New Stable Release (

The Lucee team is proud to announce the Stable Release of 5.3.8, available for download or via the Lucee Admin.

This has been a very long release cycle, a massive thank you to everyone who has been helping us test and address regressions and performance problems…

We have done a lot of work in 5.3.8 to optimise memory usage, the main two areas being improved was the template cache handling and parallel functionality.

The Docker builds will be available next week, we are still sorting out some issues since we migrated to GitHub Actions from Travis CI.

We also now have CI Testing in place for most Lucee extensions, using the Lucee Script Runner GitHub - zspitzer/lucee-script-engine-runner: CFML Ant script runner for Lucee Server JSR-223

Java / Tomcat Versions

Java 8, Java 11 LTS.

The Lucee Installer bundles AdoptOpenJDK-11.0.11+9 and Tomcat 9.0.46

Linux installer is available for download, the Windows Installer will be listed shortly

Java 16 is not currently supported due to some breaking JVM changes.

The bundled caerts file has also been updated with the version from Java SE 11.0.11

Tickets addressed in this Release

New Functionality

LDEV-42 - Array methods: shift(), unshift(), push(), pop(), splice()
LDEV-3134 - ACF2021 - add function ArrayPush
LDEV-3135 - ACF2021 - add function ArrayPop
LDEV-3136 - ACF2021 - add function ArrayShift
LDEV-3137 - ACF2021 - add function ArrayUnShift
LDEV-2686 - Add function structValueArray()
LDEV-1328 - add optional offset argument to callStackGet()
LDEV-2883 - Add support for the Argon2 hashing algorithm
LDEV-1826 - Add QuerySetRow, Query.setRow() and allow returning an array from QueryRowData
LDEV-3009 - add support for Java Regex
LDEV-2881 - Add iso format for DateTimeFormat
LDEV-2764 - Allow Query to return a 1-record Struct
LDEV-2912 - Add attribute directory to cfexecute
LDEV-1746 - Allow ${} in Lucee config files
LDEV-3239 - cfhttp doesn’t support TLSv1.3
LDEV-3377 - tag cfhttp stream support
LDEV-3122 - add nameconflict=“forceunique” for file uploads to use a filename with a uuid
LDEV-3147 - ACF2021 - add function ClearTimeZone
LDEV-3149 - ACF2021 - add member function toJson
LDEV-946 - Always include functions and properties in CFC metadata


LDEV-2772 - add an application setting to disable searching query resultsets for unscoped variables
LDEV-3287 - Unnecessary getRootPath() file system access on every request adds overhead
LDEV-3290 - Reevaluate performance of locking overhead in pc.initApplicationContext() for every request
LDEV-2903 - Parallel processing array.each() duplicates tmp-xxx.upload files on every loop, crashing the server


LDEV-2559 - arrayEach has too much memory overhead from duplicating pageContext
LDEV-2087 - Lucee 4 and 5 consumes too much heap memory with large uploads due to bug in
LDEV-2904 - Non-Heap Memory Increases Till Server Crashes
LDEV-3019 - add possibility to add a cpu/memory/concurrent request threshold for request timeout
LDEV-3210 - Heap memory gradually increases after complex use of ArrayEach() with parallel threads


LDEV-2473 - Lucee ignores cfmailparam name=“Message-ID”
LDEV-2233 - mail spooler still retries mails with a missing from address
LDEV-2234 - cfmail only validates emails when spooling
LDEV-2561 - No provider for smtp exception using AWS SES
LDEV-2926 - Mail leaks server information in Message-ID
LDEV-2945 - CFMAIL doesn’t default type to plain text when empty


LDEV-2528 - Mixed-orientation PDF support
LDEV-2480 - cfdocument crashes generating PDF with embedded base64 image in Java 11
LDEV-93 - cfpdf action=“write” fails to preserve info metadata
LDEV-2424 - cfpdf action=“getinfo” does not return PageRotations or PageSizes properties
LDEV-2595 - file generated by PDF extension is missing an important newline
LDEV-2556 - Regression: Local images no longer render in PDF in Lucee 5.3+
LDEV-3078 - cfdocument, images with data URLs don’t work in the body
LDEV-3108 - Error on CFDocument: Provider for class javax.xml.transform.TransformerFactory cannot be created


LDEV-2888 - local lucee docs doesn’t use member-position for object methods
LDEV-3040 - GetTagData should return the tag attributes in an ordered struct

Lucee Admin

LDEV-1114 - Proxy settings in server admin broken
LDEV-1162 - allow to set a general Proxy in the admin.
LDEV-1200 - datasource hints don’t include username if password is blank
LDEV-1960 - add a purge debugging logs button/method
LDEV-3497 - Lucee Server Admin “Restart Lucee” silently 404s on second click
LDEV-2408 - Plugin doesn’t work after installing extension until Lucee restarts
LDEV-2483 - snapshot updates aren’t being advertised on admin overview page
LDEV-2617 - Change the info in update page - Admin
LDEV-2623 - Encrypted password didn’t showing properly - Admin - Mail
LDEV-2518 - when the update provider isn’t accessible, show an error message
LDEV-3016 - clicking an admin update notification should auto select the latest version
LDEV-2927 - Web admin panel displays incorrect datasource host
LDEV-3098 - lucee admin is too animated for RDP sessions
LDEV-3121 - improve extensions page
LDEV-3148 - forgbox extensions missing from admin

Query of Queries

LDEV-3042 - Query of Query performance is very bad and single threaded for complex SQL
LDEV-2382 - Query of Query doesn’t return correct results when UPPER() is used


LDEV-3411 - Application Scope Leak & Zombie DB connections when ORM inside CFTHREAD


LDEV-1724 - Daylight Savings Time, Scheduler, and 100% CPU Usages
LDEV-2712 - shutdown taking 1m
LDEV-3243 - Schedule task - action=delete doesn’t throws error for the non existing task
LDEV-3214 - Increased CPU usage (+40%) - due to scheduled task threads


LDEV-2937 - add possibility to configure the maximal lifetime of a datasource connection
LDEV-2943 - add maximum lifetime timeout for datasources
LDEV-2978 - Administrator.updateDatasource() issues creating MSSQL datasource
LDEV-2933 - Oracle transaction isolation bug
LDEV-3010 - queryparam measures maxlength based on character length instead of byte length
LDEV-3124 - Datasource timeout (isvalid()) checks can completely lock connection pool
LDEV-3487 - mysql insert not returning the identity
LDEV-2920 - cfqueryparam list throws cryptic exception
LDEV-2292 - clearParam removes SQL
LDEV-2902 - Datasources defined in Application.cfc always get a timezone set
LDEV-3126 - Allow Controler validation of datasource connections to be disabled
LDEV-3143 - cfqueryparam Should Accept datetime type as alias to timestamp
LDEV-3316 - test.tags.Query.testQueryParamCharset tests failing on windows


LDEV-2674 - disabling debugging should purge the debug logs from memory
LDEV-2988 - Missing “debugging.implicitAccess” variable in debug template
LDEV-2992 - Add enabled attribute to cfdump
LDEV-3074 - debugging template is called redundantly after a cfcontent tag


LDEV-2990 - Application.log missing
LDEV-3036 - Hang: Log4JEngine: failed to stop thread. Conflict in same thread
LDEV-3001 - Application log missing application name
LDEV-3083 - regression, logging from thread doesn’t work
LDEV-3084 - regression, datasource session scope logging no longer going to scope.log
LDEV-3266 - cflog doesn’t write application name to log
LDEV-3352 - apache commons logging locked


LDEV-3101 - Allow initially missing application defined mapping physical paths to be re-checked


LDEV-3334 - static function cannot be used with dot notation
LDEV-3465 - Regression: inherited static variables no longer accessible in child components
LDEV-265 - Static variable values seem to occasionally “reset”
LDEV-3221 - Regression: Closure in static method calling another static method causes request to hang when run in parallel
LDEV-2932 - component looses static functions

Sessions / Cookies

LDEV-784 - CSRFverifyToken() does not work when this.sessionCluster = true
LDEV-2555 - Application action=“update” reverts sessioncluster and clientcluster to false.
LDEV-2973 - Sessiontimeout ignored with J2EE sessions
LDEV-2823 - lucee session databases queries aren’t named
LDEV-2993 - SameSite for CFCookie doesn’t send None values
LDEV-2998 - cfhttp result cookie query resultset doesn’t contain a samesite column
LDEV-3062 - add sessioncookie support for path attribute

Bug Fixes

LDEV-2928 - code change affects already loaded components
LDEV-2885 - Can’t copy file
LDEV-2898 - Seemingly random but regular lucee.runtime.exp.TemplateException: lucee.transformer.library.tag.TagLibException popping up
LDEV-2934 - ParseNumber has no default radix
LDEV-2950 - reFindNoCase does not return subexpression
LDEV-2960 - Showing wrong exception using cfadmin - getdefaultSecurityManager function
LDEV-2961 - PassBy=“value” doesn’t duplicate entire structure
LDEV-2971 - array.append with merge with non array fails silently
LDEV-2977 - administrator.cfc updateMapping()
LDEV-3017 - the word blacklist is offensive and should not be used
LDEV-3018 - File uploads doesn’t support allowedExtensions or strict=“false”
LDEV-3023 - XSS in REST error handler
LDEV-3026 - ListAsArray.containsAll() invokes List.contain() method instead of List.containsAll()
LDEV-2810 - CFXML error
LDEV-1997 - getPageContext().getRequest().getRequestUrl() different
LDEV-2120 - lucee/graph.cfm lack of exception handling
LDEV-2156 - ReMatchNoCase() doesn’t work as expected when handling with vast data
LDEV-3054 - Setting enablenullsupport in cfapplication tag throws NoSuchMethodError
LDEV-3066 - ReReplace regression
LDEV-3075 - Remove support for pack200
LDEV-3111 - nullPointerError with threads
LDEV-3117 - cfexecute directory="#GetTempDirectory()#" throws error
LDEV-3155 - REST errors do not trigger Application.onError()
LDEV-3156 - Add Parameter Alias “onConflict” for “nameConflict” in fileUpload
LDEV-3163 - cache connection not get updated with deployment
LDEV-3167 - since toJson function, wrong available functions on error with unknown function
LDEV-3185 - csrfGenerateToken() returns an empty string
LDEV-2538 - Improve error message - cflocation tag with end tag didn’t work properly
LDEV-3199 - function week() returns wrong alue 54 for 27. december 2020
LDEV-3211 - regression with LDEV-2810
LDEV-3220 - better error feedback for cffile permission problems
LDEV-3236 - Failed to download the bundle [com.sun.jna:5.5.0] on first start without network connection
LDEV-3242 - NPE customtag and server.cache in admin (listCTCache)
LDEV-3244 - member function with too many arguments throws incorrect Error
LDEV-3256 - web admin-Debugging settings shows Can’t cast String to a boolean error
LDEV-3275 - IsNumeric returns True on strings like “3d” and “6f” (5.3.8 regression!)
LDEV-3278 - IllegalArgumentException timeout value is negative - using now() on cfschedule tag
LDEV-2562 - \WEB-INF\lucee\context\admin\resources\img\arrow-right.gif.cfm not found
LDEV-2645 - Regression: In Lucee 5.3.3, component Property function does not recognize variables defined at the top of that Component
LDEV-2689 - Function isValid for URLs does not validate SharePoint/Office365 links properly
LDEV-2747 - isNumeric doesn’t support negative e notation
LDEV-2748 - Short-hand component properties parsed incorrectly - regression from 5.3.3
LDEV-2749 - JavaLoader throws exception loading Apache Tika library


Our thanks goes to all Contributors for this release candidate, plus everybody who has worked with the team, testing, reporting bugs and helping us solve problems

  • John Bampton
  • Mircea Botex
  • Ben Bluemel
  • Andrew Dixon
  • kaputotx
  • Michael Offner
  • Eric Peterson
  • Pothys Ravichandran
  • Andreas Ru
  • Igal Sapir
  • Zac Spitzer
  • stillnet
  • Brad Wood
  • Dan Switzer, II


Currently there are no known regressions between 5.3.7 and 5.3.8.


This will be the last release cycle for 5.3.

5.3.8 is a supported release and will still receive bug fixes.

The Lucee team is now working on getting Lucee 6.0 ready. Once we have 6.0 stable enough for use, we will start publishing snapshots.

In the meantime, we will be updating some extensions with bug fixes and new JDBC versions.

The Hibernate / ORM 5.4 extension is in beta and will be released soon.

We also still have an enormous backlog of Pull Requests which we want to review and merge.

The ongoing development of Lucee is community funded, if you would like to support the project, you can make a donation via Open Collective Lucee - Open Collective


YES!!! This list of tickets looks amazing!!


Aren’t these two statements contradictory? If 5.3.8 will receive bug fixes, then surely that means this wasn’t the last 5.3 release.

Other than that, good work everyone on the release. This was a long time coming but super stable!

aka, the major release for 5.3 :slight_smile:


The Docker images for are now on Docker Hub;

1 Like

Great news!
Can you please provide Windows installer for this version?

@karniolus: If you need to install Lucee and you are missing the latest “Lucee Installer” release at Lucee’s download site, you can still install the latest available Lucee version as a workaround with the following steps:

Step 1: Select the latest possible release that has a “Lucee Installer” version available and do the complete installation process.

Step 2: Stop the Lucee/Tomcat service.

Step 3: Download the latest “Lucee.jar” file at Lucee’s download page at

Step 4: Replace the old lucee.jar with the new downloaded Lucee.jar file at path-to-lucee-install/lib/

Step 5: Delete the folder “lucee-server” at path-to-lucee-install/tomcat/lucee-server

Step 6: Restart the Lucee/Tomcat service

The steps above are pratically an installation followed by an upgrade of the lucee servlet container lucee.jar.

Hope this helps

1 Like

Thank you @andreas, it worked.

But it will be very convenient to have on each Lucee release automatically built Windows installer.
When I make new fresh installations it is more easy to install it without additional steps.

Glad it worked!

Yes @karniolus, I totally agree that these files should be automatically built, just like the other files are!!! That’s how it should be. The issue is that the installer was always supplied with courtesy by the viviotech team in the past, but the main person behind the installer files and deploying it unfortunately left viviotech.

I know that the Lucee Core Team recently forked the installer files. See:

They are working hard to supply the files and everything smoother in future. They are also working hard to make it even better (e.g. I know they would love to add ngnix support to it and even Apache2 on Windows).

But they have/had lots and lots of other priorities, such as getting the latest stable release out with all the added functions, bug fixes and doing it without regressions. Besides, they are working also on Lucee 6.

That’s why they need our help from the community with contributions in whatever/wherever we can contribute. Lucee lives a lot from contribuitions.

1 Like

the windows installer is ready, just the download site, isn’t showing it


Thank you for quick response!

A post was split to a new topic: Mappings not working with IIS and Boncode

Great effort from everyone involved

1 Like

I’ve always upgraded Lucee from the admin section. I understand that doesn’t include updated Java or Tomcat versions? If that’s the case what are the procedures for upgrading from the windows installer? Thank you!

Updating Java is easy, you can just stop Tomcat and replace the JRE in the install folder (C:\lucee\jre)

Or you can just point it at a different folder, using the Lucee-Tomcat Service Control

Tomcat is a bit more complicated, depending on which version you are upgrading from

1 Like

Good one! My prefered option as of today is:

Simply download JDK version(s) as zip file(s) from and extract it/them to the C:\lucee\ directory e.g. C:\lucee\jdk-11.0.11+9 or C:\lucee\jdk8u292-b10.

To switch them you can simply stop Lucee/Tomcat and rename the directories (old into C:\lucee\jdk_bak and the new into the default location C:\lucee\jdk). Then restart Lucee/Tomcat. Switching between Java versions like so feels the quickiest to me. If something goes wrong, you can always switch back in a matter of seconds by renaming it back without editing services or setenv.bat files.

This way I can switch safe even in production. If I notice a day or two that something is going wrong, I can simply rename the old version back.

Similarly I do it with Lucee.jar for Lucee upgrades. I have various Lucee-x.x.x.x.jar downloaded and located in Tomcats lib or lib/ext folder. I have them all deactivated by having the file extension named *.j–ar and only keep the .jar file extension of the Lucee version intact that I want to load/run.

Switching back and forth even in production is extremly quick. That is what I do when @Zackster comes here asking us to test release candidates on production :smiley:

But always make also a backup of your Lucee admin configurations first.

There is currently one known regression with this release

It has just been fixed in the, we will be making a minor 5.3.8 stable release next week including this fix

1 Like

Another regression with this latest release.

Same here - experiencing both regressions unfortunately. Any ETA on that fixes update?