1.13.0

April 29, 2026

BoxLang 1.13.0 is a stability-first release with deep compatibility work and runtime hardening. This build closes 48 issues (all resolved), with the majority focused on CFML compatibility edge cases, concurrency correctness, formatting parity, and miniserver/runtime reliability under real production loads.

While this release is bug-fix heavy, it still introduces several meaningful features and quality-of-life improvements: character-aware trimming, class metadata lookup by absolute path, process environment control in SystemExecute(), SOAP headers, new query column rename capabilities, and safer miniserver routing/security defaults.

Release report: BoxLang 1.13.0 in Jira

🚀 Major Highlights

✅ Compatibility Parity Sweep (CFML + Formatting)

A large portion of 1.13.0 targets exact behavior parity with Adobe CF/Lucee in places where tiny differences caused real migration friction.

Key parity wins include:

• numberFormat() mask compatibility for patterns like _$,.99, ,9, and $,.00

• TimeFormat() token behavior (n/nn minutes)

• locale-aware date parsing for en_AU and en_GB

• query BIF column name trimming behavior

• transpiler fixes around preserveSingleQuotes() injection and source type handling

• cfcatch name attribute support in template syntax

// numberFormat compatibility fixes
numberFormat( 432342, "$,.00" )    // no malformed pattern exception
numberFormat( 1234, ",9" )         // 1,234
numberFormat( 2, "999,999,999" )   // 2 (not 000,000,002)

// TimeFormat minute token fix
timeFormat( now(), "HH:nn" )

// Locale-sensitive parse now works correctly for AU/GB day-first dates
setLocale( "en_GB" )
parsed = parseDateTime( "31/01/2026", "dd/MM/yyyy" )

🧵 Async + Concurrency Hardening

Several race and lifecycle issues have been resolved across async execution, file/class generation, and array iteration.

Notable fixes:

• async API surface normalized (missing methods/signatures corrected)

• BoxFuture() context lifecycle fix after HTTP request completion

• race condition fixes for for/in array iteration

• atomic class file writes (temp file + atomic rename)

// Spread positional args now supported in function calls
args = [ "Brad", "Wood" ]
fullName = buildName( ...args )

The runtime now better protects background work from request teardown timing and avoids transient zero-byte class artifacts on disk.

🖥️ Miniserver Reliability + Security

1.13.0 improves miniserver correctness for large transfers and upload edge cases while tightening static-serving protections.

Improvements/fixes include:

• configurable pass predicate (CLI, JSON config, env var)

• stronger static security filter (hidden files, config/source exposure blocked)

• chunked encoding truncation fix for large file responses

• empty text-file upload handling correction

# CLI pass predicate support
boxlang server start --pass-predicate "/api/*"

{
  "web": {
    "passPredicate": "/api/*"
  }
}

🧰 BoxLang Formatter Tool

One of the biggest practical additions in this release cycle is the maturity jump of the BoxLang formatter (boxlang format).

The formatter is now production-usable as both a local developer tool and a CI quality gate:

• wired directly into boxlang format CLI action in BoxRunner

• supports check mode with non-zero exit codes when formatting drift is detected

• auto-discovers config with fallback precedence:

  1. .bxformat.json

  2. .cfformat.json (auto-converted into formatter config model)

  3. built-in defaults

• supports in-place formatting, stdout mode, and directory recursion

• supports BoxLang + CFML extensions in one pass: .bx, .bxs, .bxm, .cfm, .cfc, .cfs

# Help and Options
boxlang format --help

# Format project in-place (default behavior)
boxlang format --input ./

# CI gate: fail if any file is not properly formatted
boxlang format --check --input ./

# Print formatted content to stdout without touching files
boxlang format --overwrite false --input ./models/User.cfc

Config bootstrap and migration are built in:

# Generate default formatter config
boxlang format --initConfig

# Convert legacy .cfformat.json to .bxformat.json
boxlang format --convertConfig --input ./

Why this matters in 1.13.0:

• BL-2398 aligns BoxLang-native default formatting with Ortus gold-standard conventions.

• .cfformat.json compatibility mode still uses legacy baseline defaults for migration-safe behavior.

• BL-2396 fixes a source-type regression in the transpiler/pretty-printer pipeline so formatting and source interpretation stay consistent.

This gives teams a safe migration path: keep legacy output behavior where needed, or adopt modern BoxLang-first formatting defaults with .bxformat.json.

✨ New Features

trim(), ltrim(), rtrim() gain chars argument (BL-2348)

You can now trim custom character sets instead of only whitespace.

"**Urgent**".trim( "*" )        // "Urgent"
"000123".ltrim( "0" )           // "123"
"report....".rtrim( "." )       // "report"

getClassMetadata( absolutePath ) support (BL-2349)

Class metadata can now be loaded directly from absolute paths, useful for tooling, scanners, and IDE integrations.

meta = getClassMetadata( "/opt/apps/myapp/models/User.bx" )
println( meta.name )

SystemExecute() environment controls (BL-2390)

Two new arguments provide deterministic process environment behavior:

• inheritEnvironment (default true)

• environment (struct of env vars)

result = systemExecute(
    name = "env",
    arguments = "",
    inheritEnvironment = false,
    environment = {
        APP_ENV : "production",
        FEATURE_X : "true"
    }
)

🔧 Improvements

SOAP header support (BL-2078)

SOAP requests can now include optional <Header> blocks for auth/security and cross-cutting metadata.

query.setColumnNames() compatibility API (BL-2333)

Query objects now support column renaming through a dedicated method.

q = queryNew( "fname,lname", "varchar,varchar", [ [ "Ada", "Lovelace" ] ] )
q.setColumnNames( [ "firstName", "lastName" ] )

Miniserver pass predicate configurability (BL-2354)

Routing pass-through is now configurable via:

• --pass-predicate

• JSON config

• BOXLANG_PASS_PREDICATE environment variable

Miniserver security handler upgrades (BL-2355)

Static serving now blocks sensitive/unsafe resources more aggressively, including hidden files and framework/source/config artifacts.

CLI now reads ~/.box.env (BL-2378)

CLI startup now loads user-level env vars from ~/.box.env.

# ~/.box.env
DB_HOST=localhost
DB_PORT=5432

🐛 Bug Fixes (By Area)

Async & Threading

• BL-2269: Missing async methods/signatures fixed (all(), allApply(), thenAsync(), delay(), shutdownAndAwaitTermination()), with improved argument conventions.

• BL-2376: BoxFuture() scope access errors after HTTP request completion resolved via safer context/thread lifecycle handling.

• BL-2372: Concurrent modification exception fixed for array for/in loops.

• BL-2373: Class-file write race fixed with atomic write pattern.

CF Compatibility / Transpiler

• BL-2334: preserveSingleQuotes() wrapping narrowed to correct interpolation contexts in query bodies.

• BL-2335: queryNew() now accepts/ignores cf_sql_ prefix as expected.

• BL-2358: <cfloop endRow="0"> behavior aligned to "do not loop" semantics.

• BL-2359: leading whitespace/line-break trimming behavior matched to CF.

• BL-2371: query column names are trimmed consistently in query BIFs.

• BL-2377 / BL-2388: UDF output inheritance behavior corrected inside CFC/include scenarios.

• BL-2389: listQualify() empty-string list behavior aligned with Adobe.

• BL-2391: template <cfcatch> now supports name variable binding.

• BL-2396: transpiler pretty-printer regression fixed for source type handling.

<cfcatch type="any" name="anyError">
    <cfoutput>#anyError.message#</cfoutput>
</cfcatch>

Number & Date Formatting

• BL-2337, BL-2338, BL-2339, BL-2340, BL-2387: major numberFormat() mask compatibility fixes.

• BL-2362: TimeFormat() minute token handling corrected.

• BL-2364: compat parse now accepts formats like Mar 12 2026 12:00AM.

• BL-2375: day-first locale parsing fixed for AU/GB both via explicit locale arg and setLocale().

Runtime / Core

• BL-2336: abort semantics corrected in web runtime Java try/catch boundaries.

• BL-2343: deterministic, per-binary AppCDS paths on Windows.

• BL-2344: failed superclass init now allows class recreation retries.

• BL-2350: graceful blockfactor=0 validation behavior.

• BL-2351: module onLoad() request-context setup fixes dump() template behavior.

• BL-2356: REST CFC service-name mapping corrected.

• BL-2357: broad class creation and locator performance optimizations.

• BL-2360: positional spread arguments now supported in calls.

• BL-2361: JSA package path handling fixed for BOXLANG_HOME with spaces.

• BL-2374: zero timespan (createTimeSpan(0,0,0,0)) correctly interpreted as no-cache.

• BL-2380: remote methods now force-write correctly under enableOutputOnly.

• BL-2382: binary write path fixed for valid downloaded ZIP output.

• BL-2383: superclass source changes now detected without requiring child manual recompile.

• BL-2384: numeric parsing now handles leading-zero strings safely.

• BL-2385: empty text-file upload behavior fixed in miniserver.

• BL-2386: QoQ nested-parentheses predicate parsing corrected.

• BL-2393: chunked encoding truncation fixed for large-file responses.

• BL-2394: custom-tag context no longer leaks incorrect this scope.

📊 Release Snapshot

• Release Date: April 29, 2026

• Status: Released

• Total Issues: 48

• Distribution: 38 Bugs, 8 Improvements, 3 New Features

• Primary Focus: CF compatibility parity and runtime stability under concurrency/load

BoxLang 1.13.0 is the recommended update for teams migrating CFML applications that depend on edge-case formatting/transpiler parity or running high-concurrency web/miniserver workloads.