LDEV-6092- Update to ASM 9.9.1 - Java 26 support
LDEV-6076- Eliminate Integer autoboxing in SourceCode constructor
LDEV-5992- use a pool for qoq hsqldb queries
LDEV-6062- Avoid exception-as-flow-control in QoQ
LDEV-6059- avoid using NoSuchElementException exception-as-flow-control
LDEV-6060- CFMLExpressionInterpreter.identifier() unnecessarily looks up PageSource for dot notation setting
LDEV-5832- improve parser compiler performance
LDEV-5920- improve performance loading resultsets from jdbc
LDEV-6054- Extension Startup-hook with maven coordinates not recognized as valid class definition
LDEV-6044- Refactor OSGi system packages configuration to use Felix JPMS auto-detection
LDEV-5923- ThreadLocal PageContext registration optimization
LDEV-5953- Use ThreadLocal buffer pools for IOUtil
LDEV-5908- Switch to java ConcurrentHashMap
LDEV-6010- Add Ability to Flush Cache for Specific Query and/or Function
LDEV-6002- Remove old JTDS extension from FAT JAR
LDEV-5959- restore basic extract/compress BIFs for zip/gzip
LDEV-6045- add maven support for extension tags and functions
LDEV-5696- felix cache is listing previous core versions as bundles
LDEV-6176- Admin "Create Archive" produces nested zip path instead of filesystem path
LDEV-6172- MappingImpl.initPhysical() overrides physicalFirst before archive initialises
LDEV-6177- Security > Access: temp directory repeatedly appended to custom directories
LDEV-6168- Remove static NativeException LRUMap cache
LDEV-6165- Regression BundleException: archive-sample1.lar is not a valid bundle
LDEV-6086- InternalRequest swallows RequestTimeoutException exceptions
LDEV-6150- Add HTTP connection pool stats to getSystemMetrics()
LDEV-6155- Request timeout race condition in StopThread causes spurious timeout exceptions on new requests
LDEV-5345- getPropertyString() getPropertyfile() & setPropertyString()
LDEV-6147- ExtensionProvider.last() prefers SNAPSHOT over release when resolving latest extension version
LDEV-6143- Admin Extension download error message doesn't include connection failure detail
LDEV-6139- releaseORM() skips closeAll() when flushAll() throws, leaking ORM session connections
LDEV-6138- ORM DatasourceManagerImpl.releaseConnection() leaks unmanaged connections when autoCommit=false
LDEV-6133- PhysicalClassLoaders accumulate in memory and are never released when no longer needed
LDEV-6132- Optimize ClassLoader reuse across web contexts sharing the same Java libraries
LDEV-6073- Page [/lucee/formtag-form.cfm] missing with form ext and 6.2.4
LDEV-6107- Stale renamed className in PageSourceImpl causes ClassNotFoundException flood after classloader flush
LDEV-6084- IllegalAccessError when dynamic invocation wrapper not in target's ClassLoader
LDEV-5862- Bad access to protected data in invokevirtual
LDEV-5711- regression: extension.pdf.tag.DocumentSection cannot be cast when marginTop set - due to reflection being disabled
LDEV-5909- CommandBox Tray Icon Issue in Lucee 7
LDEV-1109- RAM drive disappears
LDEV-6108- Make getSystemMetrics() official
LDEV-5437- path outside mapping not correctly resolved
LDEV-6105- Add configurable Maven download policy with startup/runtime distinction
LDEV-6101- org.lucee.extension.esapi.functions.SanitizeHTML not found
LDEV-6098- Older ESAPI extension requires commons-lang which is unbundled in 7.0.2
LDEV-6075- OSGI stack overflow after downgrading ESAPI ext
LDEV-6097- StackOverflowError when duplicating CatchBlock with cause chain
LDEV-6090- ClassNotFoundException in PhysicalClassLoader due to file locking race condition during JAR update on OverlayFS
LDEV-6085- admin - scopeCascading and templateCharset don't update
LDEV-6056- Regression: incorrect super.method() resolution in deep component hierarchies
LDEV-3892- improve Can’t cast Complex Object Type Struct to [String] type exceptions
LDEV-6069- Extension update check incorrectly reports downgrade as upgrade due to inconsistent version padding
LDEV-6068- refactor admin update version handling
LDEV-6066- streamline verifyDatasource
LDEV-6067- add admin updates notification test
LDEV-6065- admin should disabled null support via application.cfc
LDEV-6063- cfflush forces Connection: close, breaking HTTP keep-alive
LDEV-6058- val() member function missing
LDEV-6012- remove jna from core
LDEV-6161- ESAPI Extension v2 → v3: OWASP Encoder Migration
LDEV-6057- NullPointerException when datasource defined in CFConfig.json without host or port
LDEV-6055- super.method() error incorrectly reports "no private function"
LDEV-6051- Default datasouce maxIdle to connectionLimit for better connection reuse
LDEV-6048- Lucee loader version checks have inverted logic and confusing error messages
LDEV-6046- sessionInvalidate() fails to de-activate old session when using database session storage
LDEV-6043- DecimalFormat returns wrong value for numbers >= 10000000 (scientific notation bug)
LDEV-6023- improve parser TemplateException, add context
LDEV-6021- cacheGetDefaultCacheName() does not recognize application-level default caches
LDEV-6020- cachedWithinFlush() returns false with struct arguments on multi-argument functions
LDEV-6004- Regression: Property.getDefault() returns empty string instead of null when no default is set
LDEV-6003- ORM Issue with Lucee 7 and Ortus 6.5
LDEV-5998- add support for "generationConfig" with Gemini
LDEV-5991- Datasource idleTimeout default of 1 minute is too aggressive
LDEV-5996- increase AI default timeout
LDEV-5995- hide AI api key in Lucee admin
LDEV-5994- update AI endpoint in admin needs a restart
LDEV-5999- Add multipart input support (images, PDFs) to AI sessions
LDEV-5993- when using a invalid model for AI the exception is to generic
LDEV-5966- Request timeout causes phantom connections in datasource pool
LDEV-5965- Datasource Connection validation exception should reject connection
LDEV-5972- Fix MSSQL Modern Mode Properly
LDEV-5970- MSSQL JDBC 13.2.1 throws "result set is closed" when using lucee.datasource.mssql.modern=true
LDEV-5955- Regression: Startup hooks not triggered in Lucee 7
LDEV-5957- Startup hook finalize() not called on extension uninstall/update - class loaded from wrong classloader
LDEV-5963- idleTimeout/connectionTimeout ignored - pool evictor disabled
LDEV-5964- Session datasource connections deadlock
LDEV-5962- Connection pool config defaults cause connectionLimit to be ignored and threads to block forever
LDEV-5339- isThreadInterrupted()
LDEV-5976- Regression: Error merging/importing cfconfig.json at startup
LDEV-5950- Race condition in TreeNode causes random dependency count mismatches in mavenLoad()
LDEV-5954- query.addParam with list=true crashes when using array as value
LDEV-5940- Static function calls with :: notation slower than . notation
LDEV-5951- use optimal sized structs and arrays for queries
LDEV-5634- Query of Query - Doesn't error when you reference a column that is not part of the original query
LDEV-5884- Lucee fails to properly detect version when ALPHA suffix is present with multiple core versions in patch folder
LDEV-5947- admin overview page shows alpha update notifcation
LDEV-5943- The setting Inspect Templates (CFM/CFC) always resets to Auto
LDEV-5730- sessionRotate: class lucee.runtime.type.scope.JSession cannot be cast to class lucee.runtime.type.scope.storage.StorageScopePro
LDEV-5942- sessionRotate() should rotate JSESSIONID for J2EE sessions
LDEV-3248- SessionInvalidate for JEE Sessions
LDEV-5939- cfdirectory action="delete" directory="" defaults to current dir
LDEV-5935- reduce xml logging overhead
LDEV-5913- Regression: super method resolution fails in nested closures
LDEV-5932- CFHTTP GET doesn't enable compression due to HttpGetWithBody
LDEV-5931- local file access restrictions regression in single mode
LDEV-5883- CFML stack trace doesn't show line numbers for errors occurring inside inline components
LDEV-5605- Exceptions in inline components have no stacktrace
LDEV-5927- validate javasettings is a valid json string at compile time
LDEV-5763- when a components javaSettings are cfml struct, all functions are missing
LDEV-5918- Bug : ListGetDuplicates()
LDEV-5915- Lucee 7 Admin web context form inputs always displaying hash values instead of label names
LDEV-5921- some should log checks are reversed
LDEV-5907- named arguments don't need to use a synced intermediary linked hashmap
LDEV-5911- Allow dead code elimination for platform specific logic
LDEV-5910- CFDIRECTORY fetch local file attributes in a single operation on windows
LDEV-5904- fileCopy(url) hanging
LDEV-5906- improve missing argument name exception
LDEV-5901- add attribute-group to tlds for complex tags with subsets of related attributes
LDEV-2931- times loop functionality does not support continue, throws Null Pointer Exception
LDEV-2930- times loop functionality does not support break, throws Null Pointer Exception
LDEV-5900- allow createArchive/compileMapping to return errors via errorVariable
LDEV-5898- AST NPE with for loops with null conditions
LDEV-5894- Import and JavaSettings Context Lost in TestBox Closures
LDEV-5891- NullPointerException in DatasourceConnectionImpl
LDEV-5889- lucee.preserve.case handling logic is reversed in Lucee 7.0.0
LDEV-5885- Race condition during extension installation: Cleanup process deletes extension files while they are being installed
LDEV-5839- astFromString returns different ast that astFromPath
LDEV-296- Throw an error on unsupported component initMethod
LDEV-5859- Better filenames for execution logs use request-pcid-starttime.exl
LDEV-5122- refactor internal downloaders into a common class
LDEV-5873- regression: udfs.clear in pageContent.release() needs additional check
LDEV-5869- Cookie values containing a = are cut off
LDEV-5870- astFromString should ignore unknown tags from existing tag libraries instead of throwing errors
LDEV-5868- AST NamedArgument invalid structure
LDEV-5863- Race condition in config file write-then-read causes "Can't cast String [] to Struct" error in Docker
LDEV-5860- Add support for Gradle/Maven-style coordinates for extension installation with env var
LDEV-5856- Monitor Configuration Structure Inconsistency After XML to JSON Migration
LDEV-5855- AST Parser Ignores Named Function Arguments and Treats Them as Positional Arguments
LDEV-5854- Admin ORM page, link to extension when no engine is installed
LDEV-5853- Admin search page, when the extension isn't installed show a message
LDEV-5850- Improve SysProp / Env Var documentation
LDEV-5845- Update QoQ SQL parser to support FROM Join Syntax for HSQLDB fallback
LDEV-5849- Add flag to restore old behaviour for tags writing into variables scope
LDEV-5844- Very large execution logs cause out of memory error due to string copying
LDEV-5836- AST add isBuiltIn metadata for CallExpression and built in tags
LDEV-5831- optimise cfproperty attribute handling
LDEV-5821- improve cfproperty bytecode performance, don't use a tag
LDEV-5830- Build hanging on extension download
LDEV-5851- regression: maven based extensions is super slow
LDEV-5842- MavenUpdateProvider problem with dates
LDEV-5813- com.sun.mail.util.SocketConnectException not found by javax.mail
LDEV-5305- java.lang.LinkageError: Attempted duplicate class definition
LDEV-5818- regression, preside can't find a datasource
LDEV-5608- can't find matching constructor with a nullValue
LDEV-5810- regression: Provider com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl could not be instantiated:
LDEV-5811- build improve test runner output
LDEV-5708- SOAP webservice - invoke service method with complex return type exception on Lucee 7
LDEV-5802- Cannot invoke ""java.lang.Integer.intValue()"" because ""this.componentDataMemberDefaultAccess"" is null
LDEV-5625- regression: lucee.commons.lang.ClassException: cannot load class through its string name
LDEV-5804- resourceExecutionLog doesn't report execution time with the correct units
LDEV-5800- use docker version of httpbin.org for github actions
LDEV-5799- REST enabled CFC should store functions in a linkedHashmap to allow proper path matching
LDEV-5795- REST not matching function names, only by restPath
LDEV-5796- build test reporting repeats errors when failed and and errors
LDEV-5776- rest mappings aren't being loaded with Lucee 7
LDEV-5779- REST Component not picking up the correct application.cfc
LDEV-5777- Generated .CFConfig.json Should Not Include Explicit Mode Setting
LDEV-5775- configImport needs to merge debugTemplates as an array
LDEV-5774- configImport needs to merge rest mappings as an array
LDEV-5773- Add urlDecode strict argument which when false, strips out invalid encodings
LDEV-5772- cfexecute returns a null in errorVariable
LDEV-5771- add support algorithms to rand, randRange and randomize exceptions
LDEV-5764- CFIMAP stopOnError isn't supported
LDEV-5285- improve exception when a function has no name
LDEV-5760- Lucee 7 javax/jakarta Extension Compatibility Issue
LDEV-5761- admin: services tasks doesn't show error when executing
LDEV-5534- form extension broken in single mode
LDEV-5759- this.logs in application.cfc fails silently or doesn't define a log
LDEV-5731- class org.lucee.extension.image.coder.Coder cannot access a member of class org.lucee.extension.image.coder.jai.JAICoder with modifiers ""protected""
LDEV-5755- cannot find jar org.apache.commons.commons-fileupload2-core:2.0.0.M4
LDEV-5660- on update additional osgi mappings from core aren't used, preventing updates
LDEV-5757- jakarta 11 support
LDEV-5476- Cannot invoke ""lucee.runtime.config.IdentificationServer.getSecurityKey()"" because ""id"" is null;
LDEV-5694- regression: Failed to load dependencies in [groupID:com.github.tjake;artifactId:jlama-native;version:0.7.0]
LDEV-5747- concurrent cfschedule updates causing CFConfig corruption
LDEV-5653- Admin: add bundleName and bundleVersion to the JDBC Other datasource form
LDEV-5743- queryAddColumn( query=a ,columnName="type" ); throws an casting null error
LDEV-5742- AST Utility Method Signature Mismatch
LDEV-5741- Allow disabling mime type sniffing for file uploads with unknown mime types
LDEV-5740- improve HMAC exception with a list of available algorithms
LDEV-5739- improve GenerateSecretKey exception with a list of available algorithms
LDEV-2682- Function GeneratePBKDFKey() only handles algorithm PBKDF2WithHmacSHA1.
LDEV-5734- replace StringBuffer with StringBuilder
LDEV-5736- improve named argument alias handling for built in functions
LDEV-5722- change cfcache to ignore query_string by default, useQueryString=false
LDEV-5177- enable lucee.security.limitEvaluation by default for Lucee 7
LDEV-1975- cfcache doesn't support attributes "dependsOn", "stripWhiteSpace", "useCache", "useQueryString"
LDEV-5702- regression: cookie scope keys not being found
LDEV-5709- Admin: CGI Scope Write Update Not Working
LDEV-5706- lazy load cgi read only scope structs
LDEV-5703- Optimize parser whitespace handling
LDEV-5698- admin: extension list labels lack contrast in dark mode
LDEV-5695- Admin: restore Logout UI for 7
LDEV-5697- improve mismatched end tag exception with line number of end tag
LDEV-5691- Admin: clicking lucee logo logs out
LDEV-5689- regression: slow performance with new query() and lots of params
LDEV-5684- Missing Required [setting] Attribute in Tag When Using action="updateDefaultSecurityManager"
LDEV-5715- Add AST (Abstract Syntax Tree) Generation
LDEV-5672- use different type than "controller" in the engine and factory
LDEV-5670- Controller should log detail about which individual steps exceed a threshold
LDEV-5612- update to mysql 9.3.0
LDEV-5661- update to postgres 42.7.7 - CVE-2025-49146
LDEV-5650- Regression: timestamps in Europe/Helsinki timezone have historical tz changes applied
LDEV-5654- Admin: Bundles shouldn't crash on invalid bundles
LDEV-5649- improve temp file handling
LDEV-5648- Admin: applications list crashes for an extension without otherVersions
LDEV-5645- upgrade ASM to 9.8 for java 25 support
LDEV-5642- Establish Consistent Configuration Hierarchy - Environment Variables Should Always Override Configuration Files
LDEV-5638- Application.cfc mailservers should accept smtp as an alias for host or server
LDEV-5636- admin: web accessible mapping setting missing on the create page
LDEV-5635- ConcurrentModificationException in ConfigImpl.cleanConnectionPools
LDEV-5633- ReplaceNoCase Performance Regression in Lucee >=5.4.5.13-SNAPSHOT
LDEV-5631- build shouldn't swallow the strack trace from service exceptions
LDEV-5627- Add getClass() function to components for Java proxy class creation
LDEV-5626- allow to load java class
LDEV-5620- Illegal Character ':' Error When Creating Java Object
LDEV-5621- when defining multiple layers of javasetting, Lucee child apply child first rule with classloaders
LDEV-5600- Maven integration: javasettings ignored if package exists locally even if versions are different
LDEV-5538- regression: datasource connections aren't being released
LDEV-5578- Lucee 6 createDynamicProxy() requiring “Webservice Engine”
LDEV-2917- Enhance SSLCertificateInstall() to point to custom key store
LDEV-4318- add low level ftp and sftp debugging
LDEV-5604- allow specifying source struct / scope for cfinsert and cfupdate
LDEV-5536- single mode contexts loading components from other contexts
LDEV-5379- restore missing security options subset for single mode
LDEV-5551- NPE at startup using logger
LDEV-5552- Deployment: Can't delete directory as it's not empty
LDEV-5434- Lucee admin not loading
LDEV-5550- startup regression: Cannot invoke "lucee.runtime.type.Struct.get(String, Object)" because "sct" is null
LDEV-5546- change query debugging to store paramType and ParamValue as arrays
LDEV-5544- array out of bounds error in classic debug template