Lucee 6.2.9.4 released

news release
1

Lucee 6.2.9.4 is now available as the stable 6.2 release. It is identical to 6.2.9.4-RC, apart from the PDF and Image extensions now using their final releases instead of RCs (same code). It is a small fix release on top of 6.2.8.20 with 4 fixes, including two regressions and a security fix in the Administrator, so we recommend that everyone on 6.2 updates.

Download: https://download.lucee.org/

  • Docker: lucee/lucee:6.2.9.4, plus the -light, -zero and -nginx variants (Docker Hub)
  • Maven: org.lucee:lucee:6.2.9.4

Overview

  • Inspect Templates “Auto” works again: since 6.2.8.10, changes to .cfm/.cfc files in web-context mappings were not detected until a restart.
  • Java constructor resolution: an exact parameter type match takes priority again, so for example org.json.JSONObject gets the right constructor.
  • Administrator security fix: the action URL parameter is now encoded, which closes an XSS hole in the admin.
  • Less noise: cfdirectory no longer writes stray debug output, and cfexecute errors now include the underlying cause.

Changelog

Regressions fixed

  • :star: LDEV-6482: Inspect Templates “Auto” stopped detecting CFM/CFC changes after LDEV-6358. The inspect ticker is now also started for web-context mappings.
  • :star: LDEV-5519: Lucee called the wrong constructor on org.json.JSONObject. Exact type matches take priority again when resolving Java constructors.

Bug fixes

  • :star: LDEV-3673 (security): fixed an XSS in the Administrator by encoding the action URL parameter in the admin layout.
  • LDEV-6445: removed stray debug prints in cfdirectory and cfexecute. cfexecute also keeps the original cause when an external process fails to start.

Extensions

  • PDF extension 1.2.0.12 and Image extension 2.0.0.35 (final releases of the RCs bundled with 6.2.9.4-RC; Image is a clean CI rebuild of 2.0.0.34).

Full changelog: https://download.lucee.org/changelog/?version=6.2

Thanks

The RC was available for testing for 10 days (RC announcement), and no regressions against 6.2.8.20 were reported. A big thank you to @thefalken for smoke testing it and to @anderslars27 for running it in production under real traffic. That feedback is what let us release with confidence.

If you run into any problems, please report them here on the forum or in Jira (LDEV).