In this section you will find the release notes for the 6.x version of CommandBox.
Version 6.0.0 - February 2024
Version 6.1.0 - November 2024
Version 6.2.0 - March 2025
This release contains 9 tickets-- several bug fixes and a couple nice new features.
Adobe CF 2025, Lucee 7, and BoxLang 1.0 are all using the Jakarta servlet spec now. CommandBox will now detect that and automatically download a Jakarta version of Runwar to start the server on first start.
CommandBox servers now support one or more warmup URLs which will be automatically fired after the server comes online to ensure it's warmed up, even if there is no external traffic. You can choose what happens to incoming requests prior to the completion of the warmup (queue, block, or allow) as well as whether the warmup URLs are fired sync or async. The warmup URL can also hit any endpoint, acting as a simple webhook to notify that the server has come online if you want.
Read more:
Here are all the tickets closed in the 6.2.0 release.
Capture partial task output in exception extended info
Improve 32 bit detection in java endpoint
whitelist /.well-known/ in extension whitelist
Support Jakarta EE
Coldbox Create Resource - 'open' variable doesn't Exists
SSL redirect not working with binding syntax
x86 being detected as 32 bit, but it can be 64 bit in java service
websockets hitting wrong site in multisite on Adobe
Add on server start URL to warm up the server
Here's an overview of the notable changes in this release.
The install command will automatically find a local Lucee Server when installing a package that is a Lex file. There is also now a command called server lucee-deploy to help with installing Lex files (Lucee Extensions) and LCO files (Lucee Core).
It will accept an absolute or relative local file path:
or an HTTP URL to download
You can also override the name of the CommandBox server to install into, regardless of what working directory the shell is in:
CommandBox now has the capability to verify the MD5 hash of a binary upon installation. When publishing packages to ForgeBox using ForgeBox's built-in S3 storage, the binary hash will be auto-calculated and stored in ForgeBox along with the package details and automatically checked on every future download.
More info here: https://commandbox.ortusbooks.com/package-management/creating-packages#custom-binary-hash
CommandBox supports WebSockets natively via our SocketBox library. The WebSocket server in CommandBox is not really a separate "server" per se, since it’s on the same port. It’s just an upgrade listener which will upgrade any WS requests.
This websocket integration will work for Lucee, Adobe, and BoxLang alike as it passes incoming messages to the app via an "internal" HTTP request to /WebSocket.cfc?method=onProcess where the CF/BL code can handle it. The incoming request will have all cookies, headers, hostname, etc that the original websocket connection was started with, so normal CGI variables and session scopes should work fine.
You need to create a custom /WebSocket.cfc class should extend one of the classes described below in this library which provides the base functionality.
And here: https://forgebox.io/view/socketbox
We've bumped the versions of several internal libraries including
Lucee (5.4.6.9)
JBoss Undertow (2.2.37.Final)
Bundled JRE (11.0.25+9)
Here is the full list of tickets closed in the 6.1.0 release.
COMMANDBOX-1630 Updates to run BoxLang
COMMANDBOX-1635 Add command to deploy Lucee lex or lco files
COMMANDBOX-1637 Check if an entry has a hash associated to it and validate it
COMMANDBOX-1638 Create a hash of the binary when storing the zip and return it to ForgeBox
COMMANDBOX-1642 WebSocket Server
COMMANDBOX-1620 Sort by date last started when finding a server by web root
COMMANDBOX-1622 Make semantic version prerelease identifiers not case sensitive
COMMANDBOX-1627 default servlet pass predicate include Boxlang files
COMMANDBOX-1616 Legacy SSL config doesn't respect enable = false
COMMANDBOX-1617 Static web server no longer works
COMMANDBOX-1619 second level dependencies inside of a top level dependency's box.json always install latest stable version
COMMANDBOX-1621 "Java search" returns no results
COMMANDBOX-1623 framework rewrites double-encode path info
COMMANDBOX-1625 CommandBox 6 not putting trailing slashes in URL
COMMANDBOX-1629 SES paths return false from is-file predicate for value files with a path info
COMMANDBOX-1633 backslash in JSON object keys not escaped when printing JSON
COMMANDBOX-1643 forgebox version-debug errors
COMMANDBOX-1626 Update to Undertow 2.2.33.Final
COMMANDBOX-1631 Update to Lucee 5.4.6.9
COMMANDBOX-1632 Update bundled JRE to 11.0.23+9
server lucee-deploy myFile.lexserver lucee-deploy https://domain.com/path/to/Lucee-core-patch.lcoserver lucee-deploy myFile.lex myServerThere are a lot of new features in CommandBox 6. Here's an overview of the biggest ones. Check out the release notes for the full list.
This one is huge. It's the hallmark feature of CommandBox 6 and allows you to easily run as many web sites (with different web roots) in a single CommandBox server. This finally gives you the same behavior you get with Adobe ColdFusion and IIS or Lucee/Tomcat and Apache with mod_cfml. CommandBox has had built-in ModCFML support for a while, but it still needed a web server in front to work fully. CommandBox Multi-Site gives you a fully powered web server that allows you to define as many separate web sites as you like, each with COMPLETE configuration control, all inside a single server process.
Rewrites
web aliases
security profile
HTTP/SSL/AJP bindings
SSL Certs
welcome files
MIME types
GZIP settings
Basically everything can currently configure under the "web" object of your server.json can be set on a per-site basis!
CommandBox is now truly a One-Stop-Shop for running your apps from development to production. You don't need Apache, Nginx, IIS, or Tomcat!
Read more here:
Going hand-in-hand with our Multi-Site features, is the ability to bind to more than one HTTP port, more than one SSL port and more than one AJP port. You can configure proper host name matching on any binding, and even have multiple SSL certs. This new feature is available not only for Multi-Site but also for single site servers. The new server bindings come with a new JSON syntax in the server.json (we still support the old one too)
Read more here:
Going hand-in-hand with our enhanced server bindings, is the ability not only to be able to specify multiple SSL certs per site, but also multiple SSL certs per SSL binding. CommandBox automatically enables SNI (Server Name Indication) which will choose the proper cert based on the incoming host name. With support for PEM files, DER formats, and PFX formats, this really opens up a lot of capabilities.
Read more here:
We added a popular feature from Apache's mod_rewrite called rewrite maps. This allows you to create a simple text file of values you can reference in your rewrite rules to map incoming URL values to another value.
Read more here:
This is a nice little productivity enhancement. When you run the publish command, the CLI will now directly upload your zip file to S3 instead of sending it to ForgeBox first. This improves the speed and efficiency of your deployments.
This is a simple one. If you want to create a simple reverse proxy to a single back-end server, we've created an alias for the existing load-balanced-proxy() handler called just proxy which accepts a single host with less verbosity.
Read more here:
You're already familiar with specifying package scripts and server scripts in your box.josn and server.json as a string containing one or more commands. Instead of using && for multiple commands, you can also do this by specifying an array of strings instead of a string like so:
This can be much more readable for multiple commands. Note, this is functionality equivalent to using &&, which means any erroring command will stop execution.
Read more here:
CommandBox still bundles helpful scaffolding commands for your favorite MVC framework Testing framework, and CMS, but these commands are no longer part of the core CommandBox source code. We've given them new life as independent modules. They are installed by default, but they now have their own lifecycle and can get releases at any time. You can view and update them with the rest of your system modules.
Read more here:
CommandBox adds a /cf_scripts/scripts alias for you any time you start an Adobe CF server. This alias points to the same folders in the root of the Adobe WAR. If you set a custom scripts src path in the CF administrator then you'll want to ensure CommandBox uses the expected alias. There is now a setting called web.adobeScriptsAlias which allows you to control the public, web-accessible path to the scripts folder that CommandBox creates for you. And better yet, if you're using CFConfig, will automatically update the Adobe script source setting to match and vice versa.
Read more here:
As a perk of CommandBox pro, once you log into the CLI with your ForgeBox Pro account, your config settings will now automatically sync to and from ForgeBox. This is a great way to keep multiple CLI instances across computers up to date.
Read more here:
Here are the full release notes for CommandBox 6.0.0
Some server.json config options unavailable as environment variables
Runwar doesn't load servlet filter mappings correct in web.xml override
semantic version parsing ignores part of pre-release IDs with hyphen
Stackoverflow when using serverinfo system setting expansion in a server script
Lucee Light Engine
Installing package crashes when PackageService cannot delete tmp folder
Add a `proxy` server rule alias to `load-balanced-proxy` which takes in one item instead of an array.
Add Rewrite Map feature similar to Apache
Multi-Site mode
CommandBox Pro users get config auto sync
box install <package>: constrain to version already defined in box.json
Publish command directly upload to S3
Allow the scripts key under the server.json and box.json to use an array of scripts to run under the same script key name
XML formatting in print helper can kick in a bad time
Allow control over undertow' s transferMinSize
Provide way to escape literal colon (:) command parameter name
Remove contentbox, coldbox, etc modules from the core
Customize Adobe cf scripts alias
Update bundled JRE to 11.0.22+7
Update to Lucee 5.4.4.38
{
"name": "commandbox-multi-site",
"web": {
"bindings": {
"HTTP": {
"listen": "80"
}
}
},
"sites": {
"site1": {
"hostAlias": "site1.com",
"webroot": "site1"
},
"site2": {
"hostAlias": "site2.com",
"webroot": "site2"
},
"site3": {
"hostAlias": "site3.com",
"webroot": "site3"
}
}
}{
"web" : {
"bindings" : {
"HTTP" : {
"listen" : "10.10.0.123:8080",
"host" : "site.com,site2.net"
}
}
}
}{
"web" : {
"rules":[
"rewrite-map( name=myMap, file='/path/to/myMap.txt' case-sensitive=false )",
"regex-nocase( '^/foo/(.*)$' ) -> rewrite( 'index.cfm?page=%{map:myMap:$[1]|99}' )"
]
}
}proxy( 'http://localhost:8085' ){
 "name" : "My Package",
 "scripts" : {
   "build" : [
     "!grunt build",
     "testbox run",
     "run-script generateAPIDocs",
     "bump --patch && publish"
    ],
 }
}list --system
update --system