The Lucee team is proud to announce the Stable Release of 5.3.8, available for download https://download.lucee.org or via the Lucee Admin.
This has been a very long release cycle, a massive thank you to everyone who has been helping us test and address regressions and performance problems…
We have done a lot of work in 5.3.8 to optimise memory usage, the main two areas being improved was the template cache handling and parallel functionality.
The Docker builds will be available next week, we are still sorting out some issues since we migrated to GitHub Actions from Travis CI.
We also now have CI Testing in place for most Lucee extensions, using the Lucee Script Runner GitHub - zspitzer/lucee-script-engine-runner: CFML Ant script runner for Lucee Server JSR-223
Java / Tomcat Versions
Java 8, Java 11 LTS.
The Lucee Installer bundles AdoptOpenJDK-11.0.11+9 and Tomcat 9.0.46
Linux installer is available for download, the Windows Installer will be listed shortly
https://cdn.lucee.org/lucee-5.3.8.189-windows-x64-installer.exe
https://cdn.lucee.org/lucee-5.3.8.189-linux-x64-installer.run
Java 16 is not currently supported due to some breaking JVM changes.
The bundled caerts file has also been updated with the version from Java SE 11.0.11
Tickets addressed in this Release
New Functionality
LDEV-42 - Array methods: shift(), unshift(), push(), pop(), splice()
LDEV-3134 - ACF2021 - add function ArrayPush
LDEV-3135 - ACF2021 - add function ArrayPop
LDEV-3136 - ACF2021 - add function ArrayShift
LDEV-3137 - ACF2021 - add function ArrayUnShift
LDEV-2686 - Add function structValueArray()
LDEV-1328 - add optional offset argument to callStackGet()
LDEV-2883 - Add support for the Argon2 hashing algorithm
LDEV-1826 - Add QuerySetRow, Query.setRow() and allow returning an array from QueryRowData
LDEV-3009 - add support for Java Regex
LDEV-2881 - Add iso format for DateTimeFormat
LDEV-2764 - Allow Query to return a 1-record Struct
LDEV-2912 - Add attribute directory to cfexecute
LDEV-1746 - Allow ${system.property} in Lucee config files
LDEV-3239 - cfhttp doesn’t support TLSv1.3
LDEV-3377 - tag cfhttp stream support
LDEV-3122 - add nameconflict=“forceunique” for file uploads to use a filename with a uuid
LDEV-3147 - ACF2021 - add function ClearTimeZone
LDEV-3149 - ACF2021 - add member function toJson
LDEV-946 - Always include functions and properties in CFC metadata
Performance
LDEV-2772 - add an application setting to disable searching query resultsets for unscoped variables
LDEV-3287 - Unnecessary getRootPath() file system access on every request adds overhead
LDEV-3290 - Reevaluate performance of locking overhead in pc.initApplicationContext() for every request
LDEV-2903 - Parallel processing array.each() duplicates tmp-xxx.upload files on every loop, crashing the server
Memory
LDEV-2559 - arrayEach has too much memory overhead from duplicating pageContext
LDEV-2087 - Lucee 4 and 5 consumes too much heap memory with large uploads due to bug in HTTPServletRequestWrap.java
LDEV-2904 - Non-Heap Memory Increases Till Server Crashes
LDEV-3019 - add possibility to add a cpu/memory/concurrent request threshold for request timeout
LDEV-3210 - Heap memory gradually increases after complex use of ArrayEach() with parallel threads
SMTP
LDEV-2473 - Lucee ignores cfmailparam name=“Message-ID”
LDEV-2233 - mail spooler still retries mails with a missing from address
LDEV-2234 - cfmail only validates emails when spooling
LDEV-2561 - No provider for smtp exception using AWS SES
LDEV-2926 - Mail leaks server information in Message-ID
LDEV-2945 - CFMAIL doesn’t default type to plain text when empty
LDEV-2528 - Mixed-orientation PDF support
LDEV-2480 - cfdocument crashes generating PDF with embedded base64 image in Java 11
LDEV-93 - cfpdf action=“write” fails to preserve info metadata
LDEV-2424 - cfpdf action=“getinfo” does not return PageRotations or PageSizes properties
LDEV-2595 - pd4fonts.properties file generated by PDF extension is missing an important newline
LDEV-2556 - Regression: Local images no longer render in PDF in Lucee 5.3+
LDEV-3078 - cfdocument, images with data URLs don’t work in the body
LDEV-3108 - Error on CFDocument: Provider for class javax.xml.transform.TransformerFactory cannot be created
Documentation
LDEV-2888 - local lucee docs doesn’t use member-position for object methods
LDEV-3040 - GetTagData should return the tag attributes in an ordered struct
Lucee Admin
LDEV-1114 - Proxy settings in server admin broken
LDEV-1162 - allow to set a general Proxy in the admin.
LDEV-1200 - datasource hints don’t include username if password is blank
LDEV-1960 - add a purge debugging logs button/method
LDEV-3497 - Lucee Server Admin “Restart Lucee” silently 404s on second click
LDEV-2408 - Plugin doesn’t work after installing extension until Lucee restarts
LDEV-2483 - snapshot updates aren’t being advertised on admin overview page
LDEV-2617 - Change the info in update page - Admin
LDEV-2623 - Encrypted password didn’t showing properly - Admin - Mail
LDEV-2518 - when the update provider isn’t accessible, show an error message
LDEV-3016 - clicking an admin update notification should auto select the latest version
LDEV-2927 - Web admin panel displays incorrect datasource host
LDEV-3098 - lucee admin is too animated for RDP sessions
LDEV-3121 - improve extensions page
LDEV-3148 - forgbox extensions missing from admin
Query of Queries
LDEV-3042 - Query of Query performance is very bad and single threaded for complex SQL
LDEV-2382 - Query of Query doesn’t return correct results when UPPER() is used
ORM
LDEV-3411 - Application Scope Leak & Zombie DB connections when ORM inside CFTHREAD
Scheduler
LDEV-1724 - Daylight Savings Time, Scheduler, and 100% CPU Usages
LDEV-2712 - shutdown taking 1m
LDEV-3243 - Schedule task - action=delete doesn’t throws error for the non existing task
LDEV-3214 - Increased CPU usage (+40%) - due to scheduled task threads
Datasources
LDEV-2937 - add possibility to configure the maximal lifetime of a datasource connection
LDEV-2943 - add maximum lifetime timeout for datasources
LDEV-2978 - Administrator.updateDatasource() issues creating MSSQL datasource
LDEV-2933 - Oracle transaction isolation bug
LDEV-3010 - queryparam measures maxlength based on character length instead of byte length
LDEV-3124 - Datasource timeout (isvalid()) checks can completely lock connection pool
LDEV-3487 - mysql insert not returning the identity
LDEV-2920 - cfqueryparam list throws cryptic exception
LDEV-2292 - clearParam removes SQL
LDEV-2902 - Datasources defined in Application.cfc always get a timezone set
LDEV-3126 - Allow Controler validation of datasource connections to be disabled
LDEV-3143 - cfqueryparam Should Accept datetime type as alias to timestamp
LDEV-3316 - test.tags.Query.testQueryParamCharset tests failing on windows
Debugging
LDEV-2674 - disabling debugging should purge the debug logs from memory
LDEV-2988 - Missing “debugging.implicitAccess” variable in debug template
LDEV-2992 - Add enabled attribute to cfdump
LDEV-3074 - debugging template is called redundantly after a cfcontent tag
Logging
LDEV-2990 - Application.log missing
LDEV-3036 - Hang: Log4JEngine: failed to stop thread. Conflict in same thread
LDEV-3001 - Application log missing application name
LDEV-3083 - regression, logging from thread doesn’t work
LDEV-3084 - regression, datasource session scope logging no longer going to scope.log
LDEV-3266 - cflog doesn’t write application name to log
LDEV-3352 - apache commons logging locked
Mappings
LDEV-3101 - Allow initially missing application defined mapping physical paths to be re-checked
Static
LDEV-3334 - static function cannot be used with dot notation
LDEV-3465 - Regression: inherited static variables no longer accessible in child components
LDEV-265 - Static variable values seem to occasionally “reset”
LDEV-3221 - Regression: Closure in static method calling another static method causes request to hang when run in parallel
LDEV-2932 - component looses static functions
Sessions / Cookies
LDEV-784 - CSRFverifyToken() does not work when this.sessionCluster = true
LDEV-2555 - Application action=“update” reverts sessioncluster and clientcluster to false.
LDEV-2973 - Sessiontimeout ignored with J2EE sessions
LDEV-2823 - lucee session databases queries aren’t named
LDEV-2993 - SameSite for CFCookie doesn’t send None values
LDEV-2998 - cfhttp result cookie query resultset doesn’t contain a samesite column
LDEV-3062 - add sessioncookie support for path attribute
Bug Fixes
LDEV-2928 - code change affects already loaded components
LDEV-2885 - Can’t copy file
LDEV-2898 - Seemingly random but regular lucee.runtime.exp.TemplateException: lucee.transformer.library.tag.TagLibException popping up
LDEV-2934 - ParseNumber has no default radix
LDEV-2950 - reFindNoCase does not return subexpression
LDEV-2960 - Showing wrong exception using cfadmin - getdefaultSecurityManager function
LDEV-2961 - PassBy=“value” doesn’t duplicate entire structure
LDEV-2971 - array.append with merge with non array fails silently
LDEV-2977 - administrator.cfc updateMapping()
LDEV-3017 - the word blacklist is offensive and should not be used
LDEV-3018 - File uploads doesn’t support allowedExtensions or strict=“false”
LDEV-3023 - XSS in REST error handler
LDEV-3026 - ListAsArray.containsAll() invokes List.contain() method instead of List.containsAll()
LDEV-2810 - CFXML error
LDEV-1997 - getPageContext().getRequest().getRequestUrl() different
LDEV-2120 - lucee/graph.cfm lack of exception handling
LDEV-2156 - ReMatchNoCase() doesn’t work as expected when handling with vast data
LDEV-3054 - Setting enablenullsupport in cfapplication tag throws NoSuchMethodError
LDEV-3066 - ReReplace regression
LDEV-3075 - Remove support for pack200
LDEV-3111 - nullPointerError with threads
LDEV-3117 - cfexecute directory=“#GetTempDirectory()#” throws error
LDEV-3155 - REST errors do not trigger Application.onError()
LDEV-3156 - Add Parameter Alias “onConflict” for “nameConflict” in fileUpload
LDEV-3163 - cache connection not get updated with deployment
LDEV-3167 - since toJson function, wrong available functions on error with unknown function
LDEV-3185 - csrfGenerateToken() returns an empty string
LDEV-2538 - Improve error message - cflocation tag with end tag didn’t work properly
LDEV-3199 - function week() returns wrong alue 54 for 27. december 2020
LDEV-3211 - regression with LDEV-2810
LDEV-3220 - better error feedback for cffile permission problems
LDEV-3236 - Failed to download the bundle [com.sun.jna:5.5.0] on first start without network connection
LDEV-3242 - NPE customtag and server.cache in admin (listCTCache)
LDEV-3244 - member function with too many arguments throws incorrect Error
LDEV-3256 - web admin-Debugging settings shows Can’t cast String [] to a boolean error
LDEV-3275 - IsNumeric returns True on strings like “3d” and “6f” (5.3.8 regression!)
LDEV-3278 - IllegalArgumentException timeout value is negative - using now() on cfschedule tag
LDEV-2562 - \WEB-INF\lucee\context\admin\resources\img\arrow-right.gif.cfm not found
LDEV-2645 - Regression: In Lucee 5.3.3, component Property function does not recognize variables defined at the top of that Component
LDEV-2689 - Function isValid for URLs does not validate SharePoint/Office365 links properly
LDEV-2747 - isNumeric doesn’t support negative e notation
LDEV-2748 - Short-hand component properties parsed incorrectly - regression from 5.3.3
LDEV-2749 - JavaLoader throws exception loading Apache Tika library
Contributors
Our thanks goes to all Contributors for this release candidate, plus everybody who has worked with the team, testing, reporting bugs and helping us solve problems
- John Bampton
- Mircea Botex
- Ben Bluemel
- Andrew Dixon
- kaputotx
- Michael Offner
- Eric Peterson
- Pothys Ravichandran
- Andreas Ru
- Igal Sapir
- Zac Spitzer
- stillnet
- Brad Wood
- Dan Switzer, II
Regressions
Currently there are no known regressions between 5.3.7 and 5.3.8.
Roadmap
This will be the last release cycle for 5.3.
5.3.8 is a supported release and will still receive bug fixes.
The Lucee team is now working on getting Lucee 6.0 ready. Once we have 6.0 stable enough for use, we will start publishing snapshots.
In the meantime, we will be updating some extensions with bug fixes and new JDBC versions.
The Hibernate / ORM 5.4 extension is in beta and will be released soon.
We also still have an enormous backlog of Pull Requests which we want to review and merge.
The ongoing development of Lucee is community funded, if you would like to support the project, you can make a donation via Open Collective Lucee - Open Collective
