In this section you will find the release notes for the 5.x version of CommandBox.

• Version 5.9.1 - August 2023

• Version 5.9.0 - May 2023

• Version 5.8.0 - April 2023

• - December 2022

• - September 2022

• - May 2022

• - May 2022

• - October 2021

• - September 2021

• - August 2021

• - May 2021

• - Dec 2020

• - Nov 2020

• - June 2020

• - May 2020

• - Mar 2020

In this section you will find the release notes for each version we release under this major version. If you are looking for the release notes of previous major versions use the version switcher at the top left of this documentation book. Here is a breakdown of our major version releases.

• Versions 6.x - Feb 2024 -

• Versions 5.x - Mar 2020 - August 2023

• Versions 4.x - Jun 2018 - Sept 2019

• - Feb 2016 - Nov 2017

• - June 2015 - Nov 2015

• - Feb 2015

This is a very small release with two changes.

• Update to Lucee 5.4.3.2

• Update bundled JRE to 11.0.20+8

Note Lucee 5.4.3.2 contains critical security patches which are outlined here:

https://dev.lucee.org/t/lucee-critical-security-alert-august-15th-2023-cve-2023-38693/12893

The new Lucee version affects the core CLI runtime as well as the default server you get when running "server start" with no cfengine specified. Possible compatibility issues related to the major bump in Lucee version:

• This Lucee version does not include Hibernate, so the Ortus Hibernate extension is installed. We will stop doing this in 6.0

• This Lucee version has strict XML parsing settings on by default which may affect any servers you start which parse XML containing DTDs.

If you do run into XML errors, this code may help you in your Application.cfc, which allows DTDs, but still disallows XML external entities (XEE).

Release notes

Task

• Update bundled JRE to 11.0.20+8

• Update to Lucee 5.4.3.2

• There is a fix for a regression introduced in 5.4.0 where updating the version of a CF engine doesn't work without forgetting the server first.

• There is also an important security improvement to CommandBox servers. Thanks to Abram Adams for reporting this to Ortus so we could address it.

In this section you will find the release notes for the 3.x version of CommandBox.

• - Nov 2017

• - Aug 2017

• - Jul 2017

This release was primarily to address a regression in 5.1.0 affecting Mac OS users who tried to start Lucee servers. If you see an error similar to this on a Lucee server and you're running a Mac and CommandBox 5.1.0, then this release will fix it for you.

If you are upgrading from CommandBox 5.1.0, there are only a handful of tickets which are listed below. If you are updating from an earlier version of CommandBox, please check out our and release blogs.

Release notes

In this section you will find the release notes for the 4.x version of CommandBox.

• - Sept 2019

• - June 2019

• - Mar 2019

In this section you will find the release notes for the 1.x version of CommandBox.

• - Feb 2015

In this section you will find the release notes for the 2.x version of CommandBox.

• - Nov 2015

• - Aug 2015

• - Aug 2015

Properties weren't being read correctly from the server.json file. If you have been using server.json, please double check the format of the file here in our docs:

This fix will make this functionality work as expected:

Upgrading

If you already have 3.0.0 then this fix only affects the CFML bits and is very easy for you to install. Simply run this command:

There are a lot of new features in CommandBox 6. Here's an overview of the biggest ones. Check out the release notes for the full list.

Multi-Site Servers

This one is huge. It's the hallmark feature of CommandBox 6 and allows you to easily run as many web sites (with different web roots) in a single CommandBox server. This finally gives you the same behavior you get with Adobe ColdFusion and IIS or Lucee/Tomcat and Apache with mod_cfml. CommandBox has had built-in ModCFML support for a while, but it still needed a web server in front to work fully. CommandBox Multi-Site gives you a fully powered web server that allows you to define as many separate web sites as you like, each with COMPLETE configuration control, all inside a single server process.

• Rewrites

• web aliases

• security profile

• HTTP/SSL/AJP bindings

• SSL Certs

• welcome files

• MIME types

• GZIP settings

• Basically everything can currently configure under the "web" object of your server.json can be set on a per-site basis!

CommandBox is now truly a One-Stop-Shop for running your apps from development to production. You don't need Apache, Nginx, IIS, or Tomcat!

Read more here:

Enhanced Server Bindings

Going hand-in-hand with our Multi-Site features, is the ability to bind to more than one HTTP port, more than one SSL port and more than one AJP port. You can configure proper host name matching on any binding, and even have multiple SSL certs. This new feature is available not only for Multi-Site but also for single site servers. The new server bindings come with a new JSON syntax in the server.json (we still support the old one too)

Read more here:

SSL SNI Support

Going hand-in-hand with our enhanced server bindings, is the ability not only to be able to specify multiple SSL certs per site, but also multiple SSL certs per SSL binding. CommandBox automatically enables SNI (Server Name Indication) which will choose the proper cert based on the incoming host name. With support for PEM files, DER formats, and PFX formats, this really opens up a lot of capabilities.

Read more here:

Rewrite Maps

We added a popular feature from Apache's mod_rewrite called rewrite maps. This allows you to create a simple text file of values you can reference in your rewrite rules to map incoming URL values to another value.

Read more here:

Publish command directly uploads to S3

This is a nice little productivity enhancement. When you run the publish command, the CLI will now directly upload your zip file to S3 instead of sending it to ForgeBox first. This improves the speed and efficiency of your deployments.

Add a proxy server rule alias

This is a simple one. If you want to create a simple reverse proxy to a single back-end server, we've created an alias for the existing load-balanced-proxy() handler called just proxy which accepts a single host with less verbosity.

Read more here:

Specify Package and Server scripts as an array

You're already familiar with specifying package scripts and server scripts in your box.josn and server.json as a string containing one or more commands. Instead of using && for multiple commands, you can also do this by specifying an array of strings instead of a string like so:

This can be much more readable for multiple commands. Note, this is functionality equivalent to using &&, which means any erroring command will stop execution.

Read more here:

ColdBox, TestBox and ContentBox commands are now modules

CommandBox still bundles helpful scaffolding commands for your favorite MVC framework Testing framework, and CMS, but these commands are no longer part of the core CommandBox source code. We've given them new life as independent modules. They are installed by default, but they now have their own lifecycle and can get releases at any time. You can view and update them with the rest of your system modules.

Read more here:

Adobe CF Script Alias

CommandBox adds a /cf_scripts/scripts alias for you any time you start an Adobe CF server. This alias points to the same folders in the root of the Adobe WAR. If you set a custom scripts src path in the CF administrator then you'll want to ensure CommandBox uses the expected alias. There is now a setting called web.adobeScriptsAlias which allows you to control the public, web-accessible path to the scripts folder that CommandBox creates for you. And better yet, if you're using CFConfig, will automatically update the Adobe script source setting to match and vice versa.

Read more here:

CommandBox Pro Config settings auto-sync

As a perk of CommandBox pro, once you log into the CLI with your ForgeBox Pro account, your config settings will now automatically sync to and from ForgeBox. This is a great way to keep multiple CLI instances across computers up to date.

Read more here:

Release Notes

Here are the full release notes for CommandBox 6.0.0

Bug

Some server.json config options unavailable as environment variables

Runwar doesn't load servlet filter mappings correct in web.xml override

semantic version parsing ignores part of pre-release IDs with hyphen

Stackoverflow when using serverinfo system setting expansion in a server script

Lucee Light Engine

Installing package crashes when PackageService cannot delete tmp folder

New Feature

Add a `proxy` server rule alias to `load-balanced-proxy` which takes in one item instead of an array.

Add Rewrite Map feature similar to Apache

Multi-Site mode

CommandBox Pro users get config auto sync

Improvement

box install <package>: constrain to version already defined in box.json

Publish command directly upload to S3

Allow the scripts key under the server.json and box.json to use an array of scripts to run under the same script key name

XML formatting in print helper can kick in a bad time

Allow control over undertow' s transferMinSize

Provide way to escape literal colon (:) command parameter name

Remove contentbox, coldbox, etc modules from the core

Customize Adobe cf scripts alias

Task

Update bundled JRE to 11.0.22+7

Update to Lucee 5.4.4.38

Java 17 Support

Java 17 was a breaking change for Java users as it now blocks illegal reflective access. Both Adobe and Lucee have been slow to address this. Lucee 5.3.10 mostly seems to run on Java 17, but only the public beta of ColdFusion 2023 (Fortuna) supports Java 17. You may want to start testing Java 17 out, so the CommandBox CLI and its servers seem to have basic support for running on Java 17 now. Note, you may need to add additional JVM args to any servers based on the specific Java libraries you use.

Library Updates

We've bumped library versions such as Redhat Undertow to stay current with recent CVE fixes.

Override package install paths

If you have a project and want all packages of a certain type to use a different-than-normal default install location, you can override each package type just for that project. Create an installPathConventions key in the containing package's box.json which is an object containing keys for each package type you wish to override package install paths for.

Read more:

ls --tree

You can get recursive file listings now in a tree view by using the --tree flag

Tree Print Helper

In task runners and custom commands, you can now tap into the same tree printer that the "package list" and "ls --tree" use to output your own ASCII trees.

which outputs

Read More:

Column Print Helper

There is also a print helper method for task runners and custom commands as well as a CLI command you can use that accepts an array or list of simple values and prints them in a column format based on the widest value and the available terminal width.

Read More:

unansi Command

This command will accepted piped text and strip any ANSI formatting from it. Especially useful if piping the text to a native OS binary which doesn't handle formatting well.

clipboard Command

We've introduced a new command for piping text onto your native operating system's clipboard.

Release Notes

Here's the full list of all the changes in CommandBox 5.9.0.

Bug

• [COMMANDBOX-665] - Relative SSL certFile or keyFile path in server.json isn't expanded

• [COMMANDBOX-674] - propertyfile set errors if file doesn't exist

New Feature

• [] - Allow relative property file paths in task runners

Improvement

• [] - Allow custom tray contributions to have relative image path

• [] - Improve coldbox create app --wizard

• [] - Always run onServerInstall

This fixes a bug in the "update" and "outdated" commands that caused them to error after you had installed packages from an endpoint other than ForgeBox. Note, packages installed from HTTP(S) and Git endpoints will always show as outdated and will always update since those endpoints don't provide a way to know what version they're hosting without downloading the entire package anyway.

We also included a small enhancement to the Git endpoint to allow for authentication via public/private SSH keys. As long as you have a public key configured on your Git server and the private key is stored in ~/.ssh/ using a standard name, SSH-based clones should automatically authenticate. Please see the docs for more info.

As always, the CommandBox Getting Started Guide is located here:

http://commandbox.ortusbooks.com/content/getting_started_guide.html

Release Notes

Bug

• [] - update command erroring

New Feature

• [] - Git SSH endpoint private key support

Improvement

• [] - Standardize parameter names for install command

Release Highlights

• Fixed the annoying "server spanner" error that *nix users saw when starting servers.

• Updated CLI engine (and default server) version to

Release Notes

Bug

Some installs unnecessarily write to the box.json

ConfigService::settingExists() fails in race conditions due to non-varscoped variables in JSONService

Release notes

Bug

Server shutdowns aren't always done cleanly

Release Notes

Bug

• [] - Server commands can have huge delay on Windows

• [] - List artifacts alphabetically.

• [] - /usr/bin/open on Linux

• [] - Errors in command CFCs can cause box to exit completely during tab complete

• [] - Running native binary that returns lots of text can perform poorly

• [] - Interceptor service blows up if you register a module with an interceptor not matching any current states

• [] - Allow modules to register an interceptor with no currently valid states

• [] - Catch errors from desktop.isDesktopSupported()

New Feature

• [] - Allow system setting (env var) expansions in REPL

• [] - Improve task DSL to allow access to exit code

• [] - Add config setting to debug raw native command being used in the "run" command

Improvement

• [] - Enforce correct casing conventions on scaffolding commands

• [] - Update propertyFile core module

• [] - Improve default ignores in box.json from init command.

We Love Lucee

The biggest feature is the switch-over from Railo to Lucee as the underlying CLI engine that powers the REPL and commands. The embedded server now also runs Lucee 4.5 as well. If you require a Railo embedded server, you will need to stay on CommandBox 1.1.1 for now.

Check Out The New Stuff

The notable updates include:

• Updated version of JBoss Undertow, which contains security fixes

There is now a new "forgebox logout" command you can use for testing or just to remove your API token from the local CLI.

You can change CommandBox's default tab completion to be an inline list that follows your cursor. This setting requires you to close and re-open the shell to take affect.

Read more here:

We've added better debugging information for Server Profiles. If you add the --verbose flag to your server start, you'll be able to see what profile was detected for your server, and what baked-in rules have been turned on as a result.

We've added a new Single Server Mode you can enable in the CLI to make using CommandBox in Docker images easier.

Read more here:

Here's the full list of what we've packed into the 4.7.0 release. Click any ticket link for more details.

Bug

• [] - CommandBox not recognizing implicit folder endpoint

Release Notes

Bug

Offline Server Starts

One of the biggest pieces of feedback we got from the CommandBox 3.1 release was that it requires an Internet connection to start a server. Since you can specify the version of the server you want to start, including semver ranges like 5.x, this required a trip to ForgeBox to check and see what the best version match was since it might have changed since the last time you started the server.

Now, if you provide an exact CF engine version number (meaning you give us a major, minor, AND patch version) CommandBox will skip phoning home to ForgeBox and will just continue with that version.

Remember that the version "5" de-sugars to "5.x.x" so you need to have all three numbers even if they're "0"

The main features of CommandBox 4.5.0 are:

• Ability to install OpenJDK automatically for your servers to use (read more)

• Environment Variables in the shell (read more)

• Support for Forgebox Enterprise (TBA soon)

• JRE Bundled CommandBox installs now use OpenJDK instead of Oracle JDK

• TestBox Code Coverage integration ()

I already wrote a fairly comprehensive overview of the new features and big fixes here. Go read it:

Note, there are two backwards incompatible changes. The first is we turned OFF directory browsing by default on servers. You can easily get the old behavior back with

The second is that unhandled errors in the shell no longer show the stack trace (you probably wouldn't have noticed if I didn't tell you!) Get the old behavior back with:

Release Notes

Here's the full list of everything that went into this release.

Bug

• [] - editing in the shell prompt is buggy while using Gitbash in VSCode

• [] - Passing positional args to task errors with required param

• [] - Passing command string as single arg to box fails

New Feature

• [] - Add concept of env vars for commands to use

• [] - Add preCommandParamProcess interception point

• [] - outdated commands now verify packages in parallel

Improvement

• [] - Add ETA to progress bar when downloading

• [] - Improve default handling of JVM heap size

• [] - Default directoryBrowsing to false

• [

Improve OS binary execution

You've been able to run OS binaries from the CommandBox interactive shell for a while now which is great for adding native CLI calls to your recipes.

The biggest problem with this though was that no output shows on the screen until the OS command is completely finished and if your OS command blocks for interactivity or just never ends, the CommandBox shell will just "hang" with no output. All that is a thing of the past now. The standard input and output of the OS process is now bound to the standard input and output of your CommandBox shell. That means that you see output as soon as the binary outputs it and if it stops to ask you for input, you can provide it. This opens up a world of possibilities.

• You can ping an address and watch the output stream as the packets return.

• You can do a Git commit and interact with the VI window that appears to capture your commit message.

• You can actually open a bash/DOS shell right inside of CommandBox and then "exit" back to box when you're done.

• Run native commands that collect input from you to continue like a sudo password.

This has been tested and works pretty well on Mac and Windows. Note, we've seen some issues on Linux where output is streamed, but input is not captured.

New interceptor points

• - Always fires before attempting to forget a server whether or not the forgetting is actually successful

• - Fires after a successful server forget. If the forget fails, this will not fire.

Allow spaces in user home directory

This was supported in CommandBox 3.4.0, but we had a regression in 3.5.0 that caused issues for users who have a space in their path to CommandBox's home dir. This has been fixed along with some related issues with the FusionReactor module. Make sure you have the latest Fusion Reactor module once you upgrade to CommandBox 3.6.0.

New Lucee version

The core version of Lucee that the CLI runs on has been updated to 4.5.5.006. Please note this means the default version of Lucee that starts up for your server when you don't specify otherwise will change. If you have settings like datasources and such that you want to keep, make sure you lock in your exact version of Lucee or check into our new CFConfig project for exporting/importing your server settings.

Incorrect exit code from "testbox run"

The testbox run command would return an exit code of 0 when your tests had in fact failed. This has been fixed so you can trust a proper exit code from the process when running your tests inside a Jenkins or Travis CI build.

Global default for HTTP port in config settings

Previously, you couldn't set a global default HTTP port for all your servers. This was on purpose since it didn't really make sense since one one server can use a port at a time. Now, with the introduction of Chris Schmitz's host updater module, you can more easily run each server on a dedicated host name which is added to your host file for you and bound to a unique port. This allows you to run all your local servers on port 80 which is great for cleaning up your local dev. As such, we've added the ability to set the global HTTP port now in your config setting's server defaults.

Release Notes

Here's the full release notes for the 3.6.0 release.

Bug

• [] - Windows CommandBox upgrades fail silently if servers are left running

• [] - Box start error

• [] - All semicolons removed in REPL which breaks some code

Improvement

• [] - improve execution of OS binaries in "run"

• [] - Add xxxServerForget interceptors to the Server lifecycle

• [] - Improve port binding detection

Bug Fixes

This release fixes an issue where Adobe CF servers will not start if you're machine is offline and also fixes a bug where the previous version of CommandBox didn't correctly remove old versions of jar files on upgrade.

Enhancements

Git tags when bumping a package command can have a custom prefix now. Tab completion options are also alphabetized. Ctrl-C is also handled better on Unix and actually works in Windows! Also, the timestamp on your sever.json file won't be updated unless the contents of the file actually changed.

Release Notes

Here is the full list of everything that changed in the CommandBox 3.4.0 release.

Bug

• [] - Adobe Servers won't start offline

• [] - start serverConfigFile=myServer.json doesn't load json settings

• [] - Adobe web.xml Flex config path is wrong after first engine start

New Feature

• [] - allow bump Git tag to have custom prefix

Improvement

• [] - testbox create bdd include describe and it block

• [] - Allow server list to filter partial server names

• [] - Sort tab completion options

Specifying a max heap size for your embedded server

And finally, the ability to install packages from a Git repo is here!

And this nice shortcut for installing from GitHub:

If you've not used CommandBox yet, check out our getting started guide here:

http://commandbox.ortusbooks.com/content/getting_started_guide.html

You can download CommandBox 2.1.0 here on our product page:

Release Notes

Bug

• [] - Piping content to box repl

• [] - Lucee default error template is broken in CLI

• [] - OWASP jars corrupt

• [

Improvement

• [] - Improve parameter escaping when running commands from native OS

• [] - Make ColdBox skeleton hints dynamic by reading folder instead of hard-coded values

• [] - Increase the size/resolution of the icon

New Feature

• [] - Additional install endpoints

• [] - Git endpoint

• [] - Update all tray icons to CommandBox latest icons

• [

Iterate over JSON with foreach command

The foreach command which was introduced recently and allows you to iterate over any list of input and run a command using each item in the list has been enhanced to also allow you to iterate from the CLI over any JSON string that you pipe in.

https://commandbox.ortusbooks.com/usage/foreach-command#iterating-over-json

Directory Watchers have more data

Now when you create a directory watcher in a task runner or custom command, you can not only get notified when something in that directory changes, but you also now receive a list of files added, removed, and modified.

New "coldbox watch-reinit" command

Thanks to Scott Steinbeck, we have a new command called coldbox watch-reinit. This will watch for changes to certain files in your project and will automatically issue a framework reinit when you edit things like configs or services.

Color all the JSONs

Thanks to John Berquist, CommandBox now has sweet color coding any time it outputs JSON to the screen. Try it out by running something like "server show".

Users can also customize the colors they see for JSON with the following config settings:

• json.ansiColors.constant

• json.ansiColors.key

• json.ansiColors.number

Setting values can be any color name from the system-colors command.

New Gist endpoint

Thanks to Jason Steinshouer we have a new Gist endpoint for installing code from a public Gist.

4.4.0 Release Notes

Bug

• [] - testbox watcher shows error when test fail

• [] - Tab complete doesn't work on param values with spaces

• [] - Long lines wrap in interactive jobs

New Feature

• [] - Allow watcher access to files that were added, removed, updated

• [] - coldbox watch-reinit command

• [] - Color code JSON on console output by default

Improvement

• [] - Refresh any salt values when deploying a new CF engine.

• [] - Add Gist endpoint

• [] - Change update behavior of GIT and URL endpoints to use semver in path if present

Cached HTTP Downloads

You can now cache downloads using the HTTP(S) endpoints using the following syntaxes:

This will speed up builds.

After almost a year in development, we are so excited to finally announce the release of . This has been definitely one of the most challenging and fun projects we have overtaken here at Ortus. We had a vision of how we could accelerate not only development, tools and ultimately the ColdFusion (CFML) landscape by building a tool that could put us up to par with many other technologies. I am glad to say we have now a great foundation to move forward. CommandBox brings CFML to any Operating System and even embedded systems like the Raspberry and Banana Pi. It also gives ColdFusion (CFML) developers a much better workflow to work with their projects and a sense of community we lovingly call .

With anything we do here at Ortus, it is fully documented using our new book formats. So head on over to to download or read the entire CommandBox documentation. In the next coming weeks we will begin our CommandBox 5-week roadshow that will include weekly blogging tutorials and video presentations, so stay tuned as each week progresses. So without further ado, I present to you project Gideon: CommandBox CLI!

web.xml Overrides

When you start an Adobe or Lucee CF Engine, the WAR CommandBox uses has a stock web.xml baked into it. Sometimes you may want to add custom servlets, servlet mappings, etc into your server. You can override the stock web.xml in part or in total with a file of your own which you specify in the server.json like so:

More info here:

https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/web.xml-overrides

Funky Parameters

In addition to quoting parameter values, parameter names can also be quoted. This is useful when setting keys into settings or JSON files that have spaces, hyphens or special characters. Each of these examples are now supported:

More info here:

Library updates

Lucee Server has been updated to 5.3.8.201 and JBoss Undertow has been updated to 2.2.10.Final. The Lucee update, as usual, applies to the CLI as well as the default server you get when you run server start.

Smarter Jar Endpoint

When you install a Jar via HTTP URL and the version number is baked into the URL, the jar endpoint now makes more assumptions about what the version of the package is that allows it to optimize the update checks and eliminate unnecessary downloads.

More info here:

ask and confirm commands

Here are some fun commands for user interactivity in the shell. You can use these as part of a recipe or a nice "one-liner".

ask

The ask command is similar to the ask() method in Task Runners. It requires an interactive terminal and will ask the user a question and return their answer. It is meant to be changed with other commands.

or with default values

or with masked input

Or fun stuff like this

confirm

The confirm command will ask the user a yes/no question and return a passing or failing exit code from the command based on the answer.

Remember the && operator will only execute the second command if the first command returns an exit code of 0.

More info here:

server prune command

You can easily forget all servers which have not been started for a certain period of time with the server prune command. It accepts the number of days that need to have passed since a server was last started in order to prune it.

More info here:

Release Notes

Here are the full release notes for CommandBox 5.4.0

Bug

Cancelling a prompt with active job doesn't clear job logs

Param tab completion is off-by-one when piping

Can't list files in directory with brackets ( [ or ] ) in the name

forgebox timeout is too small when publishing packages

dir command returns no results in drive root

Summary over 200 chars in box.json causes error when publishing

Addition of Apache logging classes breaks 3rd party libs using it

Installing a system module as one-off command doesn't clear wirebox metadata cache

Commenting server rules doesn't work correctly in text files

CommandDSL doesn't handle struct args

create a server prune command

Server start can hang when CF engine blows up

Tab complete doesn't work after a pipe

Working dir of server custom menu items doesn't default properly

Error when setting failing exist code in Task Runner

updating commandbox to 5.3.1 via Homebrew breaks with a java error

Rewrite rule with query string doubles up question mark

printTable column validation breaks with spaces in list

Directory listing not showing folders properly when names are numeric

Certain Java installs fail version check

Improvement

ask and confirm command to capture user input from shell

Improve version handling in JAR endpoint

Update to Lucee 5.3.8

Support dots in struct keys with set/show/clear commands

printTable custom header names for non-array input

Add printTable check for data with no columns

Sort column names in printTable --debug

New Feature

Set env vars directly in server.json for local one-off overrides

Support web.xml Overrides

Task

Update to Undertow 2.2.10.Final

ModCFML Support

ModCFML is a popular standard for running a CF server behind IIS or Apache web server and allowing your virtual hosts configured in the web servers to control the web root of the CF server so you can run more than one site on a single CF instance. CommandBox has historically only had a single web root per server, but now you can use a single CommandBox instance to power as many Adobe CF or Lucee Server sites as you like. CommandBox's ModCFML just needs to be enabled and can work with BonCode, mod_cfml or Nginx.

server.json

Read more here: https://commandbox.ortusbooks.com/embedded-server/modcfml-support

Log4j 1.x is gone!

CommandBox's core is now 100% free of 1.x versions of the Log4j library. Note, if you start an older Lucee server or any Adobe ColdFusion server, they may still have Log4j 1.x bundled with them.

Library updates

Many of the java libraries have been updated

• JRE-bundled version ships with Java 11.0.15+10

• Undertow updated to 2.2.17.Final

• Lucee updated to 5.3.9.133

• JGit

Set Java System Props directly in server.json

Does what it says. Looks like this:

server.json

Read More Here:

JVM Args can be an array

JVM args and Runwar args can now be set an array of strings which prevents you from needing to escape or quote anything.

Old way (still works)

New way

Read More Here:

Request Dumper

There is now a handy little handler you can put in your server rules to view a console dump of all the header data related to your request and response.

server.json

OpenJDK Downloads

The java API has been moved from AdoptOpenJDK to the project. This is basically the same project, it just changed names.

assertFalse command

Opposite of assertTrue. Returns a passing (0) or failing (1) exit code whether falsy parameter passed. Truthy values are "yes", "true" and positive integers. All other values are considered falsy

assertNotEqual command

Opposite of assertEqual. Returns a passing (0) or failing (1) exit code whether both parameters DO NOT match. Comparison is case insensitive.

Better command chaining

You can have more than two chained commands, and the command chain will keep executing so long as the next part is compatible with the previous exit code. Ex:

cfpm improvements

• We now set the JAVA_HOME for the cfpm command if it doesn't exist

• An Adobe server no longer needs to be the default server for that web root

• If cfpm is run as part of a package or server script, it will default to the using the server currently doing something

box.exe finds Java better on Windows

Previous versions of Launch4j only used the Windows registry to find the installed version of java. The following environment variables are now also checked in this order to attempt to find a JRE to use.

• JAVA_HOME

• JRE_HOME

• JDK_HOME

• PATH

head Command

Does the same basic thing as the tail command, but it reads from the top of the file or input.

X-Forwarded-For support disabled by default

For better security, CommandBox servers will not automatically obey X-Forwarded-For HTTP headers unless you enable it.

Only enable this setting if your CommandBox server is behind a trusted proxy which always sets this header. Otherwise, a malicious client could spoof a trusted IP an bypass IP access control.

Relaxed semantic version parsing

Both of these commands will now do the same thing. The second one used to error with version not found.

XML Love

XML formatting is now a first-class citizen of the print helper and the REPL. You can pass a parsed XML doc and they will be formatted upon display.

Mac Tray Icon Disabled

Due to lack of Java 9+ support in the Java library that creates tray icons, we've disabled the tray icon by default on MacOS. If you want to brave the possibility of it not working or spilling errors in the console, you can re-enable it like so:

Hopefully when the library gets updated, we'll be able to re-enable the tray icon by default.

Release Notes

Here is the complete list of all tickets closed in this release

Java 14 support

Java 14 is now supported in CommandBox 5.1.0. In order to support Java 14, we had to stop using Pack200 which means the binary sizes have grown a little. The good news is CommandBox will start up a little faster on its first run since there's less to unpack now.

Library Updates

We know this stuff may seem boring, but it's super important to ensure you stay safe and secure on the latest versions of our bundled libraries. We updated the following libs in this release:

• org.lucee:lucee 5.3.9.141 -> 5.3.9.160

Task Target Dependencies

For a task that has more than one target (method) you can specify dependencies that will run, in the order specified, prior to your final target. Specify task target dependencies as a comma-delimited list in a depends annotation on the target function itself. There is no limit to how many target dependencies you can have, nor how deep they can nest.

Given the above Task Runner, typing

would run the runMeFirst() and run() method in that order.

Docs:

GZip Compression

The web server in CommandBox is capable of enabling GZIp compression to reduce the size of HTTP responses. To enable GZip compress on your CommandBox server, add a web.gzipEnable setting in your server.json file.

Docs:

Add --simple flag to ls/dir command

When you get a directory listing in CommandBox, you can add the --simple flag which will only output the file and folder name without any other information. This feature was added to compliment the feature below.

forEach Command

The foreach command will execute another command against every item in an incoming list. The list can be passed directly or piped into this command. The default delimiter is a new line so this works great piping the output of file listings directly in, which have a file name per line.

This example will find all JSON files in a directory and run the cat command against them.

Docs:

Java 9/10/11 support

This is still a little experimental since it hasn't gone through full testing, but we upgraded to Lucee 5.2.9.31 in the core CLI which has support for the newer versions of Java. We've removed the checks that previously preventing CommandBox from even trying to run on versions of Java later than 8 and at first glance it seems to be working though there's been some flakiness on Java 11. Please help test these later Java versions and remember that if you spin up a server, you'll want to still dial in Java 8 for Adobe CF 2016 and prior and Lucee 5.2.8.50 and prior even if you have the CLI running on Java 9+.

Docs for setting custom Java version in your server:

Release notes

Here's the full release notes for CommandBox 4.3.0.

Bug

• [] - Command Box failed to initialize using java 9

• [] - CFFileServlet doesn't work with default rewrites in ACF 2016

• [] - We need to review exit codes in Tasks

New Feature

• [] - Task method dependencies

• [] - Add setting for GZip compression

• [] - Add --simple flag to ls/dir command to only output filename

• [

Improvement

• [] - TestBox Run command could use a way to add custom url parameters. Also the options parameter does nothing

• [] - Improve progress bar cleanup and exit codes on Ctrl-C

• [] - Allow Java jars to be installed from S3

Updated bundled Java libraries

• JLine - 3.19.0

• jGit

What's New

• Task Runners - Run ad-hoc builds from the CLI written in CFML (Read more)

• Manage System Packages - update, list, and uninstall system modules

• File Globbing - Use place holders like **.cfc for file operations to affect more than one file at a time.

• Command Aliases - Alias your favorite commands for easy access in the future

• Global Command Parameter Defaults - Set common parameters to have a given value at a global level

• System Settings - Utilize environment variables to make your package and servers more dynamic

• Testbox Run - Improved, minimalist output to the "testbox run" command

• TestBox Watchers - Watch a directory for file changes and run your unit tests

• Customize REST Servlets - Customize or disable the REST servlet paths on Lucee and Adobe servers

• Custom Java Versions - Start your CF servers with any version of Java you want

• Property files - New commands and helper libs for dealing with property files

• Basic Authentication - Enable basic security on your servers with unlimited users

• Custom URL to Open - Customize the browser URL that opens when you start a server

• Disable Tray Icon - Turn off the system tray icon for your servers entirely

• Show Proxy IP - Servers pass through the original user IP through proxies

• Jar Endpoint - Install 3rd party jars into your projects

Release Notes

Bug

• [] - Server start tries to open HTTP URL even if it's disabled

• [] - testbox run with runner urls that have a query string fail

• [] - cf_scripts folder not working on Adobe 2016

New Feature

• [] - Allow file globbing patterns in file/folder operations

• [] - Create BaseTask

• [] - Add "task" command to run tasks

• [

Task

• [] - Better error message for invalid JSON in a server.json file

Improvement

• [] - Update debian build signing to be higher than SHA-256

• [] - If publishing but not logged into forgebox, prompt for login instead of just erroring

• [] - Clean up SSL cert and key file parameters for server start

UNC Network path support

This has been pretty big for Windows users who access files on their servers over a UNC network path like \\server-name\foo\bar. You can now cd into paths starting with \\, perform file operations like cat against those paths, etc. Note backslashes need escaped in the CommandBox shell.

This was pretty straightforward since Java already supports this, but I had to change a lot of core path handling to make sure the correct slashes were preserved. This needs a fair amount of testing to make sure we nailed it down for good. If your network share requires permissions, you'll need to have saved those in Windows Explorer already or execute a "net use" OS command from the shell.