Blog

Everyone knows the datasource password should not be sitting in plain text in a config file. Everyone has also, at some point, shipped exactly that, because the alternative was a pile of environment variable plumbing that nobody wanted to build on a deadline. x

Here's a bug that's easy to miss until it bites someone in production: an agent turn asks for two tool calls at once, both need human approval, and only the first one actually suspends. The second one gets silently skipped. Not rejected, not queued, just gone. That's what happened before 3.4.0, and it's fixed now with batched tool-call approvals.

HumanInTheLoopMiddleware used to do everything itself: decide which tool calls needed approval, present the request, and wait for a decision. In 3.4.0, that logic has been pulled apart into a real subsystem, and the piece developers will feel the most is that a human's "always allow this" now actually means always.

Every serious language has a way to ask "is this even parseable?" without running it. bash -n script.sh. node --check file.js. python -m py_compile. As of 1.17.0, BoxLang has one too.

Every AI agent that touches something real eventually needs a human in the loop. Someone has to approve the delete, confirm the wire transfer, or just say "go ahead" before a tool call runs. The question BoxLang AI 3.4.0 answers is: approve it how? A terminal prompt? A webhook? A Slack button?

BoxLang has always been an extensible language. As of 1.17.0, it is a hierarchically extensible one. Every module ecosystem you have worked in is flat. You declare a list of dependencies and something outside the language, a package manager or a build tool, resolves and downloads and orders them. The language itself has no opinion about the shape of the graph. It sees a list, not a tree.

BoxLang has always been an extensible language. As of 1.17.0, it is a hierarchically extensible one. Modules can now contain other modules; aka Module Inception. Recursively. To any depth. Each nested module gets its own class loader, chained to its parent's, and BoxLang's own ModuleService discovers, registers, activates, and unloads that entire tree itself. No package manager. No build tool. No install ordering. Drop in one artifact and everything it depends on comes with it, already wired up and already isolated. Not only that, you can now package modules into a single jar.

BoxLang AI 3.4.0 is one of the biggest releases in the module's history, and it is built around a single theme: trust. Every agent you ship eventually needs a human to step in, and every agent that reads untrusted content is a target for prompt injection. This release gives you both a proper answer.

Learning a new AI API usually means jumping between scattered documentation pages, guessing at imports, and copy-pasting code that may or may not still work. We wanted something better for BoxLang AI, so we built the BoxLang AI Explorer: a local, browser-based catalog of runnable BoxLang AI examples, organized by category and difficulty, each with guidance, source code, and sample output.

If you've spent years in Spring Boot, Micronaut, or Jakarta EE, "web framework" usually means a servlet container, an embedded Tomcat or Netty, a build step, and a fat jar before anything answers a request. What if you could skip all of that and still be on the JVM?