Versioning Schema

BoxLang is maintained under the Semantic Versioning guidelines as much as possible. Releases will be numbered in the following format:

And constructed with the following guidelines:

• Breaking backward compatibility bumps the major (and resets the minor and patch)

• New additions without breaking backward compatibility bump the minor (and resets the patch)

• Bug fixes and misc changes bump the patch

BoxLang Release & Support Lifecycle

Our release cadence follows a predictable yearly major-version schedule, with each release enjoying two years of Long-Term Support (LTS):

• Active Support: First 12 months after release – full feature updates, bug fixes & security patches.

• LTS (Updates & Security): 2nd year – maintenance releases (minor improvements & security).

• LTS (Security-Only): 3rd year – critical security fixes only, then archived.

This gives you a clear planning horizon and overlap between versions, so you can upgrade on your own schedule without ever being left unprotected.

Support Lifecycle Chart

Here is our 5-year outlook.

• After the “security-only” phase, the version is archived: no further updates, but archives remain available for reference.

• Overlaps ensure there’s always at least one actively maintained release.

• All dates refer to calendar years; exact dates will align with our annual major-version launch each Q1.

Hola amigo! I'm excited that you are interested in contributing to BoxLang. Before submitting your contribution, please make sure to take a moment and read through the following guidelines:

Code Of Conduct

This project is open source, and as such, the maintainers give their free time to build and maintain the source code held within. They make the code freely available in the hope that it will be useful to other developers and/or businesses. Your contributions are crucial in maintaining the integrity of BoxLang. Be considerate towards maintainers when raising issues or presenting pull requests. We all follow the Golden Rule: Do to others as you want them to do to you.

• As contributors and maintainers of this project, we pledge to respect all people who contribute through reporting issues, posting feature requests, updating documentation, submitting pull requests or patches, and other activities.

• Participants will be tolerant of opposing views.

• Examples of unacceptable behavior by participants include the use of sexual language or imagery, derogatory comments or personal attacks, trolling, public or private harassment, insults, or other unprofessional conduct.

• Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions not aligned with this Code of Conduct. Project maintainers who do not follow the Code of Conduct may be removed from the project team.

• When interpreting the words and actions of others, participants should always assume good intentions. Emotions cannot be derived from textual representations.

• Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by opening an issue or contacting one or more project maintainers.

Bug Reporting

Please link it to the appropriate issue if you submit a pull request.

If you file a bug report, your issue should contain a title, a clear description of the issue, a way to replicate the issue, and any support files we might need to replicate your issue. The goal of a bug report is to make it easy for yourself - and others - to replicate the bug and develop a fix for it. Not all issues that do not contain a way to replicate will be addressed.

Support Questions

If you have questions about usage, professional support, or ideas to bounce off the maintainers, please do not create an issue. Leverage our support channels first.

• Ortus Community Discourse:

• Box Slack Team:

• Professional Support:

Pull Request Guidelines

• The main branch is just a snapshot of the latest stable release. All development should be done in dedicated branches. Do not submit PRs against the main branch. They will be closed.

• All pull requests should be sent against the development branch or the LTS version branch releases/v{version}

• It's OK to have multiple small commits as you work on the PR - GitHub will automatically squash it before merging.

Security Vulnerabilities

If you discover a security vulnerability, please email the development team at . All security vulnerabilities will be promptly addressed.

JRE Compatibility

Please make sure your code runs on JRE 21+

Financial Contributions

You can support BoxLang and all of our Open Source initiatives at Ortus Solutions by becoming a Patreon. You can also get lots of goodies and services depending on the level of contributions.

BoxLang is a modern dynamic JVM language that can be deployed on multiple runtimes: operating system (Windows/Mac/*nix/Embedded), web server, lambda, iOS, android, web assembly, and more. BoxLang combines many features from different programming languages, including Java, CFML, Python, Ruby, Go, and PHP, to provide developers with a modern, functional and expressive syntax.

BoxLang has been designed to be a highly adaptable and dynamic language to take advantage of all the modern features of the JVM and was designed with several goals in mind:

1. Be a rapid application development (RAD) scripting language and middleware.

2. Unstagnate the dynamic language ecosystem in Java.

3. Be dynamic, modular, lightweight, and fast.

4. Be 100% interoperable with Java.

5. Be modern, functional, and fluent (Think mixing CFML, Node, Kotlin, Java, and Clojure)

6. Extend via Modules

7. Be able to support multiple runtime environments:

   1. Native OS Binaries (CLI Tooling, compilers, etc.)

   2. Serverless Computing (AWS Lambda, Azure Functions, etc)

   3. Servlet Containers - CommandBox/Tomcat/Jetty/JBoss/Undertow
8. Compile down to Java ByteCode

9. Framework Capabilities (Scheduling, applications, events, async computing, tasks, queues, modules)

11. Drop-in Replacement for Adobe ColdFusion and Lucee CFML

Launch Video

License

BoxLang is open source and licensed under the License. Copyright and Registered Trademark by Ortus Solutions, Corp.

BoxLang Subscriptions

BoxLang can also be enhanced by to give you:

• Business Support with SLAs

• Enhanced builds

• Custom patches and builds

• Dedicated Engineer

Support Open Source

To support us, please consider becoming our patron at for as little as $10/month.

Discussions & Help

The Ortus Community is how to get help:

You can also join our Slack Box Team at:

Reporting a Bug

We all make mistakes from time to time :) So why not let us know about it and help us out? We also love 😍 pull requests, so please star us and fork us at

Jira Issue Tracking

• BoxLang:

• BoxLang IDE:

• BoxLang Modules:

Resources

• Professional Support:

• GitHub Org:

• Twitter:

• FaceBook:

Ortus Solutions, Corp

This book was written and maintained by and the Development Team.

Ortus Solutions is a company that focuses on building professional open source tools, custom applications and great websites! We're the team behind ColdBox, the de-facto enterprise BoxLang HMVC Platform, TestBox, the BoxLang Testing and Behavior Driven Development (BDD) Framework, ContentBox, a highly modular and scalable Content Management System, CommandBox, the BoxLang <BoxLang> CLI, package manager, etc, and many more -

In this release, we've introduced the exciting addition of websockets support to BoxLang through the powerful SocketBox module. This enhancement is not limited to our CommandBox Runtime but also extends to our MiniServer runtime, creating a more dynamic and efficient framework for real-time communication. For an in-depth introduction to these features, please visit our community post here.

Additionally, we've implemented several new features and improvements. We've also improved the system startup process by adding version and build date information to the MiniServer startup output (BL-607). Lastly, we've addressed session management by ensuring that application settings are readily accessible during the onSessionEnd event (BL-610). This release encapsulates our ongoing commitment to providing robust, cutting-edge solutions for developers and reaching stable release in the coming weeks.

New Features

MiniServer WebSocket handler

Improvement

Add version/build date to output of Miniserver startup

onSessionEnd needs application settings made available

Remove debugmode capture on miniserver, delegate to the core runtime.

Bugs

Timeouts (connection, idle) for datasources needs to be in seconds and not in milliseconds to adhere to cfconfig

BoxLang resolvers do not allow class paths to have `-` in them.

Beta 4 is a small incremental release which includes improvements and bug fixes.

Improvements

BL-299, BL-300, BL-301, BL-302 Query caching improvements and compatibility updates

BL-315 Ensure request attributes are available to the web runtime scope

BL-164 bx-compat-cfml CFML compatibility module updates to ensure null query column values are returned as empty strings

Bug Fixes

Fixes compilation issue with variables name cfcatch

CFML compatiblity for CGI.QUERY_STRING when not provided

Fix null queryparam functionality

The source code for this book is hosted on GitHub: . You can freely contribute to it and submit pull requests. Ortus Solutions, Corp copyrights the contents of this book and cannot be altered or reproduced without the author's consent. All content is provided "As-Is" and can be freely distributed.‌

Notice of Liability

‌The information in this book is distributed as is, without warranty. The author and Ortus Solutions, Corp shall not have any liability to any person or entity concerning loss or damage caused or alleged to be caused directly or indirectly by the content of this training book, software, and resources described in it.

Bugs

BoxRunner fails on some input args

This release introduces several new features and configurations to enhance functionality and security. It also continues to squash tons of bugs to bring about CFML compatibility. Key updates include:

• Enhanced arrayFind and arrayFindNoCase functions, allowing value closures to accept item indices.

• New validBoxLangTemplates configuration for filtering templates processable by the Runnable Loader.

• New validClassExtensions configuration to specify permissible class extensions.

• A new security configuration section designed to disallow BIFs, Components, and Imports, enhancing security.

New Feature

arrayFind, arrayFindNoCase value closures, accept the value and now the index of the item as the second param

New configuration: validBoxLangTemplates to determine which templates the Runnable Loader can process

New configuration: validClassExtensions to determine which class extensions to work with

New security configuration section for disallowing: BIFS, Components, Imports

Internal refactor to make the class locator and resolvers have a life-cycle based on the runtime and not alone

Improvement

Remove debugmode capture on miniserver, delegate to the core runtime.

Consolidate CastAttempt and Attempt into a hierarchy

New DynamicFunction type that can be used to generate dynamic BoxLang functions using Java Lambda proxies. Great for code generation

Bug

Import nested classes

Java static funcitons not behaving as expected

array.find does not use cf rules to convert result of predicate to boolean

QueryColumnType doesn't handle "idstamp" (mssql)

static scope in application.cfc not initialized before psuedoConstructor runs

Auto-escaping of {} in regex needs to ignore already-escaped braces

Instead of removing special chars from Java FQN, replace with __ to avoid conflicts

Tag expressions not parsing inside template island inside braces

duplicate() doesn't work on empty structs

randrange() not inclusive of upper bound

array.find - can't cast closure to string

This release brings another round of powerful tools and refinements to the BoxLang community, making development more dynamic and robust than ever. We’ve added new capabilities for debugging and tracing, expanded context-sensitive controls for thread management, and introduced new methods for fluent attachment handling.

For deeper flexibility, our improvements enhance configurability, streamline session control, and add deeper levels of JSON serialization management. Plus, we’ve squashed a wide range of bugs, enhancing stability across database connections, date handling, and runtime compatibility with CFML.

In addition, CSRF Token functionality is now provided via the bx-csrf module.

New Feature

BL-713 Global events for Application events

Implement table filter for dbinfo component

getComponentList() should also return the declared attributes of a component

getFunctionList() should also return the declared arguments of a BIF

Improvement

Implement Algorithm Argument for RandRange

Set request class loader into thread as context class loader

Retain directories in dynamic class loader

Add nullIsUndefined flag to control how null variables are handled

Don't default properties with no default value to null when compat has enabled nullIsUndefined scope behavior

Bug

Passing a null named argument hides outer bindings by the same name

Missing BIF - CSRFGenerateToken is now supplied with the bx-csrf module

Difference in args vs local variables handling

Incompat: metadata annotations from inherited sub classses added to top level class

cfloop collection with an array throws casting exception

argument collection optional param is null

dot access not chaining to static access

NPE when calling non-existent Java method

Duplicate of cfc instance presenting as struct

Key access in StructMapWrapper not working

GetTagData(), GetFunctionData() function not implemented, implement in the COMPAT module

import name restrictions too strict

Assignment not working on static fields of an imported class

Adding two ints uneccessarily returns a long

New Features

• BL-1365 Add parse() helper methods directly to runtime, which returns parse result

• BL-1388 new security configuration item: populateServerSystemScope that can allow or not the population of the server.system scope or not

Improvements

• Create links to BoxLang modules

• match getHTTPTimeString() and default time to now

• Work harder to return partial AST on invalid parse

• Error executing dump template [/dump/html/BoxClass.bxm]

Bugs

• BoxLang date time not accepted by JDBC as a date object

• contracting path doesn't work if casing of mapping doesn't match casing of abs path

• sessionInvalidate() "Cannot invoke String.length() because "s" is null"

• Some methods not found in java interop

New Features

• BL-438 - Zip Components, Utility and incorporating BIFS

• BL-487 - Implement pagePoolClear()

• - Add the ability to configure the CF transpiler

• - Transpiler doesn't handle attributeCollection

• - Zip Components, Utility and incorporating BIFS

Improvements

• - Compiler thread safety

• - Implements SystemCacheClear()

• - Allow "object" passed to throw to be a struct representation of an exception

• - Added all missing boxlang types to BoxLangType class

Bugs

• - Lock expects timeout to be minimum of 1

• - numeric literals with leading zeros are confused with octal values in java source

• - getApplicationMetadata() fails before application listener is defined

• - AST string values incorrectly unescaped outside of cfoutput

Luis Fernando Majano Lainez

Luis Majano is a Computer Engineer who has been developing and designing software systems since 2000. During economic instability and civil war, he was born in San Salvador, El Salvador, in the late 70s. He lived in El Salvador until 1995 and then moved to Miami, Florida, where he completed his Bachelor of Science in Computer Engineering at .

He is the CEO of , a consulting firm specializing in web development, BoxLang, Java development, and open-source professional services. He is the creator of ColdBox, ContentBox, CommandBox, WireBox, TestBox, LogBox, and anything "Box," and he contributes to over 250 open-source projects. He has a passion for learning and mentoring developers so they can succeed with sustainable software practices and the usage and development of open-source software. You can read his blog at

BoxLang Beta 25 Has Landed!

This release takes BoxLang to the next level, delivering a mix of critical bug fixes, thoughtful improvements, and exciting new features designed to enhance your development experience. With Beta25, we’ve solidified and made the ASM ByteCode BoxPiler the default compiler, refined module, and logging management, and added long-requested query of queries and JSON-based logging encoders. Additionally, we’ve tackled critical issues around debugging, compatibility, and system settings to make this the most stable and feature-complete beta yet.

At this point, we have a handful of small bugs open, which will completely certify all of the major Ortus frameworks like ColdBox, ContentBox, and over 50 modules. Complete certification is around the corner.

As a bonus, we are almost ready to release our Hibernate ORM module (bx-orm) and move into a Release Candidate phase for our entire lineup. So please test test test, and give us your feedback.

✨ New Features

• : createObject() now supports classloading arguments as the third argument.

Easily manage and control classloading with arguments to enhance flexibility and modularity.

• : Dynamic Task Management in Schedulers

Added startupTask(task) to dynamically initialize tasks by name or task object.

• : JSON-based Logging Support

Appenders and root configurations now include JSON encoders for enhanced logging formats.

• : Improved Scheduler Logging

Scheduler logs are now effectively reported to provide better insights.

• : Enhanced Module Logging

Modules now have dedicated logs to improve debugging and diagnostics.

• : New Event Lifecycle: onConfigurationLoad

Introduced a new lifecycle event for IServices to optimize configuration handling.

• : Enhanced Compatibility Assignments

Assignments now accurately interpret null variables for better compatibility.

• : New Logging Setting: statusPrinterOnLoad

Added statusPrinterOnLoad for much-needed debugging of logging configurations.

🛠 Improvements

• : Streamlined Method Expectations

Improved handling of methods that don’t expect return values for better consistency.

• : Enhanced Session Cookie Controls

Added missing controls for session cookie management to improve security and compliance.

• : Bytecode Line Number Enhancements

Added line number details to bytecode generated with ASM for improved debugging.

• : ASM is Now the Default BoxPiler

Streamlined the toolchain by making ASM the only default stock BoxPiler.

• : Optimized Replace Operations

Updated replaceAll() methods to use pre-compiled patterns for better performance.

• : Unified Logging Configuration

Consolidated logging startups and configurations for both servlet and non-servlet environments.

• : Support for this.componentPaths

Introduced implicit mapping support for more intuitive path management.

• : Module Enable/Disable Support

Modules can now be enabled or disabled using enabled in boxlang.json, removing double negatives like disabled.

• : Forms Module Introduced

A new module for handling forms was added, enhancing the BoxLang ecosystem.

• : Improved Scope Assignment

Allowed reassignment of a scope to a struct for more flexible programming.

• : Collision Prevention in IClassRunnable Methods

Prefixed methods to prevent naming collisions for safer execution.

• : Graceful Module Unloading

Added defensive coding for module unloading failures to ensure runtime stability.

• : Consistent Struct Collector Outputs

Resolved inconsistencies by ensuring collectors return Struct objects.

• : Improved Parent Class Delegation

Enhanced module class loaders to delegate certain parent classes to the parent loader exclusively.

🐞 Bug Fixes

• ASM and Debugging Fixes:

, , , ,

• Localization and Formatting Issues:

, ,

• Parsing Errors:

, ,

• Thread and Scope Resolution Bugs:

, ,

• Miscellaneous:

, , ,

🚀 Introducing BoxLang 1.0.0 Beta 20! 🚀

This release brings another round of powerful tools and refinements to the BoxLang community, making development more dynamic and robust than ever. We’ve added new capabilities for debugging and tracing, expanded context-sensitive controls for thread management, and introduced new methods for fluent attachment handling.

For deeper flexibility, our improvements enhance configurability, streamline session control, and add deeper levels of JSON serialization management. Plus, we’ve squashed a wide range of bugs, enhancing stability across database connections, date handling, and runtime compatibility with CFML.

New Feature

trace bif and component

Setup the thread's context class loader when an application is defined with the correct loader from the Applications java settings

showDebugOuput added to request box context to allow for tracer/debugging outputs

new computeAttachmentIfAbsent, to make fluent attachments on IBoxAttachable implementations

refactor escapeHTML to the lib we use instead of multiple functions

DateTime objects don't have a len member method

Improvements

Add line break in dump console output

Allow access to super scope from thread

reuse config of validTemplateExtensions

Add ability to deep merge config items from the environment.

track current request context in thread

improve concurrency of session ID creation

Move from immutable verbiage to unmodifiable

Need to set explicit `/` path on session cookies

if calling serializeJSON() on a class, and the class is marked as not serializable, then return empty struct

if calling serializeJSON() on a class, properties marked as not serialiable should be skipped.

Arrays/Lists/Structs/Maps/Classes that have been visited already by JSON will not serialize again but show a recursion marker

Bugs

bx-compat-cfml datediff fails to convert string

Update parser to allow for `@module` notations on imports and `new` operators

NOT operator precedence not grabbing operators in the chain

Java Doc implementation is stricter that ACF and Lucee

Missed module class hierarchy to have the runtime class loader as the parent

ortus.boxlang.runtime.events.InterceptorPool: Errors announcing [logMessage] interception ortus.boxlang.runtime.types.exceptions.BoxRuntimeException: An error occurred while attempting to log the message

Dump not showing BoxLang type NullValue as null

DBInfo schema and several other columns can be null, make sure you address it

boxclass dump looping construct exception

java class method not found

argument collection optional param is null

Cannot convert class ortus.boxlang.runtime.types.DateTime to SQL type requested due to com.mysql.cj.exceptions.WrongArgumentException - Conversion from ortus.boxlang.runtime.types.DateTime to TIMESTAMP is not supported.

DatabaseException: There is no known date-time pattern for '09/24/2024' value at ortus.boxlang.runtime.jdbc.PendingQuery.executeStatement(PendingQuery.java:390)

cannot get lenght of native java date time objects

Can't cast [2021-01-01 12:00:00 pm] to a DateTime.

BoxLang Betas are released weekly.

This is our seventh beta marker and we are incredibly excited of this beta marker since it now fully supports ColdBox for operation.

Improvements

web support error template only shows details of exceptions if IN debug mode else secure by default

If you are using the MiniServer or CommandBox, then if an exception occurs, only in DEBUG MODE, will you get the exception stacktrace, details and more. This makes it secure by default of not exposing any potential data for exceptions.

Consolidate the runtime into services without the need of getInstance()

A simple internal improvement to improve locking and instance usage.

New Features

threadNew()

This is a new BIF for BoxLang. We have a way to create threads using the thread{} component in both script and template, and we have threadJoin(), threadTerminate() but we never had a way to create threads functionally.

Signature

Examples

Please note that the attributes is a struct of data that we will bind into the thread's local scope.

Stream type and collector member methods

Java streams are now a native BoxLang type, which for now we don’t try to coerce, but simply match any existing instance or subclass of java.lang.Stream. This means we can now add member methods to ANY stream from BoxLang source code and make Streams also dynamic:

• .toBXArray()

• .toBXStruct( [String type] )

• .toBXQuery( [Query query] )

Examples

Collect stream of objects into BoxLang array

Collect stream of Map entries into a struct

Collect an array of structs into an existing query object

Collect a stream of objects into a list

orThrow( type, message ) for attempts

Attempts now allow you to do a custom exception type and message. Check out the docs.

ifSuccessful() alias to ifPresent() on attempts

Attempts now allow you to have an alias to ifPresent() that's fluent: ifSuccessful(). Check out the docs.

Bugs

Parser detection for unparsed tokens only works if there are 2 or more tokens left

Declaring UDFs in function context doesn't always work

CFConfig datasources aren't importing due to lack of support for the 'dbdriver' key

Runtime can deadlock due to syncronized methods

NPE calling isNumeric()

JSONSerialize() errors when useSecureJSONPrefix not a boolean

Cannot call getWriter(), getOutputStream() already called

empty url vars coming through as null

Tasks

Create tests for al valid and invalid dot and array access expressions

Welcome to Beta 15! This release brings several significant enhancements aimed at improving the efficiency and functionality of the CLI environment and continued bug fixing to bring our CFML compatibility to several client applications and Ortus Libraries. Key among these is the introduction of the bx-web-support module, which allows the CLI to interface with web server capabilities, making it an excellent tool for testing and feature auditing. Additionally, the merge capabilities within module settings have been refined to support deep merges from the configuration file, ensuring greater flexibility and control.

Moreover, running scripts or classes via CLI execution now supports the automatic detection and execution of Application.bx|cfc, streamlining the process for developers. The new ToString dump template enhances debugging by enabling a concise display format for lists of Java objects, simplifying the analysis and debugging process.

Overall, this beta release brings further stability for CFML applications migrating to BoxLang!

New Features

Look and execute for Application.bx|cfc when running scripts or classes via CLI execution

We have always wanted even further CLI enhancements for applications built with BoxLang. Now you get it! BoxLang will look for an Application.bx|cfc whenever it executes a template or class and follow the process of application startup, settings, ORM, etc. The full life-cycle of an application but at the CLI level. This will allow you to completely test your web applications with no web server and even build CLI applications with easy application constructs!

New bx-web-support module to support the CLI with web server capabilities. Great for testing, mocking and feature audits.

We have released the bx-web-support module which will give you mocking, testing and auditing capabilities for CLI testing and runners. This means that your CLI applications will look and feel like a real web application with a real web server, but using our mock approaches.

This module is still in it's alpha stages so expect much more development on it.

Module settings should have a deep merge from the configuration file

All module settings in your boxlang.json can now be deeply merged automatically by BoxLang.

Add a new ToString dump template that will take a list of java objects to display them in short hand format

We will be easing the visibility of certain human readable Java classes in our dump templates.

Handle single values in arrayAppend merge=true

A nice feature to support further merging techniques with arrays.

Improvements

dump improvement of UI when using expand/collapse

Show errors in class pseudo constructor in tag context

List utils need to trim all values when converting to arrays

LocalDateTime not showing in dumps as a date/time string, but as a Java Object

Update date/time and instant dump templates to be less verbose and more functional

Allow CF tag islands and template islands to be nested more than one level deep.

Merge CF lexer and grammar for faster parsing and more accurate lexing

Make tag expression parsing smarter

expandPath() must ignore invalid paths, just returning the input

More IO BIFs need to ignore invalid paths

Bugs

script block parsing can be tricked by comments

Lucee allows properties to be anywhere in the pseduoconstructor of a class, not just at the top

flush component only flushes up one buffer, not all the way

Boxlang doesn't parse milliseconds in datetime string

Date "string" doesn't have date time member functions available

Querynew failing with more than one column defined

Regular Expression Syntax not supported

Metadata visitor doesn't support struct annotations with unquoted keys

Hyper module failing

bx-compat cfloop requires "index" when it shouldn't

transaction shouldn't require global DSN

cfproperty tag lucee allows non quoted properties

Class name sensitivity based on provided rather than class found

No reading dump templates due to pathing incorrectly in debug mode

Static support not compatible with CFML

javacast not actually casting as expected

functions in variables scope vs values in variables scope

bx-compat unquoted hashed expressions cause compiler error

serializeJSON errors when serializing a function

Sentinel loop with missing expressions fails

mid() It does not remove characters if the count is more than the length

Cannot invoke "ortus.boxlang.runtime.types.IStruct.putAll(java.util.Map)" because "recipient" is null

This release introduces several new features aimed at enhancing the usability and functionality of BoxLang. We have closed a tremendous amounts of bugs on this release in order to bring more compatibility and stability to BoxLang. We have also started to introduce performance enhancements and more innovations as we progress towards final release.

Enjoy!

New Features

Writedump output support

We have finalized the console output for the dump component, but we have also added the following ticket:

New dump event to listen when an non-core output is detected so modules can handle it. onMissingDumpOutput

Which will allow module developers to collaborate their own output destinations for any dump in the language. This is something we have wanted for years and it's now a possibility. Just listen to the onMissingDumpOutput interception point, you get all the arguments to the BIF or component and you decide where things will go. VScode Dump Panel, here we come.

The console output has also been enhanced where everything will be pretty printed, including labels.

Ability to mark a @BoxBif as excluded from documentation

This is more of an internal documentation process for the team.

New dump template for Java instants

Java Instants will now be dumped nicely with an internal representation and a human readable representation.

dump showUDFs

All the arguments for dumps are now available including this one for controlling the dumping of UDFs on classes.

Improvements

Simplify BoxLang class dumps

Add output and format to dump

Some BIFs not fully supporting BigDecimal values

access e.cause as shortcut for e.getCause()

When creating an abstract class a new `AbstractClassException` is thrown. Great for testing frameworks

Bugs

queryaddcolumn ignores the datatype

Issue with #dateTimeFormat(now(),'mm-dd-yyyy')# function returning incorrect results

structnew( "linked" ) doesn't work

argumentCollection doesn't work with implicit constructor

directory component must always return query

BoxNewTransformer using hard-coded context name

toNumeric() not accepting radix values of 2-36

cannot cast [x to object] on generic caster when using `QuerySetCell()`

Issue with `Duplicate()` Function Causing Null Pointer Exception in BoxLang

final keyword not working on this scope

directoryList() filters are not working as closures/lambdas as they are hardcoded as strings

Cannot invoke "ortus.boxlang.runtime.types.Query.isEmpty()" because "this.query" is null

Multiple pipe-delimited glob patterns are not working as directoryList filters

DuplicationUtil not doing deep clones of structs according to all types

Throwing custom type exceptions just shows `custom` as the type instead of the actual type in the throw

remote access not treated as public but as private for functions

Interfaces don't support multiple inheritance

CFC source type not detected correctly for abstract or final classes

Metadata with : in them in cfml mode not treated correctly

xml entity parsing issue when calling `toString()` on Java objects

Welcome to Beta 16! This release focuses on web support functionality and contains a number of improvements and bug fixes for HTTP operations, including multi-part file uploads and error handling. It also provides enhancements to Java interoperability, dump template output, and metadata introspection.

Overall, this beta release brings further stability for CFML applications migrating to BoxLang!

Release notes - BoxLang - 1.0.0-Beta16

New Feature

Implement timeout for HTTP requests

Multi-part request support in HTTP

Improvement

Add text-based toString() method for Queries (used in console dumps)

for in Java transformer not mapping source line numbers for start of loop

Make include case insensitive

Enhance metadata visitor to process extends

add fieldNames key to form scope

Auto casting for URI and URL classes to string

Handle bad gateways in HTTP component

Allow for multiple form fields with the same name in HTTP component

autocast InetSocketAddress to string

Bug

Fix for overeager escaping of quantifier sequences in REFind

High order closures creating incorrect AST when parsing

Update DateTime Parsing to handle the Common Javascript Date.toString format

Module settings no longer overriding after deep merge function added

Java interop doesn't find method by argument types when passing null

Can't assign to List due to incorrect validation in referencer

content-type isn't always getting defaulted in some requests

for/in loop over struct should get String keys instead of BL Key instances

showUDFs not cascading down in dump levels

using cfcookie should update cookie scope

Fix argument order for FileUpload

Introduction

BoxLang 1.7.0 brings significant performance improvements, powerful new features for modern web development, and enhanced database capabilities. This release introduces Server-Sent Events (SSE) support for building real-time applications and AI agents, a new JDBC Cache Store for distributed caching, and bytecode compatibility versioning for improved module management. Performance optimizations across scheduled tasks, class loading, and ASM generation deliver faster execution, while over 40 bug fixes improve stability in file operations, HTTP handling, database queries, and CFML compatibility.

Introducing BoxLang 1.0.0 Beta 24!

We’re excited to announce the release of Beta 24, packed with powerful new features, essential bug fixes, and impactful improvements that enhance performance and security. This release brings more robust logging capabilities, enhanced configuration flexibility, and new query-handling methods to streamline your development experience. We’ve also squashed several parsing bugs, ensuring smoother code execution.

Whether you’re optimizing your runtime with custom logging encoders or leveraging the new queryColumnList for seamless data manipulation, Beta 24 is designed to empower developers with a more secure, customizable, and efficient development environment.

The BoxLang 1.0.0-Beta22 release includes several improvements, bug fixes, new features, and stories. Key improvements include enhanced redirection for the Miniserver, better transactional event broadcasting, and added convenience methods like getRequestContext() and getApplicationContext(). Bug fixes address issues such as JSON deserialization, whitespace management, and various errors related to data types and loops. New features include support for multiple statements inside queries and a new datasourceRegister() BIF for easier SaaS integrations.

Release Notes

Welcome to the latest release of BoxLang, where innovation takes center stage with groundbreaking enhancements and features designed to elevate your development experience. With the introduction of the ASMBoxPiler, we're pioneering a direct pathway to converting BoxLang code into highly optimized Java bytecode, offering an unprecedented boost in performance and efficiency. By eliminating traditional bottlenecks, we're empowering developers to achieve seamless integration with Java environments, transforming the way applications are built and executed. Prepare to explore the full potential of your projects with this transformative update!

New Features

ASMBoxPiler to do direct Java bytecode creation

With the implementation of the ASMBoxPiler, developers can now compile BoxLang source code directly into Java bytecode, streamlining the process and improving performance by over 4 times. This feature eliminates the intermediate steps previously required for code execution, resulting in faster compilation times and seamless integration with Java environments.

The JavaBoxPiler will remain in BoxLang as it's an integral debugging piece. It might be moved later to it's own module, but having the capability to transpile BoxLang/CFML code to Java will remain.

The direct bytecode generation allows for enhanced optimization and leverages the full potential of Java's JVM, leading to more efficient and scalable applications. By default, right now this is an experimental feature and it will need to be turned ON in order to use it via our boxlang.json configuration, via the compiler : "asm"

Star-import for boxlang classes

You can now use * imports for BoxLang classes, which allows you to bring in all the classes found in the imported package into the class namespace so you can create them by just using their name. In practice, the use of star-imports is a trade-off between convenience and potential issues such as namespace collisions. While they can make code more concise, especially when many classes from a package are needed, they may also import unintended classes, leading to ambiguities. Therefore, it's generally recommended to use specific imports when only a few classes are required and reserve star-imports for when numerous classes from the same package are genuinely required.

Java wildcard imports from loaded jars

The feature enhances import capabilities by allowing Java wildcard imports from loaded JAR files. This means you can use the * notation to import all classes within a JAR package, reducing the need to import each class manually. This functionality streamlines the process of utilizing numerous classes within a package and is particularly beneficial when dealing with extensive libraries. However, similar to BoxLang star-imports, it is essential to be aware of possible namespace conflicts and ensure that unintended classes do not get imported, maintaining code clarity and preventing ambiguity.

Ability to import/create BoxLang classes from modules via direct `@{moduleName}` notation.

The @ notation in BoxLang’s import system allows for more efficient and precise class referencing. By explicitly addressing classes from a specific module, performance is improved because it avoids the need for BoxLang to search through all available modules, reducing ambiguity in cases where classes with the same name exist in different modules. The module’s root serves as the base for addressing the class.

Here’s a breakdown of how it works:

By using this method, developers can avoid potential issues like performance degradation due to unnecessary module scanning and the possibility of naming conflicts. It provides a clear and concise way to manage dependencies and class imports in BoxLang.

Ability to import create java classes from modules explicitly using the `@`notation

Just like with BoxLang classes, you can also do the same for all Java libraries modules are packaged with. This allows you to import and create Java classes from specific modules by addressing them using the @ notation.

The following were support tickets for all of these functionalities

• Import Definitions now support module addressing for simple, wildcard and aliases

• JavaResolver module targeted resolution

MIgrate AST Capture to it's own experimental flag

If you want to capture AST JSON for debugging purposes you will need to activate the new AST experimental flag:

Add STOMP subprotocols in miniserver

We continue to make great strides with easy websocket support for BoxLang. Now we have added our very own STOMP implementation which makes our websockets behave like AMQP Messaging Brokers like RabbitMQ.

Improvements

Move CFID to compat module

Have servlet runtime return actual pagecontext object instead of fake

Update the allowedFileOperationExtensions and disallowedFileOperationExtensions to the security block

Allow casting to array of primitive types

Improve exception when trying to invoke null as a function

Get ColdBox Loading via ASM

Improve logic surrounding loading of pre-compiled source files

added a `isCommitted()` to the PageContext to match the servlet response to assist when doing resets without exceptions

StopGaps and config from cfconfig.json to boxlang.json

NotImplemented updated to check if it's a string and if empty, then ignore it to provide leeway

Rename default sessions cache to `bxSessions` to create the `bx` prefix standards. Add configuration to boxlang.json

Bug

boxlang invokes private onApplicationStart

expandPath does not preserve file system case

cfml2wddx action missing

deserializeJSON not handling white space / control characters

Update parser to allow for `@module` notations on imports and `new` operators

listFind() and listFindNoCase() are allowing partial matches

Can't dump null in console

Cannot invoke "java.lang.CharSequence.length()" because "this.text" is null

🚀 BoxLang Release Candidate 1 is Here! 🚀

After nearly a year of relentless iteration, rigorous testing, blood, sweat, lots of praying, tears, and over 1,000 resolved tickets, we proudly announce the first Release Candidate (RC1) of BoxLang! With 27 beta versions behind us, we are now on the final stretch toward the official 1.0 release.

This milestone ensures that most of our libraries are fully compatible and certified for BoxLang, making it production-ready. RC1 delivers significant bug fixes, performance optimizations, and stability enhancements, enabling teams to deploy and fine-tune their applications in real-world environments confidently. We strongly encourage the community to start running production workloads now—your feedback will be instrumental in refining BoxLang ahead of the final release.

Licenses Available TODAY!

Additionally, we are thrilled to open up support license subscriptions () for BoxLang +/++, offering enterprise-grade support, priority fixes, and exclusive benefits. As an introductory offer, all licenses are available at 50% off for February. In March, with the release of RC2, discounts will adjust to 25% off—scaling down progressively until our official launch at Into The Box 2025 ().

Let me also remind you that our Visionary Licenses will cease to be offered by the end of this month. Visionary licenses are unique for 10 years and 5 years of support. If you are interested in securing a visionary license, please email us at .

Production Tips

We encourage you to pre-compile your applications using our BoxLang compiler for incredibly safe and high-performance deployments since no parsing is involved. Combined with our new , your applications will fly and be highly performant.

Release Notes

New Features

Make sure execution exceptions are propagated to an `exception.log` for all runtimes

Create getHTTPTimeString bif in the CFML Compat Module

Missing bif: createTime()

Improvement

returns 500 status code when hitting the default error page

Allow annotation values of unquoted strings

allow RHS of castas operator to omit quotes

default output to true in Application classes

Disable external DTD validation

Migrate usage of LoggerFactory.getLogger to the internal BoxLang logger classes in the core

BIF and Component abstract objects now have a logger that maps to a `runtime` logger for ease of use

Favor native java methods on a struct if there is a key of that name, but it's not a function

Improve boxpiler selection by using the interface not classes or direct implementations

Bugs

Abort should not fire the `onRequestEnd` method ( or it should fail quietly )

Struct.put Usage Throws Error

BX-ORM: When First Request to Application is a CFC, the application scope is undefined when starting ORMApp attempts to instantiate

numeric key access of struct failing for BigDecimal keys

directoryList does not sort by name

Too many pattern letters: m

Trivial: Typo in error message

thread attribute scope needs to be headlessly accessible

structget() incorrectly returning true with cfml-compat installed

String caster doesn't work on char[] and produces incorrect results for Character[]

class dump template doesn't work with compat module

Access and mutation of native Java unboxed arrays doesn't work

Query objects do not allow complex data when adding columns via `queryAddColumn()` with no data type.

Can't use EMail as a returntype from EMail object

shebang detection not working and skipping execution to the REPL

isValid uuid returns false

Error executing dump template

default string representation of exception object

Dereferencing property on Java class not calling getter

Jakarta servlet removed response.setStatus( int, String ) from API

Typo in exception string for parseDateTime

getDirectoryFromPath breaks when passed a null value

Durations created by `createTimespan` can't be casted to strings

`this` scope can no longer be mutated

final access modifier with explicit static scope on assignment not working

static method access on non-imported identifer not working

boxpiler was defaulting to javaboxpiler internally, remove it, it should be null and seeded later

isSimpleValue returns true on Exception in Compat Mode

QueryParam: SQL Server Unknown Column Type `datetime`

ParseDateTime failure with `hh:nn a` mask - e.g. `03:00 PM`

onRequestEnd() not firing for on class requests

This was our first stable release of the BoxLang language. It grouped the entire betas and release candidate features and fixes. This specific version included the following release notes from issues that changed between release candidate 3.

New Features

Create the config `runtimes` struct so any runtime can store their settings there by convention

Add simple rewrites to miniserver

Introducing BoxLang 1.0.0 Beta 23

The latest release of BoxLang, Beta 23, marks a significant step forward in our journey to create the ultimate dynamic language for the JVM. Packed with powerful new features, important bug fixes, and thoughtful optimizations, this update is designed to make your development experience smoother, faster, and more reliable, especially after now starting to take 100s of comments and bug reports from our community.

Modularity takes center stage in this release with the ability to define BoxLang components (aka Tags) within modules and a new version-checking mechanism that ensures module compatibility. Database interactions are now more intuitive with enhancements to the Generic JDBC Driver, and the introduction of the getSemver() function brings a robust tool for managing semantic versioning with precision and ease.

BoxLang Betas are released weekly. This is our third beta marker. Here are the release notes.

New Features

Implement query cache ability

In this release, we are excited to introduce several new features and enhancements aimed at improving functionality and user experience. These updates include the creation of Unmodifiable query types, new server keys to aid on CLI tooling, and methods to identify runtime initiation modes.

Additionally, we've added an event announcement for dump rendering to enable better integration with external listeners. Read on to learn more about these features and how they can benefit your workflow.

Code Strong!

New Features

BoxLang Betas are released weekly. This is our tenth marker and we are incredibly excited to bring you a very big release. This gives us a huge push forwards towards compatibility with other engines and many more new features we have always wanted in our language. Enjoy!

Release notes - BoxLang - 1.0.0-Beta10

New Features

transpile queryGetRow() to queryRowData()

Ths is a compatibility feature for CFML engines so they can use the queryGetRow() BIF which internally funnels to the () method.

Ini files support

CFML engines always had half baked support for working with INI files. We now have full support and a fluent way to interact with ini files. This is really important for those building IoT solutions or interacting with micro processor devices. To get started use the boxlang installer install-bx-module bx-ini or if using CommandBox: install bx-ini

Here is a typical ini file example:

Here are the contributed functions in this module:

• getIniFile( file ) : Reads an ini file and returns the IniFile object. If the file does not exist, it will create it.

• getProfileSection( iniFile, section ) : Gets a section from the ini file as a struct

• getProfileSections( iniFile ) : Gets all the sections from the ini file as a struct of structs

The IniFile object is a fluent object that allows you to work with ini files in a very easy way. Here is an example of how to use it:

JSStringFormat BIF

This BIF is now complete to provide JavaScript escaping when using BoxLang as the template processor:

xml component

We have now finalized XML support in BoxLang with a beautiful xml component:

getVariable() & setVariable()

These two functions now exist in the compat module. It allows you to set and get variables in the variables scope. This can also be used to retrieve dynamic variable names or set dynamic variable names:

Add getClientVariablesList() to compat

Legacy client scope support added to the compat module

New getDescendantsOfType() AST method with predicate

This is an internal method of our contexts to allow us to retrieve things easily with predicates.

Implement single quote escapes in queries and preserveSingleQuotes

We thought this was going to be an easy one. preserveSingleQuotes() is now built for the core language to assist when building dynamic SQL and escaping quotes smartly.

Allow .cfm and .cfs files from the boxlang CLI runner

Our BoxLang runner now allows for the CLI execution of cfm and cfs files directly along side BoxLang templates.

Add isNumericDate BIF

This BIF is now in the core thanks to a client migration.

Add getHTTPTimeString BIF to web-support

Our web support package gets a new BIF thanks to a client migration

Writedump label support

WriteDump in BoxLang now get beautiful labels!

java.math.BigInteger caster

We have a new caster for BigInteger and BigDecimal to help us with precise mathematics in BoxLang.

Improvements

When doing class serialization make sure to identify which properties have `serialize=false` on them

Our serializer to binary for classes now respects the serialize annotation on properties.

content component can have body

Enhance error messages for parsing invalid tag code

Bugs

MalformedInputException: Input length = 1 when parsing CFC

component detection can be tricked if there is a tag comment line starting with the word "component"

Regression: Can't run files via BoxRunner due to new action command logic

Sometimes trying to shutdown runtime throws NPE if it was never started fully

pretty print visitor outputting extra " on tag catch block

pretty print visitor doesn't handle array notation invocation

This release brings enhanced XML handling, new CLI app support, improved error handling, and expanded interoperability with Java and CFML runtimes. We've also added new HTTP event hooks, improved caching strategies, and a streamlined class resolution process to make your applications more performant, even in debug modes.

🌟 Highlights:

✅ Enhanced XML Support – Improved cloning, merging, and namespace handling in XML operations. ✅ Unified Template & Script Grammars – BoxLang now seamlessly integrates both styles, bringing performance updates to the parser. ✅ Improved Java Interop – Automatic coercion of BoxLang arrays to native Java arrays and varargs support ✅ Better Error Handling – More robust dump rendering and exception management. ✅ New CLI Features – Built-in functions like cliRead(), cliGetArgs(), and cliExit() for pure CLI apps. ✅ Improved HTTP Handling – Proxy support, authentication, and new request/response events.

✅ Trusted Cache – Trusted cache is in the house, to get high performance in production

✅ Class location caches – More performance updates for class resolutions for BoxLang classes

With over 40 improvements, new features, and fixes, this release makes BoxLang even more powerful and stable! 🔥

Improvements

Implement Node pass-through methods to handle cloning and merging of XML objects

Combine template and script grammars for boxlang

Error Getting method keyExists for class ortus.boxlang.runtime.types.XML

StructFindKey returns two findings on the same node if top level key is array

Better error handling when dump template errors

Return callback return value from runThreadInContext()

java interop coerce BL arrays to native arrays

Add toOptional() method to Attempt

coerce return values of proxied methods

output class of non-simple valued fields in class output for cfdump

prefer same mapping for relative class lookups in box resolver

Client scope needs more consistencies like the session scope when validating and expiration determination

Module service record was not registering interceptors with the module settings

HTTP Component - Implement Proxy Server handling

add default itnerface helper for the IBoxContext to get the running application name if any

Servlet to support Jakarta namespace

New Features

Move defaultCache to the caches section as default, verify it exists, else create it anyways

add http events: onHTTPRequest, onHTTPResponse

Expose buildRegistry() and encapsulate per location registration

CLI BIFS for working with pure cli apps: cliRead(), cliGetArgs(), cliExit()

Activate box resolvers cache according to request and app settings

New setting: classResolverCache : boolean [true] which controls if the class locators caches resolve lookups

Bugs

varargs not working

CF casts Class instances to a String

Namespaced XML nodes not accessible by their non-namespaced names

XMLSearch Not Finding Correct Results When Namespaces are Present

XML asString Generates trailing line break

StructFindKey Not Returning owner values correctly

ASM compilation error

query with empty column name can't be dumped

WriteDump()/Dump() is broken in current snapshot build

DateCompare on two zero-hour strings fails with long overflow

XMLElemNew Illegal Character exception when using the namespace URI as the second argument

HTTP Component - Implement Basic Authentication

Cannot access variables scope in a static context -- but there is no variables access

timezone not always used in datetime caster

toUnmodifiableStruct() method not threadsafe

directoryList filter param does not accept a closure

Support for guid and uuid type

getDirectoryFromPath returns different result to Lucee and ACF

argument type of binary is not supported

argument type of email is not supported

CGI scope reporting 0 items

JSONSerialize pretty prints JSON which blows up outbound NDJSON

CFHTTParam Encodes Query Strings By Default

URLEncodedFormat Replaces Spaces with Plus Symbols

Bracket Notation Usage on Java Hashmaps Does not work.

Detail and Extended Info Can Be Null In Thrown Exceptions

BoxLang Beta 26 Has Landed!

We’re thrilled to announce the release of BoxLang 1.0.0 Beta 26, a monumental update that takes performance and functionality to the next level. This beta officially certifies the ColdBox HMVC Framework to run on BoxLang, marking a significant milestone in compatibility. Not only can you now run all ColdBox applications seamlessly on BoxLang, but with the latest ColdBox snapshot, you can also build your entire applications in BoxLang, unlocking the full potential of this dynamic and expressive language for modern application development.

This release also introduces blazing-fast Query of Queries (QoQ) support, delivering speeds up to 70 times faster than Adobe or Lucee in specific scenarios, along with exciting new features like list parameter support in JDBC queries and custom QoQ functions. Over 70 bugs have been resolved, and significant improvements have been made, such as enhanced debugging capabilities, refined Box Script syntax, and robust session and metadata handling. With Beta 26, BoxLang continues to push the boundaries, empowering developers to build robust, efficient, and fully modern JVM-based applications.

We have really kicked into gear with this release, tackling a whopping 26 tickets and delivering some of our most aggressive features to date. This update signifies a significant leap forward towards a stable release in the Fall. Thank you for your continued support and stay tuned for more exciting developments!

New Features