Lucee 7.1.1.17 is now available as the stable 7.1 release. It is identical to 7.1.1.17-RC. It is a fix release on top of 7.1.0.204 with 14 fixes, most of them regressions. Seven of them are mail problems that came from moving mail into an extension in 7.1, so we recommend that everyone on 7.1, and everyone planning to move from 7.0 to 7.1, updates.
Download: https://download.lucee.org/
- Docker:
lucee/lucee:7.1.1.17, plus the-light,-zeroand-nginxvariants (Docker Hub) - Maven:
org.lucee:lucee:7.1.1.17 - Installers, WAR and Express: GitHub release 7.1.1.17
Overview
- Mail works again:
new mail().send()works again, spooled mail is no longer silently dropped, cfmail no longer fails with “IMAPProvider not a subtype”, and mail no longer times out with the spool off. In the admin, the Mail page is back and “Verify” and “Send test mail” really work. An update from 7.0 now installs the Mail extension. isValid( "email" )is fixed: it accepts valid addresses likeo'reilly@example.comagain and rejects invalid ones likeuser.@gmail.com.- No more leaked datasource connections: when resetting a connection at the end of a transaction failed, the connection leaked. It is now invalidated and removed from the pool instead.
- Component metadata fix: a child component lists its inherited methods in
functionsagain when parent and child have the same file name. - Java method and constructor resolution: an exact parameter type match takes priority again, so for example
org.json.JSONObjectgets the right constructor. - SQL comments are kept: comments in your SQL are now sent to the database, so SQL monitoring tools and sqlcommenter see them. A
?or:inside a comment is no longer treated as a query parameter. - No more false request timeouts: Lucee could interrupt a healthy, short request as if it had timed out.
- Final extensions only: every bundled extension is a final release, and Tomcat is updated to 9.0.123 for three CVEs.
Changelog
Regressions fixed
LDEV-6455: spooled cfmail was silently dropped. Writing the spooler task failed with “NotSerializableException: sun.nio.cs.UTF_8”, and reading it back failed with a ClassNotFoundException. The Mail extension now writes the task correctly, and core loads spool task classes that come from an extension. If a task still can’t be written to disk, it is sent right away and the error is logged, so it is no longer lost.- LDEV-6484:
new mail(...).send()threw “not supported in 7.1 OOTB”. Theorg.lucee.cfml.Mailcomponent now ships with the Mail extension and works again. - LDEV-6485: once anything in the JVM had used javax.mail, every cfmail failed with “jakarta.mail.Provider: com.sun.mail.imap.IMAPProvider not a subtype” until a restart. The Mail extension now uses its own classloader to create the mail session and transport.
- LDEV-6486: a minor update from 7.0 to 7.1 (.lco file or Admin update) did not install the Mail extension, so every
<cfmail>failed with “undefined tag [cfmail]”. On that update Lucee now installs the Mail and FTP extensions, which both moved out of core in 7.1. - LDEV-6458: the Mail page was missing from the admin menu, and on that page “Verify” and “Send test mail” did nothing but still reported success. The link is back when the Mail extension is installed, “Verify” really connects to the mail server and shows the error, and the test mail is actually sent.
- LDEV-6487:
isValid( "email" )rejected valid addresses likeo'reilly@example.comand accepted invalid ones likeuser.@gmail.com,.foo@gmail.comora..b@gmail.com. This also affected cfparam and arguments withtype="email". The check follows the 7.0 rules again. (Based on a PR by MitrahSoft.) - LDEV-6129: managed datasource connections could leak when resetting them at the end of a transaction failed. Such a connection is now invalidated and removed from the pool, and an error while releasing connections at the end of a request is logged instead of breaking the cleanup.
- LDEV-6469:
GetMetadata( childCfc ).functionsno longer included inherited methods when the child and parent CFC have the same file name (for example twoDefault.cfcin different packages). This works as before again. - LDEV-6490:
GetMetadata()threw “this.cpRef is null” on a component restored withobjectLoad( objectSave() ). This was a 7.0 regression and works again. - LDEV-5519: Lucee called the wrong constructor on
org.json.JSONObject. Exact type matches take priority again when resolving Java constructors, and now also Java methods. - LDEV-5352: fixed the compiler error “Type lucee/runtime/type/Closure not present”, for example with a ternary that returns a closure in one branch and a string in the other.
Bug fixes
- LDEV-6500: with the mail spool turned off, sending mail could time out. Fixed in the Mail extension.
- LDEV-6453: request timeout checks could interrupt healthy, short requests (reported on AWS Lambda at about 1 in 1,000 requests). A request is now only checked for a timeout once it is fully set up, and no longer while it is being released.
- LDEV-4867: query param parsing removed comments from the SQL, so they were not visible in SQL monitoring tools. Comments are now kept in the SQL sent to the datasource,
?and:inside comments are not treated as parameters, and comments are only stripped for Query of Queries. This also fixes LDEV-4866, where a/or-at the end of the SQL broke the parsing.
Improvements
- When a required OSGi bundle is not available, the error message now includes the full download URL, so you can fetch the bundle by hand.
Extensions and dependencies
- All bundled extensions are final releases: MySQL JDBC 9.6.0, MSSQL JDBC 13.2.1, PostgreSQL JDBC 42.7.9, Administrator 1.0.0.7, Documentation 1.0.0.6, S3 2.0.3.1, PDF 2.0.1.0, Image 3.0.1.1, ESAPI 3.0.0.14, Scheduler Classic 1.0.0.1, Compress 2.1.0.3, Mail 1.1.0.17 and FTP 1.0.0.8.
- Compared to 7.1.0.204: Mail 1.1.0.6 → 1.1.0.17 (with the mail fixes above), Image 3.0.0.9 → 3.0.1.1, Compress 2.1.0.2-SNAPSHOT → 2.1.0.3 and FTP 1.0.0.5-RC → 1.0.0.8. Mail, Compress and FTP are the final releases of the candidates we tested in the RCs, with the same code.
- Tomcat is bumped to 9.0.123 for CVE-2026-68525, CVE-2026-65905 and CVE-2026-65182.
Full changelog: Changelog 7.1.1.17 — Lucee Downloads
Known issue
- LDEV-6597: a spooled mail that keeps failing (for example rejected by the mail server) is retried every 60 seconds instead of backing off and is never closed. The fix is in the Mail extension, so you’ll be able to get it by updating the extension once its next release is out, without updating Lucee. Thanks @martin for the detailed report.
Thanks
The 7.1.1 RCs were available for testing for over two weeks (RC announcement), and no regressions against 7.1.0.204 were reported. A big thank you to @Jim_Priest for rolling the RC out to development servers early, to @kenricashe for running all his tests against 7.1.1.17-RC including spooled cfmail, and to @Roberto_Marzialetti for running almost 600 tests against it. That feedback is what let us release with confidence.
If you run into any problems, please report them here on the forum or in Jira (LDEV).