Lucee 5.4.0.80 Stable Release

[Zackster]

Just in time for CFCamp 2023, the Lucee team presents the first stable release in the 5.4 series.

The main focus of this release was updating all the underlying java libraries to be CVE free.

The one exception in Hibernate 3.5.5 which hasn’t been (and can’t be upgraded) we’ll have more to announce about this soon.

5.4 also bundles two major updates to extensions

• s3 v3, which switches to awslib
• image v2, a complete rewrite, which is much more stable and supports WEBP

if you would like to see HEIC image support in Lucee, please donate to the upstream Twelve Monkeys library donating to open source projects is really

Available as usual via

• your Lucee Admin,
• download.lucee.org
• Commandbox cfengine=lucee@5.4.0+80
• Docker (including native ARM)
• Maven

Java Versions supported

• Java 8
• Java 11 (Lucee Installer bundles 11.0.19)
• Java 17 isn’t supported yet, (Lucee 6 will be supporting it this year)

Release notes 5.4

Lucee 5.4.0.77-RC Release Candidate 2

Following up on Lucee 5.4.0.65-RC Changelog (Since RC 1) LDEV-1526 - update HyperSQL 2.7.2 (HSQLDB) for QoQ (CVE) LDEV-4461 - Using named arguments in entityLoadByPK call results in java.lang.NoSuchMethodError LDEV-4466 - OSGI error with memcached driver extension 4.0.0.7-SNAPSHOT LDEV-4469 - Regression: Invalid “member is set to final” error on static property when code changes LDEV-4506 - don’t accept strings of format “m d" as valid dates LDEV-4525 - mssql can’t connect in 5.4, throws …

Lucee 5.4.0.65 Release Candidate

The Lucee team is proud to present our next release candidate for the 5.x series. The 5.4 series bumps the minor version (from 5.3), as we had to update some of the underlying java libraries and extensions as the older versions have CVEs or are no longer maintained. All of the java libraries which have been updated in 6 have also been updated in 5.4, with the exception of hsqldb which in this RC is still 2.7.0 This includes an important performance logging / log4j fix with logging since 5.3…

Changelog since last RC

LDEV-4358 - Resource leak in DatasourceConnectionPool 5.3.10
LDEV-4550 - Upgrading to v5.4.0.65 failed due to Felix installation

Code Changes

Comparing 5.4.0.0...5.4.0.80 · lucee/Lucee

Extensions Bundled

AXIS and Search are no longer bundled due to CVEs, but can still be manually installed

lucee/Lucee/blob/5.4/core/src/main/java/META-INF/MANIFEST.MF#L358

Lucee needs financial Support

If you are building your career and/or business on Lucee, please support the developers working on the project. With your support, we can make Lucee even better and quicker, both in terms of performance and release cycles!

Lucee - Open Collective

Release Roadmap

TL;DR due to CVE in java libraries used in 5.3, 5.3 is EOL aside from security fixes

The one caveat is we haven’t upgraded Hibernate from 3.5.5 to 5.4 yet in Lucee 5.4

Roadmap Lucee 5.4

As noted in the release notes for 5.3.10.97, there will be a Lucee 5.4 release very soon, which will upgrade some underlying java libaries with CVEs Extension Changes with 5.4 due to CVEs (which is why we are bumping up the version) Lucee 5.4 will no longer bundle older extensions like Axis and Search due to CVEs (and being deprecated) Hibernate extension will be updated to 5.4 (3.5.5 has CVEs and is no longer maintained) Image Extension will be updated to version 2 (factored, 12 Monkeys) S3 …

[Charlesr]

I don’t understand why 5x is still being developed, if 6x is just around the corner?

[andreas]

Please read this very informative post by @bdw429s

Lucee 5.3.9 vs 5.3.10

Lol, I think you’re overthinking this pretty hard. Lucee follows a pretty standard release process using (mostly) semantic versioning. Their version numbers are built like this major.minor.patch.build where major is a paradigm shifting release where major overhauls happen minor releases are when breaking changes are made and happen once a year or so patch releases represent a stable collection of bug fixes and enhancements builds represent a single commit/build fixing one issue or adding o…

Finally I’ve met him in person here at cfcamp!!!

[Michele_Scaletta]

Yesterday I upgraded the production server with no issues. All applications seem to work fine.
CentOS Linux 7.9.2009 (Core)
Tomcat 9.0.31 and Java 11
Lucee run under Plesk Obsidian 18.0.53 update 1.
Well done to the development team.
Thanks

[Zackster]

There was a regression with QoQ relating to $ in column names, due to the hsqldb 2.7.2 upgrade

https://luceeserver.atlassian.net/browse/LDEV-4593

it has been addressed in the 5.4.1.2 and 6.0.0.487 SNAPSHOTS

The old version of HSQLDB was 1.8.0, from 2009, so there maybe some changes in behaviour we can’t change. HSQLDB is used for any QoQ with multiple tables, native QoQ only works on a single table

[Phillyun]

Maybe related… ? We have some complex/very old QoQ joins failing in 5.4 (works in 5.3). Feel free to split to a separate thread.

My attempts to create an easy repro case has been unsuccessful.
I have updated details below to include the accurate query and the error.

Short version:
We have two queries via MSSQL.

QoQ does this:

SELECT qry1.stateCode, qry1.description, qry2.exempt
FROM qry1, qry2
WHERE cast(qry1.stateCode as varchar) = qry2.stateCode

Error Message:
length must be specified in type definition: VARCHAR
ErrorCode: 0
NativeErrorCode: -5599
SQLState: 42599
Stack:

lucee.runtime.exp.DatabaseException: length must be specified in type definition: VARCHAR at org.hsqldb.jdbc.JDBCUtil.sqlException(Unknown Source) at org.hsqldb.jdbc.JDBCUtil.sqlException(Unknown Source) at org.hsqldb.jdbc.JDBCStatement.fetchResult(Unknown Source) at org.hsqldb.jdbc.JDBCStatement.execute(Unknown Source) at lucee.runtime.type.util.QueryUtil.execute(QueryUtil.java:320) at lucee.runtime.type.QueryImpl.execute(QueryImpl.java:287) at lucee.runtime.type.QueryImpl.<init>(QueryImpl.java:235) at lucee.runtime.db.HSQLDBHandler.__execute(HSQLDBHandler.java:345) at lucee.runtime.db.HSQLDBHandler._execute(HSQLDBHandler.java:310) at lucee.runtime.db.HSQLDBHandler.execute(HSQLDBHandler.java:294) at lucee.runtime.tag.Query.executeQoQ(Query.java:1111) at lucee.runtime.tag.Query._doEndTag(Query.java:681) at lucee.runtime.tag.Query.doEndTag(Query.java:566) at ...

Removing the CAST causes this error:
Message: incompatible data types in combination
ErrorCode: 0
NativeErrorCode: -5562
SQLState: 42562
Stack:

lucee.runtime.exp.DatabaseException: incompatible data types in combination at org.hsqldb.jdbc.JDBCUtil.sqlException(Unknown Source) at org.hsqldb.jdbc.JDBCUtil.sqlException(Unknown Source) at org.hsqldb.jdbc.JDBCStatement.fetchResult(Unknown Source) at org.hsqldb.jdbc.JDBCStatement.execute(Unknown Source) at lucee.runtime.type.util.QueryUtil.execute(QueryUtil.java:320) at lucee.runtime.type.QueryImpl.execute(QueryImpl.java:287) at lucee.runtime.type.QueryImpl.<init>(QueryImpl.java:235) at lucee.runtime.db.HSQLDBHandler.__execute(HSQLDBHandler.java:345) at lucee.runtime.db.HSQLDBHandler._execute(HSQLDBHandler.java:310) at lucee.runtime.db.HSQLDBHandler.execute(HSQLDBHandler.java:294) at lucee.runtime.tag.Query.executeQoQ(Query.java:1111) at lucee.runtime.tag.Query._doEndTag(Query.java:681) at lucee.runtime.tag.Query.doEndTag(Query.java:566) at ...

Environment:
Lucee 5.4.1.2-SNAPSHOT
Lucee 5.4.1.4-SNAPSHOT
Windows 64-bit
Tomcat/9.0.64
11.0.7 (AdoptOpenJDK) 64bit

[Zackster]

please always include the top of the stack trace!!!

I’m working on the QoQ regressions, basically the problem is it used to be a lot slacker in terms of what is allowed and HSQLDB has become stricter since 2009

[Zackster]

The following QoQ regressions are fixed in 5.4.1.4 and 6.0.0.498

[LDEV-4592] - Lucee & [LDEV-4613] - Lucee

[thefalken]

just fixing a S3 ACL issue and they will also be on forge box

What’s the issue for that ? I was just updating our dev Docker images from 5.3 to 5.4 to start testing, and if I’m just gonna have to do it again I may as well hold off a day or two.

[Zackster]

Just with Lucee build / publish infrastructure, nothing to worry about, already resolved

[thefalken]

Ah, cool.

I still need to wait for 5.4.1.4 to hit Docker Hub so it’s not a rush anyway

[thefalken]

I see 5.4.1.4 was just a SNAPSHOT and there’s now a 5.4.1.5 SNAPSHOT too, so are some more regressions being fixed somewhere ?

https://hub.docker.com/r/lucee/lucee/tags?page=1&name=5.4.1

( please don’t direct me to Jira, it’s impossible to use even if I guess where the login button is and moans at me about dark mode every time I open it )

[Zackster]

look, if you are going to be messing around with snapshots, then you need to look at jira, end of story

everyone else seems to manage

here is our sprint plan Log in with Atlassian account

[thefalken]

I don’t want to be messing with snapshot at all

I want the latest released 5.4.1. Above it was stated “QoQ regressions” are fixed in 5.4.1.4 so I thought that that would be a non-snapshot.

It seems like instead I need to watch the 5.4.1 Backlog list at the link you kindly gave (stands at 4 at present, including the QoQ fixes) and when that hits 0 there’ll be a 5.4.1.something RC and then a release ? E.g. 5.4.1.4 will never be a release, only ever snapshot ?

Sorry if this seems like silly questions, I really don’t follow how Lucee releases relate to Jira “fix versions” and then on to Docker tags.

[Zackster]

5.4.1 isn’t released, you know I publish release notes for all stable releases???

[kabutotx]

Question: Will the update process erase old jars with CVEs? I would assume it will just use the newest if an older is also there? What is the “preferred” method. My Tomcat and JDK are updated to latest already.

[Zackster]

fresh install they won’t be used, but that’s the only way