auth

• [COMMANDBOX-1083] - Option for server start to write file with full start args for direct Runwar call

• [COMMANDBOX-1088] - Add lex endpoint for installing Lucee extensions

• [COMMANDBOX-1096] - Add unique command to filter out duplicates rows of input

• [COMMANDBOX-1097] - Add sort command to sort rows of input

Task

• [COMMANDBOX-964] - Make sure the build works

• [COMMANDBOX-965] - Document Setup in the Repo

• [COMMANDBOX-995] - Vet all changes on Runwar since April 25, 2018.

Improvement

• [COMMANDBOX-885] - Enhance Globber to take more than one pattern

• [COMMANDBOX-886] - Enhance Globber to have exclude patterns

• [COMMANDBOX-963] - Update CLI to Lucee 5.3 and test Java 11

• [COMMANDBOX-1029] - Change CommandBox build to pull Ortus build of Runwar

• [COMMANDBOX-1049] - Output Runwar version and jar path in "info" command output

• [COMMANDBOX-1055] - Need Config for Max Thread Request at runwar

• [COMMANDBOX-1057] - Enhance dir command with new Globber features

• [COMMANDBOX-1058] - Optimize installation of packages with createPackageDirectory set to false

• [COMMANDBOX-1059] - Improve performance of print buffer by using String Builder internally

• [COMMANDBOX-1060] - Add --count flag to grep command

• [COMMANDBOX-1065] - Update CommandBox to Runwar 4.0.0

• [COMMANDBOX-1066] - Upgrade to JGit 5.5

• [COMMANDBOX-1074] - Tie into FusionReactor to report transactions for tasks, commands, etc.

• [COMMANDBOX-1086] - Default location to forgeboxStorage for package init command

• [COMMANDBOX-1087] - Improve default package naming of jar endpoint

• [COMMANDBOX-1093] - Add option to tray menu to open server home directory

• [COMMANDBOX-1095] - Update to latest WireBox

• [COMMANDBOX-1099] - Stop outputting extra line break for commands with no output

Override Config Settings via Env Vars

Every Config Setting can be overridden by convention by creating environment variables in the shell where you run box. This is ideal for CI builds where you want to easily set ForgeBox API keys, or tweak settings for your build.

box_config_endpoints_forgebox_APIToken=my-token-here

# JSON which will be parsed
box_config_proxy={ "server" : "localhost", "port": 80 }

# dot-delimited keys (windows only)
box_config_endpoints.forgebox.APIToken=my-token-here

# array indexes too (windows only)
box_config_foo.bar[baz].bum[1]=test

More Info: https://commandbox.ortusbooks.com/config-settings/env-var-overrides

Override Server Settings via Env Vars

Every server setting can be overridden by convention by creating environment variables in the shell where you run box. This is ideal for CI builds where you want to easily set ports, or tweak settings for your build.

box_server_profile=production

box_server_web_http_port=8080

# JSON which will be parsed
box_server_web_ssl={ "enabled" : true, "port": 443 }

# dot-delimited keys (Windows only)
box_server_web.http.port=8080

# array indexes too (Windows only)
box_server_web_rules[1]=path-suffix(/box.json) -> set-error(404)
box_server_web_rules[2]=disallowed-methods(trace)

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/env-var-overrides

HTTP/2 Support

CommandBox now has out-of-the-box support for the HTTP/2 protocol. It is always enabled by default and browsers will use it when you're serving over HTTPS.

server set web.http2.enable=true/false

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/server-port-and-host#http-2

JMES JSON filtering / jq Command

Thanks to a massive effort from Scott Steinbeck, the CFML world has a new CF implementation of the JMES spec, which is what powers the popular "jq" (or JSON Query) bash command. We've plugged this new library into CommandBox and exposed it in the following ways.

We've added a new jq command which behaves roughly like the bash counterpart. You can pipe in JSON, or read the JSON from a file and apply a JSON query against it which can be used to filter, massage, rewrite, map, or filter the JSON into a new JSON object.

# Return array of dependency names
package show | jq keys(dependencies)

# Find dependencies with "cb" in their name
package show | jq key_contains(dependencies,'cb')

We've also added the ability to specify powerful jq filters to the "package show", "server show", and "config show" commands directly. Just prefix your filter with the text "jq:" like so:

config show jq:endpoints.forgebox.apiToken
# .. is the same as ...
config show endpoints.forgebox.apiToken

# or you can get fancy...
config show 'jq:keys(modules)'

# Impress your friends
package show "jq:[name,version]"

# Be the life of the party
package show "jq:contributors|split(@,' ')" 

The jq command and JMES spec are very powerful and probably do much more than you realize! Make sure you check out the docs for more ideas.

More Info: https://commandbox.ortusbooks.com/usage/jq-command

AJP Secret Support

CommandBox's AJP listener (provided by Undertow) is already protected against the Ghostcat vulnerability. However, if you would like to set up an AJP secret as well to ensure all requests coming into the AJP listener are from a trusted source, you can do this by setting the web.ajp.secret property.

server set web.AJP.secret=mySecret

For this to work, you must also configure your AJP proxy in your web server to send the same secret!

More info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/server-port-and-host#ajp-secret

AsyncManager Available to Task Runners and Commands

We've updated the version of WireBox inside the CLI and now have access to the AsyncManager for sweet threading and scheduled task support.

// Parallel Executions
async().all(
    () => hyper.post( "/somewhere" ),
    () => hyper.post( "/somewhereElse" ),
    () => hyper.post( "/another" )
).then( (results)=> logResults( results ) );

CommandBox is using an AsyncManager scheduled task thread now to redraw interactive jobs and progress bars. Look out for some new eye candy hiding in your server starts and package installs!

More Info: https://commandbox.ortusbooks.com/task-runners/threading-async#asyncmanager

New Table Printer

The print helper in commands and Task Runners has a new toy that will print ASCII representations of tabular data thanks to a pull request from Eric Peterson. You can see it in the output of the outdated command.

And you can use it in your Task Runners like so:

print.table(
	[ 'First Name', 'Last Name' ],
	[
		[ 'Brad', 'Wood' ],
		[ 'Luis', 'Majano' ],
		[ 'Gavin', 'Pickin' ]
	]
);

ColdBox Scaffolding for REST Handlers

When scaffolding ColdBox handlers, we have support for ColdBox 6.x REST Handlers now.

coldbox create handler --rest

Experimental Server Features

You can enable extra Resource Manager Logging when troubleshooting file system issues:

server set runwar.args="--resource-manager-logging=true"

You can force case sensitivity on a Windows server:

server set runwar.args="--case-sensitive-web-server=true"

You can force case Insensitivity on a Linux server:

server set runwar.args="--case-sensitive-web-server=false"

You can enable a cache of file system lookups of servlet paths. This is only for production and will eliminate repeated file system hits by your CF engine, such as checking for an Application.cfc file on every request, or testing where the servlet context root is. Standard Adobe ColdFusion installations have a similar cache of "real" paths from the servlet context that is tied to a setting in the administrator called "Cache Webserver paths" but that setting is not available and does not work on CommandBox servers for some reason. This setting would apply to any CF engine.

server set runwar.args="--cache-servlet-paths=true"

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/experimental-features

HTTPS Redirect/HSTS

When using a CommandBox web server in production, you may wish to force your users to visit your site over HTTPS for security (and for HTTP/2 to work). However, it is desirable to still have your web server listening on HTTP so a user just typing your address in his browser can still connect to HTTP and then redirect. CommandBox can be configured to redirect all HTTP traffic over to HTTPS with the following setting.

server set web.SSL.forceSSLRedirect=true

If you want to go one step further, you can add a Strict-Transport-Security header to your site. This instructs the browser to automatically use HTTPS every time the user visits your site again.

server set web.SSL.HSTS.enable=true
server set web.SSL.HSTS.maxAge=31536000
server set web.SSL.HSTS.includeSubDomains=true

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/https-redirect-hsts

Force Colored Output in your Builds

CommandBox won't use ANSI color formatting when running inside of a non-interactive terminal. However, build servers such as Gitlab or Jenkins (via a plugin) support ANSI color sequences. You can force CommandBox to use colored text output with this new setting:

config set colorInDumbTerminal=true

Loose Semantic Version Parsing

One of the common hangups for people dealing with Lucee Server and Adobe ColdFusion CF Engines versions, is that CommandBox follows the npm-flavor of the semantic version spec and expects

server start cfengine=lucee@5.3.7+48

instead of

server start cfengine=lucee@5.3.7.48

So we've loosened our sem ver library to treat the 4th number as a build ID if there is no plus sign in the version (instead of just discarding the 4th digit as the spec requires)

Support for "localhost subdomains"

Most modern browsers allow you to make up any subdomain you want before localhost such as mySite.localhost and will simply resolve them to localhost (127.0.0.1) even without a hosts file entry. CommandBox now supports using these domains and will bind your server's ports to localhost even without using the commandbox-hostupdater module.

server set web.host=mySite.localhost

More Info: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/server-port-and-host#a-gracious-host

Relative CommandBox home

You can customize where CommandBox lives by placing a commandbox.properties file next to the box binary. We have better support for relative paths now so you can have portable CommandBox installations such as a thumb drive.

commandbox_home=../customHome

More Info: https://commandbox.ortusbooks.com/setup/installation

Halt Server If Port In Use (Breaking Change)

The only known breaking change in this release is if you try to start two servers on the same HTTP port. Previously, CommandBox would just ignore the port on the second server and choose a random port. Due to the confusion that can cause, CommandBox will now throw an error. If you want to override an explicit port locally, set the port to an empty string or a 0 and CommandBox will choose a random port for you. For example, if you are using the commandbox-dotenv module, you can put this line in your project's .env file to override the port in your server.json

box_server_web_http_port=0

Relative Web Alias Behavior (regression)

If you have a server with the server.json outside of the web root and at least one relative web alias, the alias will not work on the first start of the server. The workaround is to change the web aliases to be relative to the folder that the server.json lives in.

Incompatibility with old DotEnv module

Some users receive the following error when starting CommandBox after updating:

The parameter [name] to function [get] is required but was not passed in.

If you see this, it means you have an older version of the commandbox-dotenv module installed that is not compatible with the new version of WireBox inside CommandBox. To fix, delete this folder out of your CommandBox home:

~/.CommandBox/cfml/modules/commandbox-dotenv

Now the CLI will start and you can install the latest version of dotenv.

install commandbox-dotenv

Release notes

Here is the list of all tickets included in the 5.3.0 release.

Bug

COMMANDBOX-1301 web server aliases in server.json should be relative to the folder of the server.json

COMMANDBOX-1300 ${Setting: serverinfo.foo not found} expansions don't work in a folder that's not the web root

COMMANDBOX-1291 Re-using same server.json with two names doesn't work

COMMANDBOX-1276 Corrupted WireBox metadata cache file will prevent CommandBox from starting

COMMANDBOX-1275 HTTP2 Additional Port Handling and Flexibility

COMMANDBOX-1271 REPL & Command highlighters don't handle square brackets [] well

COMMANDBOX-1270 JVM arg ending in backslash doesn't work

COMMANDBOX-1268 Coldbox Watch-Reinit Watches Unwanted Folders

COMMANDBOX-1263 Package installation doesn't always optimize duplicate packages

COMMANDBOX-1261 Globber.count() bombs if run after .asQuery()

COMMANDBOX-1259 Starting lucee@1.2.3 will use light-light when using CommandBox Light

COMMANDBOX-1255 Loading class files in task runner doesn't work

COMMANDBOX-1253 variables scope doesn't persist between task dependencies

COMMANDBOX-1250 tokenreplace removes BOM from files

COMMANDBOX-1212 trayOptions.json not respecting serverHomeDirectory

COMMANDBOX-664 Server status not always correct.

Improvement

COMMANDBOX-1297 Add singleServerHome option to not auto-deploy different versions of servers

COMMANDBOX-1296 Improve error message if version isn't found in ForgeBox

COMMANDBOX-1295 Loosen parsing of build ID in semver

COMMANDBOX-1292 Treat empty HTTP port the same as 0 (chooses random port)

COMMANDBOX-1290 Remove runwar hack that sets java vesrion

COMMANDBOX-1288 Runwar timesout when Lucee's new warmup flag is used

COMMANDBOX-1287 Add option for PID file

COMMANDBOX-1285 Allow generic override of server start settings via env vars or java sys props

COMMANDBOX-1284 Have parser ignore quotes inside a token

COMMANDBOX-1269 Cache "/" path lookup in Runwar's mapped resource manager

COMMANDBOX-1267 Add setters for run() arguments in CommandDSL

COMMANDBOX-1258 Default embedded server only needs to copy lucee.jar

COMMANDBOX-1256 Have outdated also show latest version of a package

COMMANDBOX-1252 Integrate AsyncManager into CommandBox

COMMANDBOX-1251 Upgrade to latest WireBox 6.x

COMMANDBOX-1249 Bundle testbox in testbox module to prevent auto download

COMMANDBOX-1248 Halt server start if asked for port is in use

COMMANDBOX-1246 the git bullet train car disappears while current working directory is not the root project folder

COMMANDBOX-1216 Support AJP secret in Undertow

COMMANDBOX-1169 Rethink the way the screen is redrawn upon extensive installs so it can be fluent on all screen sizes

COMMANDBOX-1136 Can't link package if no modules are installed

COMMANDBOX-1117 New first-class setting to enable HTTP2

COMMANDBOX-1108 Comment out the default environment vars in .env when createing a new coldbox app

New Feature

COMMANDBOX-1294 Allow server rules to be commented out with #

COMMANDBOX-1293 Allow servers to use random.localhost domains

COMMANDBOX-1289 Integrate JMES JSON filtering

COMMANDBOX-1282 Debug when lucee-extensions don't find Lucee server

COMMANDBOX-1281 Allow JSON service to create implicit arrays

COMMANDBOX-1280 Add config setting to enable ANSI colors in dumb terminals

COMMANDBOX-1279 Allow generic override of config settings via env vars or java sys props

COMMANDBOX-1278 Add --json flag to server list

COMMANDBOX-1277 Add HTTP redirect options

COMMANDBOX-1273 Add optional servlet path cache in Runwar

COMMANDBOX-1262 Allow caching of task runners

COMMANDBOX-1260 Support for generating ColdBox RESTHandlers

COMMANDBOX-1245 Support default module export as @moduleName,

COMMANDBOX-676 Allow commandbox_home to be relative

There is now a new "forgebox logout" command you can use for testing or just to remove your API token from the local CLI.

# Logout one user
forgebox logout username

# logout all users
forgebox logout

You can change CommandBox's default tab completion to be an inline list that follows your cursor. This setting requires you to close and re-open the shell to take affect.

config set tabCompleteInline=true

Read more here:

https://commandbox.ortusbooks.com/config-settings/misc-settings#tabcompleteinline

We've added better debugging information for Server Profiles. If you add the --verbose flag to your server start, you'll be able to see what profile was detected for your server, and what baked-in rules have been turned on as a result.

|------------------------------
   | √ | Setting Server Profile to [development]
   |   |------------------------------------------------------
   |   | Profile set from "environment" env var
   |   | Block CF Admin disabled
   |   | Block Sensitive Paths enabled
   |   | Block Flash Remoting enabled
   |   | Directory Browsing enabled
   |   |------------------------------------------------------

We've added a new Single Server Mode you can enable in the CLI to make using CommandBox in Docker images easier.

Read more here:

https://commandbox.ortusbooks.com/embedded-server/single-server-mode

Release Notes

Here are the release notes for the 5.2.1 release.

Bug

• [COMMANDBOX-1231] - Installing via lex endpoint uses incorrect file extension

• [COMMANDBOX-1232] - Location of predicate file is in a folder that the Docker finalization script deletes

• [COMMANDBOX-1238] - Command alas for run command doesn't expand properly

New Feature

• [COMMANDBOX-1237] - Add config setting to activate JLine's AUTO_MENU_LIST

• [COMMANDBOX-1240] - forgebox logout command

Improvement

• [COMMANDBOX-1227] - verbose server start output for profile and security settings

• [COMMANDBOX-1228] - Extend ${} scopes to apply to any getSetting() call or "env show" command

• [COMMANDBOX-1229] - Modules aren't unloaded on reload or shutdown

• [COMMANDBOX-1233] - Add debug output that shows location of commandbox.properties file on start

• [COMMANDBOX-1234] - Add single server mode for CommandBox in a Docker container

• [COMMANDBOX-1236] - Add Testbox runner to sensitive paths in production profile

• [COMMANDBOX-1241] - Use UTF-8 when reading files with "cat" command