> For the complete documentation index, see [llms.txt](https://boxlang.ortusbooks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://boxlang.ortusbooks.com/readme/release-history/1.19.0.md).

# 1.19.x

November 2, 2026

**BoxLang 1.19.0** continues our development mantra: **BoxLang is the AI-native software productivity platform for building, modernizing and running applications, with developers and AI agents working together.** This release adds a place for your own global settings with **`runtimeSettings`**, built-in **code coverage and execution profiling**, **static method interception**, **raw binary HTTP streaming**, and the missing **post-invocation events for BIFs**. It also brings native **savepoint release** for transactions, query error and cache observability events, much better **Java class extension**, a new key pair generator, a JDBC connection pool leak fix, a round of class-resolution and string performance work, and a long list of CFML-compatibility, `cftranspile` and database fixes.

{% hint style="success" %}

## 🎛️ NEW: Your Own Global Settings in `boxlang.json`

**Store your own named values in `boxlang.json` and override them per application.** The new `runtimeSettings` struct takes values of any type, resolves `${env.X}` placeholders and `bxsecret:` secrets at any depth, and is read with the new [`getRuntimeSetting()`](/boxlang-language/reference/built-in-functions/system/getruntimesetting.md) BIF. Read the [Runtime Settings guide](/getting-started/configuration/runtime-settings.md).
{% endhint %}

{% hint style="success" %}

## 📈 NEW: Code Coverage and Execution Profiling

**BoxLang can now tell you which code ran, how often, and where the time went**, with no changes to your code. Turn it on with a single `codeProfilerEnabled` flag and export the results as JSON, SonarQube coverage XML or HTML reports. See [Major Highlights](#-major-highlights) below.
{% endhint %}

## 🚀 Major Highlights

### 🎛️ Runtime Settings (BL-2762)

A user-defined struct in `boxlang.json` that belongs to your applications. BoxLang loads and serves it, it never interprets it.

{% code title="boxlang.json" %}

```json
{
    "runtimeSettings": {
        "apiUrl": "${env.API_URL:http://localhost:8080}",
        "stripeKey": "bxsecret:AbC123...",
        "features": { "beta": true, "regions": [ "us", "eu" ] }
    }
}
```

{% endcode %}

* **Any value type.** Strings, numbers, booleans, structs and arrays, with unique keys.
* **Environment variables and secrets.** `${env.VAR}`, `${env.VAR:default}`, the path variables and `bxsecret:` values resolve at any depth, including inside arrays.
* **Application overrides.** `this.runtimeSettings` in `Application.bx` (or `bx:application runtimeSettings={...}`) is **deep merged** over the global values and the application wins by key. Arrays and scalars are replaced, not merged. The Application layer re-resolves placeholders and secrets on **every request**, and is cached for the rest of that request.
* **Read only.** Returned structs and arrays are deeply unmodifiable.

```js
// Application.bx
class {

    this.name = "myApp"

    this.runtimeSettings = {
        features : { level : 7 }
    }

}

getRuntimeSetting( "features.level" )          // 7, from the application
getRuntimeSetting( "features.beta" )           // true, from boxlang.json
getRuntimeSetting( "features.regions.1" )      // "us", array indexes are 1-based
getRuntimeSetting( "timeout", 30 )             // default when missing
getRuntimeSetting()                            // the whole merged struct
```

A missing key with no default throws, the same convention as `getSystemSetting()`. See [Runtime Settings](/getting-started/configuration/runtime-settings.md) and the [Application.bx](/boxlang-framework/applicationbx.md#runtime-settings) settings.

### 📈 Code Coverage and Execution Profiling (BL-2732)

BoxLang can now record **which code ran, how often, and where the time went** while your code executes, with no changes to that code.

* **Coverage.** Per file, whether each executable span ran (covered or missed) and how many times.
* **Timing.** Accumulated self time per span, so hot code is easy to find.
* **Fine grained.** Branches, short-circuit operators, ternaries, function and closure bodies and class code are tracked independently, so you can see which branch actually ran.
* **Aggregation.** Covered, executable and total counts, and a coverage percentage, across files.
* **Exports.** Built-in export to **JSON** (per line or per span) and **SonarQube generic coverage XML** for CI, plus **HTML** reports for line coverage, spans and a span **heatmap**.
* **Off by default.** Capture is a single flag, and nothing is instrumented when it is off.

{% code title="boxlang.json" %}

```json
{
    "codeProfilerEnabled": true
}
```

{% endcode %}

The collected data is exposed through the runtime's `CodeProfilerService`, which coverage reporters and CI exporters consume.

### 🧩 Static Method Interception: `onMissingStaticMethod()` (BL-2748)

Classes have always had `onMissingMethod()` for instance calls. Static calls to a method that does not exist used to throw a `KeyNotFoundException`. A class can now handle them, which enables dynamic static APIs such as `User::findByEmail( "a@b.com" )`.

```js
class {

    static function onMissingStaticMethod( string missingMethodName, struct missingMethodArguments ){
        return "called #missingMethodName#"
    }

}

MyClass::anything( 1, 2 )    // "called anything"
```

* It runs only when the static method is **missing**, so normal static calls cost nothing extra.
* It runs as a static function of the class, with `static` access like any other static call.
* It works when declared in the class **and** when a module adds the function to a class's static scope at runtime.
* A handler can cache by putting a function into the static scope under the missing name, so later calls are normal static calls.
* It also works for classes that **extend a Java class**. A call is only sent to the Java parent when the parent has a matching method, otherwise it falls through to the missing-method handlers.
* Without a handler, behavior and error messages are unchanged.

See [Static Constructs](/boxlang-language/classes/static-constructs.md).

### 📡 Raw Binary HTTP Streaming: `onBinaryChunk` (BL-2738)

`http().onChunk()` decodes the body as text and splits it on newlines, which corrupts binary streams such as audio. The new `onBinaryChunk` callback receives **raw bytes per network read**.

```js
http( url, "POST" )
    .header( "Authorization", "Bearer #key#" )
    .body( payload )
    .timeout( 30 )
    .onBinaryChunk( ( bytes, info ) => {
        sendToClient( bytes )
        return !clientGone    // an explicit false stops the stream and closes the connection
    } )
    .onError( ( e, result ) => handleError( e ) )
    .send()
```

* `info` carries `chunkNumber`, `totalBytes`, `headers` (first chunk only), `result` and `httpClient`.
* **Stop on `false`.** Only an explicit `false` stops the stream. The response is closed immediately and the result is flagged as not completed, not as an error.
* **Idle timeout for streaming.** In binary and SSE modes `timeout` becomes the longest wait for headers or between received bytes. A stalled stream is reported as a timeout error (408). Buffered mode is unchanged.
* **Errors.** In binary and SSE modes a non-2xx status skips the chunk callback, and the body is reported as `HTTP <status>: <body>` through `onError` and the result struct.
* **SSE.** Server-sent events get the same stop-on-false, idle timeout and non-2xx handling, and now apply `Content-Encoding` decoding.
* Also available as an attribute on `bx:http`. Fully backward compatible.

See [HTTP Calls](/boxlang-framework/http-calls.md) and [Server-Sent Events](/boxlang-framework/server-sent-events.md).

### 🔔 BIF Interception Points Fixed (BL-2741)

`postBIFInvocation` was declared but never announced, and `onBIFInvocation` fired twice per call. BIF invocation now mirrors user-defined functions:

| Point               | When                     | Data                                                                            |
| ------------------- | ------------------------ | ------------------------------------------------------------------------------- |
| `onBIFInvocation`   | Once, before the call    | `context`, `arguments`, `bif` and `name`                                        |
| `postBIFInvocation` | After a successful call  | The same data plus `result` and `elapsedNanos`. Listeners may override `result` |
| `onBIFException`    | New. When the BIF throws | `exception` and `elapsedNanos`. The exception is rethrown unchanged             |

With no listeners registered there is no allocation and no clock read on the hot path. See [Life-cycle Events](/boxlang-framework/interceptors/core-interception-points/life-cycle-events.md).

### 🔑 `generateKeyPair()` (BL-2753)

A new BIF next to [`generateSecretKey()`](/boxlang-language/reference/built-in-functions/encryption/generatesecretkey.md) for **asymmetric key pairs**, with no Java interop needed.

```js
pair = generateKeyPair( "Ed25519" )
pair.publicPem
pair.privatePem
```

* **Algorithms:** `Ed25519`, `Ed448`, `X25519`, `X448`, `RSA` (2048, 3072, 4096) and `EC` (`secp256r1`, `secp384r1`, `secp521r1`).
* **Returns a struct** with `algorithm`, `privateKey` (base64 PKCS8 DER), `publicKey` (base64 X.509 SPKI DER), `privatePem` and `publicPem`.
* **Randomness** comes from the JDK `SecureRandom`, supplemented with the runtime's global secret seed.

## ✨ New Features and Improvements

### Language and Runtime

* [**BL-2771**](https://ortussolutions.atlassian.net/browse/BL-2771) / [**BL-2772**](https://ortussolutions.atlassian.net/browse/BL-2772) / [**BL-2773**](https://ortussolutions.atlassian.net/browse/BL-2773) - **Extending Java classes.** A BoxLang class that uses `extends="java:..."` can now call super-class methods that need argument coercion (for example `add()` on a class extending `java.util.ArrayList`), override **protected** Java methods, and extend Java classes supplied by a module or a runtime JAR.
* [**BL-2749**](https://ortussolutions.atlassian.net/browse/BL-2749) - `Foo::counter = 42` now assigns a static variable from outside the class. It used to throw `KeyNotFoundException`.
* [**BL-2750**](https://ortussolutions.atlassian.net/browse/BL-2750) - Writing to the static scope with bracket notation inside a function, `static[ name ] = value`, is no longer parsed as an array destructuring declaration.
* [**BL-1792**](https://ortussolutions.atlassian.net/browse/BL-1792) - The thread scope is no longer part of unscoped variable lookup. See the [Migration Notes](#-migration-notes).
* [**BL-1330**](https://ortussolutions.atlassian.net/browse/BL-1330) - `print()` and `println()` accept any number of arguments. `print( "Age:", 21 )` outputs `Age: 21` (values joined by a space, no trailing newline), and `println( "A", "B" )` outputs one argument per line followed by a final newline. Single-argument calls behave as before.
* [**BL-1694**](https://ortussolutions.atlassian.net/browse/BL-1694) - `duplicate()` handles Java `List`, `Map` and `Set` instances (and BoxLang sets) directly instead of serializing them. `deep=false` is now honored for these types, shallow copies no longer fail on non-serializable contents, sorted BoxLang sets can be duplicated, and duplication is faster.
* [**BL-1666**](https://ortussolutions.atlassian.net/browse/BL-1666) - Java class dumps show public **instance** and **static** methods in separate sections, sorted by name, and hide non-public methods.
* [**BL-2766**](https://ortussolutions.atlassian.net/browse/BL-2766) - Class loading no longer throws a `NullPointerException` when the thread context class loader is `null`, a valid state that the PostgreSQL JDBC driver uses while it initializes.

```js
// BL-1330: multiple arguments
print( "Age:", 21 )      // Age: 21
println( "A", "B" )      // A and B on their own lines
```

### JDBC, Queries and Transactions

* **Release savepoints.** The new `transactionReleaseSavepoint( name )` BIF and the `releasesavepoint` action of `bx:transaction` discard a savepoint you no longer need. Release is optional cleanup: it does not commit or roll back data. It frees driver resources in long transactions and lets you reuse savepoint names. A new `onTransactionReleaseSavepoint` interception point is announced. Drivers that do not support release raise a `DatabaseException`.
* **Query error and cache events.** A new `onQueryExecuteError` interception point is announced when a query fails, with `pendingQuery`, `context`, `exception` and the elapsed `executionTime` in milliseconds. The original exception is always rethrown unchanged, even if a listener throws. Results served from the query cache now announce `preQueryExecute` and `postQueryExecute` with `cached=true` and an `executionTime` of `0`, and `preQueryExecute` now includes `dbtype` and `cached`.
* **Transactions roll back on `abort`.** A database transaction is now rolled back when `abort` runs inside it, matching Adobe ColdFusion and Lucee.
* [**BL-2763**](https://ortussolutions.atlassian.net/browse/BL-2763) - JDBC connections were not always returned to the pool. Connections acquired inside a transaction for another datasource or with credential overrides, stored procedure calls that fail during setup, and connections still open when a request ends are now released. A failure while closing one transaction or in one shutdown listener no longer stops the remaining cleanup.
* [**BL-2770**](https://ortussolutions.atlassian.net/browse/BL-2770) - On-the-fly datasources created by overriding the username and password of a named datasource are now named `{datasource}_user_{username}_{hash}`, so they are easy to identify when you list registered datasources.
* [**BL-2715**](https://ortussolutions.atlassian.net/browse/BL-2715) - With `debug=true`, stored procedure logs show which variables and types were created from which `OUT` parameter names.
* [**BL-2743**](https://ortussolutions.atlassian.net/browse/BL-2743) - Nested database exceptions: a cause that was already set no longer makes the exception chain throw. It is stored as a suppressed exception, which still shows in the stack trace.

```js
transaction {
    for ( var item in batch ) {
        var recoveryPoint = "item_" & createUUID().replace( "-", "", "all" )
        transactionSetSavepoint( recoveryPoint )
        try {
            importItem( item )
        } catch ( any error ) {
            transactionRollback( recoveryPoint )
            recordImportFailure( item, error )
        }
        transactionReleaseSavepoint( recoveryPoint )
    }
}
```

### Caching

* **Native savepoint release (**[**PR #681**](https://github.com/ortus-boxlang/BoxLang/pull/681)**).** [`transactionReleaseSavepoint()`](/boxlang-language/reference/built-in-functions/jdbc/transactionreleasesavepoint.md) and `transaction action="releasesavepoint"` provide optional cleanup without committing or rolling back. Released names can be reused; pending savepoints preserve lazy connection acquisition. The new [`onTransactionReleaseSavepoint`](/boxlang-framework/interceptors/core-interception-points/transaction-events.md#ontransactionreleasesavepoint) event joins the transaction lifecycle events, which now create payloads lazily and pass the transaction's originating context explicitly to both interceptor pools. Explicit release requires JDBC driver support once a connection exists.
* **Stored procedure debugging (BL-2715).** With `debug=true` the log now shows which variables and types were created from which `OUT` parameter names.
* **Transactions roll back on `abort`.** A database transaction is now properly rolled back when `abort` is hit inside it.
* [**BL-2714**](https://ortussolutions.atlassian.net/browse/BL-2714) - `systemCacheClear( "classfiles" )` clears the compiled class files cached on disk. See [SystemCacheClear](/boxlang-language/reference/built-in-functions/system/systemcacheclear.md).
* [**BL-2764**](https://ortussolutions.atlassian.net/browse/BL-2764) - In debug mode, the source code snippets shown in exception tag contexts are now cached in a new `bxCodeSnippets` cache, so repeated errors no longer re-read source files. Clear it with `systemCacheClear( "codesnippets" )`. Entries for a file are discarded when the file changes.

### Performance

* [**BL-2747**](https://ortussolutions.atlassian.net/browse/BL-2747) - The class resolver no longer lists every directory on the path for each lookup miss. On case-sensitive file systems the cost grew with the number of class files. Class resolution is no longer quadratic.
* [**BL-2756**](https://ortussolutions.atlassian.net/browse/BL-2756) - `replace()` and `replaceNoCase()` were refactored to avoid allocating substrings.
* [**BL-2765**](https://ortussolutions.atlassian.net/browse/BL-2765) - Case-insensitive searches compare in place instead of lower-casing whole strings, which speeds up `findNoCase()`, `replaceNoCase()`, the `CONTAINS` operator, `stringStartsWithNoCase()` and `stringEndsWithNoCase()`.
* [**BL-2758**](https://ortussolutions.atlassian.net/browse/BL-2758) - Comparisons pass the caller's context down to the date caster, so a date compare no longer rebuilds the whole runtime config struct. A date string compared inside a request is also read in the **request** timezone. Java integrators: `Compare` and the comparison operators gain context-taking overloads, and the old ones are deprecated.
* [**BL-2759**](https://ortussolutions.atlassian.net/browse/BL-2759) - Interceptors announced without a context (BIF, query and transaction events) now run on the **current request** when there is one. They see its settings and no longer rebuild the runtime config on every read.

### Casting

* [**BL-2730**](https://ortussolutions.atlassian.net/browse/BL-2730) - BigDecimal and BigInteger casters accept a string with leading whitespace before the number, such as `" 1"`.

### Tooling and CFML Transpiler

* [**BL-2735**](https://ortussolutions.atlassian.net/browse/BL-2735) / [**BL-2736**](https://ortussolutions.atlassian.net/browse/BL-2736) - `cftranspile`: docblock `@return` no longer becomes an invalid annotation, script components written without a `bx:` prefix (`savecontent`, `application`) now compile, and tag-form `<cffunction>` in `.cfm` templates is emitted as `bx:function` instead of being silently dropped. Template conditions print `GT` and `GTE` as keywords, and `NOT CONTAINS` as `DOES NOT CONTAIN`.
* [**BL-963**](https://ortussolutions.atlassian.net/browse/BL-963) - The transpiler maps the Lucee argument aliases of `invoke()` to BoxLang's `object`, `method` and `arguments`: `cfcInstance`, `obj`, `value` and `variable`; `name`, `methodName`, `functionName` and `function`; and `params`, `args` and `argumentCollection`.

## 🐛 Notable Bug Fixes

### Language and Compiler

* [**BL-2745**](https://ortussolutions.atlassian.net/browse/BL-2745) - A script with an `import` statement and a `try/catch` failed to load with `java.lang.VerifyError: Inconsistent stackmap frames`.
* [**BL-2754**](https://ortussolutions.atlassian.net/browse/BL-2754) - Parser error when using `not listFindNoCase()` inside a struct literal.
* [**BL-2760**](https://ortussolutions.atlassian.net/browse/BL-2760) - The `finally` block was skipped when `abort` ran inside a `try` that also had a `catch`.
* [**BL-2769**](https://ortussolutions.atlassian.net/browse/BL-2769) - `return +expr;` failed to parse.
* Abstract functions in tag-based classes now get a semantic error when they declare a body.

### CFML Compatibility

* [**BL-2721**](https://ortussolutions.atlassian.net/browse/BL-2721) - A `cf_` custom tag call swallowed its `template` and `name` attributes.
* [**BL-2731**](https://ortussolutions.atlassian.net/browse/BL-2731) - `<cf_foo>` style custom tags lost the `name` attribute.

### Runtimes and Platform

* [**BL-2757**](https://ortussolutions.atlassian.net/browse/BL-2757) - Environment variables were not imported on Windows when using `boxlang.bat`. The Windows environment loader script was reworked.
* [**BL-2744**](https://ortussolutions.atlassian.net/browse/BL-2744) - MiniServer: `getRequestBody()` returned an empty string when the request body arrived after the headers, as `bx:http` and the JDK HTTP client send it.

### Modules

* **bx-orm** - [BL-2739](https://ortussolutions.atlassian.net/browse/BL-2739): `generator="identity"` failed on PostgreSQL when the table name is a reserved word, such as `comment`.
* **bx-orm** - [BL-2751](https://ortussolutions.atlassian.net/browse/BL-2751): `fieldtype="collection"` (a bag or map of simple values) was silently dropped from the mapping.
* **bx-image** - [BL-2767](https://ortussolutions.atlassian.net/browse/BL-2767): `isImageFile()` and `imageNew()` reject oversized images from the image header before decoding them, instead of decoding the whole image into memory.

## 🔒 Security

* [**BL-2728**](https://ortussolutions.atlassian.net/browse/BL-2728) - Jackson updated to 2.21.7, which resolves [CVE-2026-89425](https://github.com/advisories/GHSA-7hhh-6rmp-j9qf).
* [**BL-2775**](https://ortussolutions.atlassian.net/browse/BL-2775) - Mitigates CVE-2026-102554. The core now depends on `javaparser-core` only, so Guava, which BoxLang never used, is no longer bundled.
* **Web support** - jsoup updated to 1.23.2 (CVE-2026-75140).

## ⚡ Migration Notes

* **Thread scope and unscoped lookup (BL-1792).** Inside a `thread` body, an unscoped name no longer falls back to the thread's metadata struct. Adobe ColdFusion and Lucee do not do this either. In practice:

  * `foo` no longer resolves after `thread.foo = "bar"`. Use `thread.foo`.
  * Unscoped reads no longer pick up metadata keys such as `status` or `output`.
  * An unscoped assignment such as `status = "x"` now goes into the local scope instead of the thread metadata.

  Scoped access (`thread.foo`, `myThread.foo`, `bxthread.myThread.foo`) and request-level access by thread name are unchanged.
* **Date strings in comparisons (BL-2758).** A date string compared inside a request is now read in the request timezone rather than the runtime default timezone.
* **Java integrators (BL-2758).** The `Compare` and comparison operator methods without a context are deprecated in favor of the context-taking overloads.
* **`onBIFInvocation` (BL-2741).** It now fires once per call, not twice. If you worked around the duplicate, remove the workaround.
* **`duplicate()` of Java collections (BL-1694).** `duplicate( javaList, false )` and other shallow duplicates of Java `List`, `Map` and `Set` instances are now really shallow. Before, they were always deep copies.
* **`abort` inside a transaction.** The open transaction is now rolled back, so writes made before the `abort` are no longer committed.
* **Credential-override datasource names (BL-2770).** If you look up on-the-fly datasources by name, they are now named `{datasource}_user_{username}_{hash}` instead of `onthefly_{hash}`.
* **Existing `boxlang.json` files (BL-2764).** The `bxCodeSnippets` cache ships in the default configuration. A runtime home config that predates it creates it on first use, so no change is needed.

## 📊 Release Snapshot

* **Release Date:** November 2, 2026
* **Status:** Released
* **Total Issues:** 45
* **Distribution:** 6 New Features, 18 Improvements, 20 Bugs, 1 Task
* **Primary Focus:** Runtime settings, code coverage and profiling, static method interception, binary HTTP streaming, BIF interception events, Java class extension, transaction savepoint release, query observability, JDBC pool and performance fixes, and CFML compatibility

***

## 🎶 Release Notes

### New Features

* [BL-2714](https://ortussolutions.atlassian.net/browse/BL-2714) - Add class files option to SystemCacheClear()
* [BL-2732](https://ortussolutions.atlassian.net/browse/BL-2732) - Code coverage & execution profiling for BoxLang
* [BL-2738](https://ortussolutions.atlassian.net/browse/BL-2738) - http() / bx:http: raw binary response streaming via onBinaryChunk, with stop-on-false and idle timeout for streaming modes
* [BL-2748](https://ortussolutions.atlassian.net/browse/BL-2748) - Classes: onMissingStaticMethod() for calls to static methods that do not exist
* [BL-2753](https://ortussolutions.atlassian.net/browse/BL-2753) - New generateKeyPair() BIF for asymmetric key pairs (Ed25519, Ed448, X25519, X448, RSA, EC)
* [BL-2762](https://ortussolutions.atlassian.net/browse/BL-2762) - Add global user-defined runtimeSettings struct to boxlang.json with Application.bx overrides and getRuntimeSetting() BIF

### Improvements

* [BL-963](https://ortussolutions.atlassian.net/browse/BL-963) - transpile additional named args for invoke() BIF
* [BL-1330](https://ortussolutions.atlassian.net/browse/BL-1330) - Modify println/echo to support N args
* [BL-1666](https://ortussolutions.atlassian.net/browse/BL-1666) - tidy up java class dumps
* [BL-1694](https://ortussolutions.atlassian.net/browse/BL-1694) - Improve duplication of Lists, Maps, and Sets
* [BL-1792](https://ortussolutions.atlassian.net/browse/BL-1792) - See about removing thread scope from unscoped lookup
* [BL-2715](https://ortussolutions.atlassian.net/browse/BL-2715) - Add out param info to stored proc debug logs
* [BL-2730](https://ortussolutions.atlassian.net/browse/BL-2730) - BigDecimal and BigInteger casters fail on a string with leading whitespace before the number
* [BL-2743](https://ortussolutions.atlassian.net/browse/BL-2743) - Improve nested DB exceptions
* [BL-2747](https://ortussolutions.atlassian.net/browse/BL-2747) - BoxResolver: avoid listing directories on every class lookup miss (quadratic class resolution on case-sensitive file systems)
* [BL-2751](https://ortussolutions.atlassian.net/browse/BL-2751) - bx-orm: fieldtype="collection" (simple-value collection) is silently dropped from the mapping
* [BL-2756](https://ortussolutions.atlassian.net/browse/BL-2756) - improve performance of replace() and replaceNoCase()
* [BL-2764](https://ortussolutions.atlassian.net/browse/BL-2764) - Improve performance of generating call stack in debug mode
* [BL-2765](https://ortussolutions.atlassian.net/browse/BL-2765) - Improve performance of case insensitive contains/index of checks
* [BL-2767](https://ortussolutions.atlassian.net/browse/BL-2767) - bx-image: isImageFile() / imageNew() decode the whole image with no dimension check - a 309 KB PNG costs 289 MB of heap, a 6 MB JPEG takes a 1 GB JVM down
* [BL-2770](https://ortussolutions.atlassian.net/browse/BL-2770) - Improve naming of user/pass on the fly datasource overrides
* [BL-2771](https://ortussolutions.atlassian.net/browse/BL-2771) - BoxLang class extending a Java class fails on any super-class method that needs argument coercion (Method 'add' not found)
* [BL-2772](https://ortussolutions.atlassian.net/browse/BL-2772) - Cannot override protected Java methods from a BoxLang class that extends a Java class
* [BL-2773](https://ortussolutions.atlassian.net/browse/BL-2773) - BoxLang class cannot extend a Java class supplied by a module or runtime JAR

### Bugs

* [BL-2721](https://ortussolutions.atlassian.net/browse/BL-2721) - Custom tag call swallows template and name attributes (treated like cfmodule attributes)
* [BL-2728](https://ortussolutions.atlassian.net/browse/BL-2728) - Bump Jackson Dependencies to 2.21.7
* [BL-2731](https://ortussolutions.atlassian.net/browse/BL-2731) - \<cf\_foo> style custom tag loses name attribute
* [BL-2735](https://ortussolutions.atlassian.net/browse/BL-2735) - cftranspile: docblock @return becomes an invalid annotation, and script components without a bx: prefix (savecontent, application) do not compile
* [BL-2736](https://ortussolutions.atlassian.net/browse/BL-2736) - cftranspile silently drops tag-form \<cffunction> from .cfm templates (output .bxm has no function, transpile reports success)
* [BL-2739](https://ortussolutions.atlassian.net/browse/BL-2739) - bx-orm: generator="identity" fails on PostgreSQL when the table name is on the reserved-word list (`comment`)
* [BL-2741](https://ortussolutions.atlassian.net/browse/BL-2741) - postBIFInvocation interception point is never announced (onBIFInvocation fires twice)
* [BL-2744](https://ortussolutions.atlassian.net/browse/BL-2744) - MiniServer: getRequestBody() returns an empty string when the request body arrives after the headers
* [BL-2745](https://ortussolutions.atlassian.net/browse/BL-2745) - Script with an import statement and a try/catch fails to compile: java.lang.VerifyError Inconsistent stackmap frames
* [BL-2749](https://ortussolutions.atlassian.net/browse/BL-2749) - Assigning a static variable from outside the class (Foo::counter = 42) throws KeyNotFoundException
* [BL-2750](https://ortussolutions.atlassian.net/browse/BL-2750) - static\[ name ] = value inside a function is parsed as a static array destructuring declaration
* [BL-2754](https://ortussolutions.atlassian.net/browse/BL-2754) - Parser error when using `not listFindNoCase()` inside a struct literal
* [BL-2757](https://ortussolutions.atlassian.net/browse/BL-2757) - Environmental Variables are not being imported into BoxLang on Windows when using boxlang.bat
* [BL-2758](https://ortussolutions.atlassian.net/browse/BL-2758) - Date compares rebuild the whole runtime config struct on every call (Configuration.asStruct in the DateTimeCaster hot path)
* [BL-2759](https://ortussolutions.atlassian.net/browse/BL-2759) - Interceptors announced without a context run on the runtime context even inside a request (config rebuilt per call, request settings ignored)
* [BL-2760](https://ortussolutions.atlassian.net/browse/BL-2760) - finally block is skipped when abort runs inside a try that has a catch clause
* [BL-2763](https://ortussolutions.atlassian.net/browse/BL-2763) - Fix JDBC connections not returned to the pool (transaction, stored proc, and web request cleanup)
* [BL-2766](https://ortussolutions.atlassian.net/browse/BL-2766) - DynamicClassLoader.findClass() throws a NullPointerException
* [BL-2769](https://ortussolutions.atlassian.net/browse/BL-2769) - cannot `return +expr;`
* [BL-2775](https://ortussolutions.atlassian.net/browse/BL-2775) - Mitigate CVE-2026-102554

### Tasks

* [BL-2761](https://ortussolutions.atlassian.net/browse/BL-2761) - CI: install CommandBox on Windows from downloads.ortussolutions.com instead of Chocolatey


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://boxlang.ortusbooks.com/readme/release-history/1.19.0.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.