# 1.13.0

**BoxLang 1.13.0** is a stability-first release with deep compatibility work and runtime hardening. This build closes **48 issues** (all resolved), with the majority focused on CFML compatibility edge cases, concurrency correctness, formatting parity, and miniserver/runtime reliability under real production loads.

While this release is bug-fix heavy, it still introduces several meaningful features and quality-of-life improvements: character-aware trimming, class metadata lookup by absolute path, process environment control in `SystemExecute()`, SOAP headers, new query column rename capabilities, and safer miniserver routing/security defaults.

Release report: [BoxLang 1.13.0 in Jira](https://ortussolutions.atlassian.net/projects/BL/versions/22840/tab/release-report-all-issues)

## 🚀 Major Highlights

### ✅ Compatibility Parity Sweep (CFML + Formatting)

A large portion of 1.13.0 targets exact behavior parity with Adobe CF/Lucee in places where tiny differences caused real migration friction.

Key parity wins include:

* `numberFormat()` mask compatibility for patterns like `_$,.99`, `,9`, and `$,.00`
* `TimeFormat()` token behavior (`n`/`nn` minutes)
* locale-aware date parsing for `en_AU` and `en_GB`
* query BIF column name trimming behavior
* transpiler fixes around `preserveSingleQuotes()` injection and source type handling
* `cfcatch` `name` attribute support in template syntax

```js
// numberFormat compatibility fixes
numberFormat( 432342, "$,.00" )    // no malformed pattern exception
numberFormat( 1234, ",9" )         // 1,234
numberFormat( 2, "999,999,999" )   // 2 (not 000,000,002)

// TimeFormat minute token fix
timeFormat( now(), "HH:nn" )
```

```js
// Locale-sensitive parse now works correctly for AU/GB day-first dates
setLocale( "en_GB" )
parsed = parseDateTime( "31/01/2026", "dd/MM/yyyy" )
```

### 🧵 Async + Concurrency Hardening

Several race and lifecycle issues have been resolved across async execution, file/class generation, and array iteration.

Notable fixes:

* async API surface normalized (missing methods/signatures corrected)
* `BoxFuture()` context lifecycle fix after HTTP request completion
* race condition fixes for `for/in` array iteration
* atomic class file writes (temp file + atomic rename)

```js
// Spread positional args now supported in function calls
args = [ "Brad", "Wood" ]
fullName = buildName( ...args )
```

The runtime now better protects background work from request teardown timing and avoids transient zero-byte class artifacts on disk.

### 🖥️ Miniserver Reliability + Security

1.13.0 improves miniserver correctness for large transfers and upload edge cases while tightening static-serving protections.

Improvements/fixes include:

* configurable pass predicate (CLI, JSON config, env var)
* stronger static security filter (hidden files, config/source exposure blocked)
* chunked encoding truncation fix for large file responses
* empty text-file upload handling correction

```bash
# CLI pass predicate support
boxlang server start --pass-predicate "/api/*"
```

```json
{
  "web": {
    "passPredicate": "/api/*"
  }
}
```

### 🧰 BoxLang Formatter Tool

One of the biggest practical additions in this release cycle is the maturity jump of the BoxLang formatter (`boxlang format`).

The formatter is now production-usable as both a local developer tool and a CI quality gate:

* wired directly into `boxlang format` CLI action in `BoxRunner`
* supports **check mode** with non-zero exit codes when formatting drift is detected
* auto-discovers config with fallback precedence:
  1. `.bxformat.json`
  2. `.cfformat.json` (auto-converted into formatter config model)
  3. built-in defaults
* supports in-place formatting, stdout mode, and directory recursion
* supports BoxLang + CFML extensions in one pass: `.bx`, `.bxs`, `.bxm`, `.cfm`, `.cfc`, `.cfs`

```bash
# Help and Options
boxlang format --help

# Format project in-place (default behavior)
boxlang format --input ./

# CI gate: fail if any file is not properly formatted
boxlang format --check --input ./

# Print formatted content to stdout without touching files
boxlang format --overwrite false --input ./models/User.cfc
```

Config bootstrap and migration are built in:

```bash
# Generate default formatter config
boxlang format --initConfig

# Convert legacy .cfformat.json to .bxformat.json
boxlang format --convertConfig --input ./
```

Why this matters in 1.13.0:

* **BL-2398** aligns BoxLang-native default formatting with Ortus gold-standard conventions.
* `.cfformat.json` compatibility mode still uses legacy baseline defaults for migration-safe behavior.
* **BL-2396** fixes a source-type regression in the transpiler/pretty-printer pipeline so formatting and source interpretation stay consistent.

This gives teams a safe migration path: keep legacy output behavior where needed, or adopt modern BoxLang-first formatting defaults with `.bxformat.json`.

## ✨ New Features

### `trim()`, `ltrim()`, `rtrim()` gain `chars` argument (BL-2348)

You can now trim custom character sets instead of only whitespace.

```js
"**Urgent**".trim( "*" )        // "Urgent"
"000123".ltrim( "0" )           // "123"
"report....".rtrim( "." )       // "report"
```

### `getClassMetadata( absolutePath )` support (BL-2349)

Class metadata can now be loaded directly from absolute paths, useful for tooling, scanners, and IDE integrations.

```js
meta = getClassMetadata( "/opt/apps/myapp/models/User.bx" )
println( meta.name )
```

### `SystemExecute()` environment controls (BL-2390)

Two new arguments provide deterministic process environment behavior:

* `inheritEnvironment` (default `true`)
* `environment` (struct of env vars)

```js
result = systemExecute(
    name = "env",
    arguments = "",
    inheritEnvironment = false,
    environment = {
        APP_ENV : "production",
        FEATURE_X : "true"
    }
)
```

## 🔧 Improvements

### SOAP header support (BL-2078)

SOAP requests can now include optional `<Header>` blocks for auth/security and cross-cutting metadata.

### `query.setColumnNames()` compatibility API (BL-2333)

Query objects now support column renaming through a dedicated method.

```js
q = queryNew( "fname,lname", "varchar,varchar", [ [ "Ada", "Lovelace" ] ] )
q.setColumnNames( [ "firstName", "lastName" ] )
```

### Miniserver pass predicate configurability (BL-2354)

Routing pass-through is now configurable via:

* `--pass-predicate`
* JSON config
* `BOXLANG_PASS_PREDICATE` environment variable

### Miniserver security handler upgrades (BL-2355)

Static serving now blocks sensitive/unsafe resources more aggressively, including hidden files and framework/source/config artifacts.

### CLI now reads `~/.box.env` (BL-2378)

CLI startup now loads user-level env vars from `~/.box.env`.

```bash
# ~/.box.env
DB_HOST=localhost
DB_PORT=5432
```

## 🐛 Bug Fixes (By Area)

### Async & Threading

* **BL-2269**: Missing async methods/signatures fixed (`all()`, `allApply()`, `thenAsync()`, `delay()`, `shutdownAndAwaitTermination()`), with improved argument conventions.
* **BL-2376**: `BoxFuture()` scope access errors after HTTP request completion resolved via safer context/thread lifecycle handling.
* **BL-2372**: Concurrent modification exception fixed for array `for/in` loops.
* **BL-2373**: Class-file write race fixed with atomic write pattern.

### CF Compatibility / Transpiler

* **BL-2334**: `preserveSingleQuotes()` wrapping narrowed to correct interpolation contexts in query bodies.
* **BL-2335**: `queryNew()` now accepts/ignores `cf_sql_` prefix as expected.
* **BL-2358**: `<cfloop endRow="0">` behavior aligned to "do not loop" semantics.
* **BL-2359**: leading whitespace/line-break trimming behavior matched to CF.
* **BL-2371**: query column names are trimmed consistently in query BIFs.
* **BL-2377** / **BL-2388**: UDF output inheritance behavior corrected inside CFC/include scenarios.
* **BL-2389**: `listQualify()` empty-string list behavior aligned with Adobe.
* **BL-2391**: template `<cfcatch>` now supports `name` variable binding.
* **BL-2396**: transpiler pretty-printer regression fixed for source type handling.

```html
<cfcatch type="any" name="anyError">
    <cfoutput>#anyError.message#</cfoutput>
</cfcatch>
```

### Number & Date Formatting

* **BL-2337**, **BL-2338**, **BL-2339**, **BL-2340**, **BL-2387**: major `numberFormat()` mask compatibility fixes.
* **BL-2362**: `TimeFormat()` minute token handling corrected.
* **BL-2364**: compat parse now accepts formats like `Mar 12 2026 12:00AM`.
* **BL-2375**: day-first locale parsing fixed for AU/GB both via explicit locale arg and `setLocale()`.

### Runtime / Core

* **BL-2336**: abort semantics corrected in web runtime Java `try/catch` boundaries.
* **BL-2343**: deterministic, per-binary AppCDS paths on Windows.
* **BL-2344**: failed superclass init now allows class recreation retries.
* **BL-2350**: graceful `blockfactor=0` validation behavior.
* **BL-2351**: module `onLoad()` request-context setup fixes `dump()` template behavior.
* **BL-2356**: REST CFC service-name mapping corrected.
* **BL-2357**: broad class creation and locator performance optimizations.
* **BL-2360**: positional spread arguments now supported in calls.
* **BL-2361**: JSA package path handling fixed for `BOXLANG_HOME` with spaces.
* **BL-2374**: zero timespan (`createTimeSpan(0,0,0,0)`) correctly interpreted as no-cache.
* **BL-2380**: remote methods now force-write correctly under `enableOutputOnly`.
* **BL-2382**: binary write path fixed for valid downloaded ZIP output.
* **BL-2383**: superclass source changes now detected without requiring child manual recompile.
* **BL-2384**: numeric parsing now handles leading-zero strings safely.
* **BL-2385**: empty text-file upload behavior fixed in miniserver.
* **BL-2386**: QoQ nested-parentheses predicate parsing corrected.
* **BL-2393**: chunked encoding truncation fixed for large-file responses.
* **BL-2394**: custom-tag context no longer leaks incorrect `this` scope.

## 📊 Release Snapshot

* **Release Date:** April 29, 2026
* **Status:** Released
* **Total Issues:** 48
* **Distribution:** 38 Bugs, 8 Improvements, 3 New Features
* **Primary Focus:** CF compatibility parity and runtime stability under concurrency/load

{% hint style="success" %}
BoxLang 1.13.0 is the recommended update for teams migrating CFML applications that depend on edge-case formatting/transpiler parity or running high-concurrency web/miniserver workloads.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://boxlang.ortusbooks.com/readme/release-history/1.13.0.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.