Lucee 7.1.2.191 released

news release
1

Lucee 7.1.2.191 is now available as the stable 7.1 release. It contains the same runtime code as 7.1.2.189-RC; only the -RC qualifier was removed (the build number is assigned automatically, see LDEV-6516). It is a large fix release on top of 7.1.1.17 with more than 100 tickets. The main areas are AST generation, time zone handling, null handling, extension loading and the Administrator, and six bundled extensions have been updated. We recommend that everyone on 7.1 updates.

Download: https://download.lucee.org/

  • Docker: lucee/lucee:7.1.2.191, plus the -light, -zero and -nginx variants (Docker Hub)
  • Maven: org.lucee:lucee:7.1.2.191
  • Installers, WAR and Express: GitHub release 7.1.2.191

Overview

  • Security: more Administrator output is encoded, to harden it against XSS.
  • AST generation (LDEV-5715): more than 30 fixes make the AST output match the source faithfully.
  • Time zones: no more Java 25 startup warnings for three-letter IDs (LDEV-6672), dateFormat/timeFormat with an X mask no longer change the JVM time zone (LDEV-6547), Vancouver times are no longer an hour early (LDEV-6570), and the IST ID is fixed (LDEV-5314).
  • Null handling: typed arguments with a null default work when omitted (LDEV-6610), and arrayEach/arrayReduce no longer skip nulls (LDEV-4023).
  • Template cache: inspectTemplates() and pagePoolClear() also clear the application path cache (LDEV-5461).
  • Extensions and Maven: no more “not unique” error on restart after an extension upgrade (LDEV-6145) and no more “could not load the base component” on a fresh install (LDEV-6666). mavenLoad no longer pulls optional dependencies (LDEV-6639), and the Maven download policy message names the correct property (LDEV-6671). Lucee uses the same Maven repository list everywhere, Maven Central first, then maven.lucee-services.com (LDEV-6705).
  • Core updates: an update looks for the .lco file first and no longer needs the jar (LDEV-6704).
  • Sessions: sessionRotate() rotates JSESSIONID (LDEV-5942), and sessionInvalidate() no longer creates replacement sessions (LDEV-6447).
  • Datasources and queries: query params work with a ? in the SQL (LDEV-4424), CF_SQL_FLOAT works with MSSQL FLOAT (LDEV-6305), no unclosed pool on creation (LDEV-6567), and QueryExecute no longer leaks options as tag attributes (LDEV-6202).
  • Mail: HTML parts are quoted-printable again (LDEV-6545).
  • Administrator: dark mode contrast, extension tiles, restart page layout and the Custom Tags Cancel button (LDEV-5786, LDEV-6616, LDEV-6617, LDEV-5852).
  • Language: method chaining on a returned UDF result (LDEV-4160), calling a lambda in the static scope (LDEV-4792), isClosure() for arrow functions (LDEV-4709), for-in inside finally (LDEV-3393, LDEV-5922), replaceNoCase() with an empty substring (LDEV-5857), and deserialized exceptions keep their stack trace (LDEV-4021).
  • Lucee Light: Server.cfc onBuild() runs on first start (LDEV-6472), and no more spurious /extensions/.index error (LDEV-6665).
  • Release artifacts: only the .lco and the pom are published to Maven Central (LDEV-6707). The jars, Express, the WAR and the installers are on the GitHub release and on download.lucee.org.

Bundled extensions

Extension 7.1.1 7.1.2
MySQL 9.6.0 26.7.0
Microsoft SQL Server 13.2.1 13.2.1
PostgreSQL 42.7.9 42.7.11
Administrator 1.0.0.7 1.0.0.9
Documentation 1.0.0.6 1.0.0.8
S3 2.0.3.1 2.0.3.1
PDF 2.0.1.0 2.0.1.0
Image 3.0.1.1 3.1.0.11
ESAPI 3.0.0.14 3.1.0.1
Scheduler Classic 1.0.0.1 1.0.0.2
Compress 2.1.0.3 2.1.0.3
Mail 1.1.0.17 1.1.0.17
FTP 1.0.0.8 1.0.0.9

All bundled extensions are final releases.

Full changelog: https://download.lucee.org/changelog.cfm?version=7.1.2.191 · GitHub compare 7.1.1.17…7.1.2.191

Known issues

These were found while testing the RC. None of them is a regression against 7.1.1, and all are already fixed in 7.1.3 snapshots:

  • LDEV-6743: with LUCEE_ENABLE_WARMUP=true, Server.cfc onBuild() runs before the extensions from .CFConfig.json are registered (fixed in 7.1.3.26).
  • LDEV-6744: warm-up exits with code 0 when onBuild() throws or times out (fixed in 7.1.3.27).
  • LDEV-6745: an extension resource in .CFConfig.json that doesn’t exist is silently replaced by a download (fixed in 7.1.3.28).
  • LDEV-6746: the Maven extension provider can’t parse versions like 13.4.0.jre11 and falls back to the legacy provider (fixed in 7.1.3.32).
  • LDEV-6722: when an extension with a JDBC driver is uninstalled at runtime, the datasource keeps the old driver and the next connection fails with a NullPointerException. Restarting after an extension change avoids it (fixed in 7.1.3.16).

Thanks

7.1.2.184-RC was announced on 21 October (RC announcement), and 7.1.2.189-RC followed on 26 October. Both soaked for more than 10 days, and no regressions against 7.1.1 were reported. A big thank you to @philsw for running the RC in production and confirming all his fixes, to @Jim_Priest for running all his tests against it, and to @John_Berquist for the detailed upgrade report. That feedback is what let us release with confidence.

If you run into any problems, please report them here on the forum or in Jira (LDEV).

2 Likes
3

I get getting a error it couldn’t find on maven or cdn.lucee from 7.1.1.17.
Downloading lco worked fine.

4

Thanks for the report. That’s expected. Because of limits on Maven Central, we now only deploy the .lco file there for each Lucee release, since that’s the only artifact Lucee itself downloads from Central. Updating through the Administrator, or dropping in the .lco, works as usual.

Everything else (the lucee.jar, plus the -light and -zero jars) is on our own Maven repository, for example maven.lucee-services.com/org/lucee/lucee/7.1.2.191/, and on the GitHub release. To download from there with Maven or in CI, add https://maven.lucee-services.com/ as a repository, as shown in the Downloading Extensions for CI, Docker and Offline Installs recipe. The same setup works for the core artifacts.

5

Sonatype, who run Maven Central, just approved more bandwidth for us as open source project, so we may start publishing the jars to Maven Central again after all. Until then, they’re available from maven.lucee-services.com and the GitHub release.

1 Like
6

Hi Michael. I am new to this community. Could you please confirm if the 6.x.x.x releases will be discontinued and if version 6.2.9.4 was the final release in that series? If so, will customers need to begin migrating to the 7.1.2.191 LTS release? Additionally, are there guidelines available to assist with a smooth migration process? Thanks in advance.

7

See this message: LTS from 6.2 to 7.1 it lists the EOL date for 6.2 as April 2027. Typically that means they would continue to release security updates on 6.2 as needed until that date.

Pete Freitag
Foundeo Inc.

8

Hi Javed, welcome. 6.2 isn’t discontinued yet. Active support ended in October 2026, and it now gets security fixes only until its end of life in April 2027. So 6.2.9.4 isn’t necessarily the last 6.2 release: if a security fix is needed before then, there will be another one. The current dates for every version are at Releases · Lucee.

7.1 is the current LTS, so that’s where we recommend moving from 6.2, ideally well before April 2027. The upgrade guide is at Updating Lucee :: Lucee Documentation. If you hit anything in testing, please report it here or in Jira (LDEV).