Lucee 7.0.6.9-RC available for testing

Lucee 7.0.6.9-RC is available for testing. It is a fix release on top of 7.0.5.41 with 7 fixes, including 5 regressions, plus a clearer error message for missing OSGi bundles.

Download: https://download.lucee.org/

  • Docker: lucee/lucee:7.0.6.9-RC, plus the -light, -zero and -nginx variants (Docker Hub)
  • Maven: org.lucee:lucee:7.0.6.9-RC

Overview

  • No more leaked datasource connections: when resetting a connection at the end of a transaction failed, the connection leaked. It is now invalidated and removed from the pool instead.
  • Component metadata fixes: getMetadata() works again on a component restored with objectLoad( objectSave() ), and a child component lists its inherited methods in functions again when parent and child have the same file name.
  • Java method and constructor resolution: an exact parameter type match takes priority again, so for example org.json.JSONObject gets the right constructor.
  • SQL comments are kept: comments in your SQL are now sent to the database, so SQL monitoring tools and sqlcommenter see them. A ? or : inside a comment is no longer treated as a query parameter.
  • No more false request timeouts: Lucee could interrupt a healthy, short request as if it had timed out.

Changelog

Regressions fixed

  • :star: LDEV-6129: managed datasource connections could leak when resetting them at the end of a transaction failed. Such a connection is now invalidated and removed from the pool, and an error while releasing connections at the end of a request is logged instead of breaking the cleanup.
  • :star: LDEV-6490: getMetadata() threw “this.cpRef is null” on a component restored with objectLoad( objectSave() ), for example when caching CFC instances in Redis. Only 7.0 was affected. (PR #2840)
  • :star: LDEV-6469: GetMetadata( childCfc ).functions no longer included inherited methods when the child and parent CFC have the same file name (for example two Default.cfc in different packages). This broke after LDEV-6056 and now works as before again. (PR #2808)
  • LDEV-5519: Lucee called the wrong constructor on org.json.JSONObject. Exact type matches take priority again when resolving Java constructors, and now also Java methods. (PR #2734)
  • LDEV-5352: fixed the compiler error “Type lucee/runtime/type/Closure not present”, for example with a ternary that returns a closure in one branch and a string in the other.

Bug fixes

  • :star: LDEV-6453: request timeout checks could interrupt healthy, short requests (reported on AWS Lambda at about 1 in 1,000 requests). A request is now only checked for a timeout once it is fully set up, and no longer while it is being released.
  • :star: LDEV-4867: query param parsing removed comments from the SQL, so they were not visible in SQL monitoring tools. Comments are now kept in the SQL sent to the datasource, ? and : inside comments are not treated as parameters, and comments are only stripped for Query of Queries. This also fixes LDEV-4866, where a / or - at the end of the SQL broke the parsing.

Improvements

  • When a required OSGi bundle is not available, the error message now includes the full download URL, so you can fetch the bundle by hand.

Testing

Please give this RC a spin, especially if you use transactions or ORM, cache components with objectSave()/objectLoad(), read inherited methods with getMetadata(), create Java objects or call Java methods with arguments, or have comments in your SQL. Report any problems here on the forum or in Jira (LDEV).

2 Likes

have run this in production for 24 hours and all looks good

Thanks a lot, Phil, for running 7.0.6.9-RC in production for 24 hours and reporting back. That really helps us get the release out with confidence, and thanks for taking the time to help improve Lucee.

Lucee 7.0.6.10-RC is now available and replaces 7.0.6.9-RC: Release Lucee 7.0.6.10-RC · lucee/Lucee · GitHub

Changes since 9-RC:

  • The Compress extension is now the final 2.1.0.3 release (was 2.1.0.2-SNAPSHOT), so this RC only bundles final extension versions.
  • Tomcat is bumped to 9.0.123 for CVE-2026-68525, CVE-2026-65905 and CVE-2026-65182.

There’s effectively no change to Lucee’s own runtime code, so runtime behaviour shouldn’t be affected. If you tested 9-RC, please give 10-RC a spin too and report anything that comes up here. Thanks for testing!

Lucee 7.0.6.10 is now released as stable: Lucee 7.0.6.10 Stable Release

1 Like