ContentBox RSS Feed https://www.ortussolutions.com Ortus Solutions, Corp (www.ortussolutions.com) http://www.rssboard.org/rss-specification FeedGenerator Tue, 27 Oct 2026 12:51:57 GMT Tue, 27 Oct 2026 12:51:57 GMT Ortus Solutions today announces MatchBox 0.12.0, the Rust runtime for BoxLang, alongside the launch of matchbox.boxlang.io: a new website with a live in-browser playground, a ten-lesson course, and complete online docs. The release also brings a more capable JIT, prebuilt native modules, a richer web runtime, and a long list of BoxLang compatibility fixes. https://www.ortussolutions.com/blog/matchbox-012-one-language-every-runtime-now-with-a-live-playground-and-a-course Tue, 27 Oct 2026 12:09:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang Community Into The Box News Releases https://www.ortussolutions.com/blog/matchbox-012-one-language-every-runtime-now-with-a-live-playground-and-a-course The server restarted. The administrator shows the expected version. Your homepage loads, and a few familiar screens look fine. Would you tell the business the upgrade is complete? Consider an illustrative scenario: a customer submits an order after an upgrade. The application saves it and displays a confirmation page. But the confirmation email never arrives, and the scheduled process that sends the order to fulfillment has not completed. From the browser, the transaction looked successful. Operationally, it is still waiting. For teams maintaining business-critical ColdFusion or Lucee applications, that gap deserves a place in the release plan. A successful startup is one checkpoint. The workflows your customers and colleagues depend on need their own evidence. If upgrade preparation keeps competing with feature delivery, explore Ortus Staff Augmentation to see how an embedded CFML specialist, technical leadership, or a focused workstream could support your team. Ortus Staff Augmentation The checks you run determine the failures you can see Opening a page verifies something useful: the application can handle that request under those conditions. It tells you much less about work that happens afterward, elsewhere, or under a different identity. Your application may also depend on: Email queues and external mail providers. Scheduled tasks running outside normal business hours. PDF generation, document processing, and file permissions. Authentication providers and session behavior. External APIs, callbacks, and retry logic. Java libraries, installed packages, and environment configuration. A release check focused on interactive pages can leave these dependencies largely unexamined. The question for your next upgrade review is straightforward: Which business process could fail while every page on our current checklist still passes? Start there. Release notes become more useful when connected to your application Vendor release notes can help identify where to investigate. For example, Adobe’s historical ColdFusion 2025 Update 5 documentation lists fixes involving mail, clustered scheduled tasks, and PDF functionality. It also describes configuration and security behavior changes. These are specific changes documented for that release—not a claim that those problems remain unresolved or affect every application. Read Adobe’s Update 5 documentation. The practical lesson is to translate relevant release notes into application questions. If your application generates invoices as PDFs, who will verify a representative invoice? If it depends on scheduled processing, what proves the task ran and produced the correct result? If an update changes a security default, which legitimate application behavior depends on the affected configuration? When moving across several updates, review the intervening changes that apply to your environment. Follow the vendor’s current instructions for your target version. This preparation should support timely patching. For urgent security updates, prioritize critical workflows and make the remaining verification and monitoring responsibilities explicit. If upgrade preparation keeps competing with feature delivery, explore Ortus Staff Augmentation to see how an embedded CFML specialist, technical leadership, or a focused workstream could support your team. Follow one transaction beyond the success screen Choose a workflow that matters to the business. Then trace it until its operational outcome is complete. For an order workflow, that might mean: The customer submits the order. The application stores the correct details. A confirmation enters the mail queue. The message reaches a controlled test mailbox. An integration sends the order to fulfillment. The receiving system acknowledges it. A failed attempt can be recovered without creating a duplicate. Each step answers a different question. A saved database record does not prove email delivery. A successful API response does not necessarily prove the receiving system completed its work. A scheduled task appearing in the administrator does not prove its latest run processed the intended records. Define the evidence at the point where the business outcome becomes observable. For email, that might include queue processing, provider acceptance, and receipt in a controlled mailbox. Those checks still cannot guarantee delivery to every customer, but they establish more than a successful call to the mail function. For an integration, it may mean confirming the expected record in the receiving system using a traceable identifier. The useful acceptance criterion is specific enough that another person can verify it. Build a workflow acceptance map You can start with a shared table. The examples below are suggested checks, not results from a customer project. Critical workflowWhat could be interrupted?Evidence to collectResponsible owner Order confirmationCustomers lack confirmation of their purchaseControlled order, queue status, and receipt in a test mailboxApplication owner Nightly reconciliationRecords remain unprocessed or inconsistentScheduled execution and expected results for controlled recordsOperations or assigned developer Invoice generationCustomers receive missing or incorrect documentsGenerated document with expected content and access permissionsFeature owner Fulfillment integrationOrders are missing or duplicated downstreamReceiving-system record and verified failure/retry behaviorIntegration owner Sign-in and restricted accessUsers cannot work, or access rules behave incorrectlyRepresentative roles, session behavior, and denied-access checksAuthentication owner Replace the suggested roles with named people. Add the environment, execution time, result, and a link to the evidence. Choose the first workflows by consequence: What stops revenue or customer service? What could affect data integrity? What runs infrequently enough that a failure might remain unnoticed? What depends on a component changed by this upgrade? A short, deliberately chosen list provides a useful starting point. Include the work that happens after the release window Some failures only become visible when the next scheduled task runs, a queue drains, or a less common integration receives traffic. Your plan should extend to those events. For each delayed workflow, agree on: When the next meaningful execution will occur. Who will inspect the result. How a missed or incorrect outcome will be detected. Who can authorize recovery or escalation. If reconciliation runs overnight, someone needs responsibility for reviewing it the next morning. Otherwise, “we will monitor it” remains an intention without an owner. Capture enough context to investigate differences: the application revision, runtime build, relevant packages, Java version, and configuration changes. A passing result is easier to interpret when the team knows what was actually tested. Decide what recovery means before you need it “Roll back if something breaks” leaves several decisions unresolved. An application may have accepted orders, sent messages, or updated another system before a problem becomes visible. Reverting the runtime alone may not reverse those effects. Before rollout, discuss: Which failure conditions require intervention? Who makes the decision? Can affected processing be paused? What happens to queued work and transactions already accepted? How will the team reconcile records or prevent duplicate actions? Which recovery steps have been rehearsed? The right response depends on the failure, the security context, and the state of the data. It could involve a configuration correction, pausing a workflow, restoring an environment, or another controlled recovery path. Agree on that path with the people responsible for the application and the business process. Give upgrade readiness an owner Preparing this evidence takes application knowledge, technical investigation, and time. That can become difficult when the same senior developer is also handling production support, reviewing features, and answering every question about the system. Before adding work to their queue, define the responsibility that needs ownership: Prepare and execute upgrade validation for our critical workflows, document the findings, and leave the team with a repeatable release and recovery procedure. That is a clearer assignment than “help with the upgrade.” Your internal team may be able to own it with protected time. A bounded project may fit a specific migration. An experienced CFML specialist working alongside the team may help when compatibility work and release preparation must move forward while existing developers continue delivering the roadmap. Whichever approach fits, the handoff should leave behind usable evidence, documented decisions, known limitations, and an internal owner who understands the result. Bring one question to your next upgrade review What could stop working for the business even if the server starts and the homepage loads? Choose one workflow from the answer. Name its owner. Define the evidence. Agree on recovery. That gives your team a concrete way to make the next upgrade decision with greater confidence. If upgrade preparation keeps competing with feature delivery, explore Ortus Staff Augmentation to see how an embedded CFML specialist, technical leadership, or a focused workstream could support your team. Ortus Staff Augmentation Already have an upgrade or delivery gap in mind? Tell us about your application and priorities, and we can discuss the support that fits. Ortus Contact Sale Stay Connected with the Ortus Solutions Ecosystem Stay connected with Ortus Solutions and get the latest updates delivered to you. Subscribe to Our Newsletter Get the latest product releases, technical articles, tutorials, upcoming events, and exclusive content delivered straight to your inbox. Subscribe Join Our Developer Community Connect with fellow developers, ask questions, share ideas, and engage directly with the Ortus team. Join our community to stay involved in the conversations shaping the ecosystem. Join the BoxTeam Community on Slack Follow Us on Social Media Stay up to date with our latest announcements, releases, educational content, and community news. Follow Ortus Solutions on your favorite platforms: X (Twitter) Facebook LinkedIn YouTube GitHub https://www.ortussolutions.com/blog/your-coldfusion-upgrade-passed-did-your-business-workflows Thu, 22 Oct 2026 16:24:00 GMT vcampos@ortussolutions.com (Victor Campos) https://www.ortussolutions.com/blog/your-coldfusion-upgrade-passed-did-your-business-workflows Keeping Adobe ColdFusion updated is an important part of maintaining a secure and reliable application environment. But applying a ColdFusion update is not always as simple as installing the latest patch and restarting the server. Updates can include security fixes, library upgrades, JVM-related changes, changes to the ColdFusion Administrator, updated packages, bug fixes, and changes in runtime behavior. Most updates will not cause problems for most applications. But when you're responsible for a large or long-running ColdFusion application, even a small behavioral change can have unexpected consequences. That's why a ColdFusion update should be treated as a deployment — not just server maintenance. A Successful Update Can Still Affect Your Application There's an important distinction between an update installing successfully and your application continuing to behave exactly as expected afterward. A ColdFusion server can start normally. The Administrator can load. Your application can respond to requests. And something can still be wrong. A change in regular expression behavior, Java integration, component handling, security defaults, permissions, libraries, or another part of the runtime may only become visible when a particular section of your application executes. This becomes especially important with older applications. A ColdFusion application that has been running for 10 or 15 years may contain thousands of templates, components, integrations, scheduled tasks, Java dependencies, and assumptions about runtime behavior accumulated across multiple versions of ColdFusion. Nobody remembers all of them. The update is therefore only one part of the job. The other part is determining whether your application is ready for it. Security Updates Create an Important Trade-Off This becomes particularly uncomfortable when an update contains security fixes. You don't want to postpone an important security update. But you also don't want to install an update directly into production without knowing whether it changes application behavior. And if testing reveals a compatibility problem, you can suddenly find yourself in a difficult position: Do you deploy the security update and risk breaking the application, or delay the update while you investigate the problem? Neither is a particularly attractive option. The best way to avoid that situation is to discover compatibility problems before the production deployment. Before Updating ColdFusion, Know What You're Running Before installing an update, create a basic inventory of the environment. At minimum, you should know: Your ColdFusion version and current update level The Java/JVM version being used Your application server configuration Installed ColdFusion packages Third-party Java libraries and JARs Database drivers External APIs and integrations Scheduled tasks Custom JVM arguments Security-related configuration Any native or OS-level dependencies Whether the application uses older or less common CFML functionality This sounds basic, but we regularly encounter long-running applications where nobody has a complete picture of the production environment anymore. That makes every upgrade more dangerous than it needs to be. Read More Than the Security Headline If an update addresses a security vulnerability, it's tempting to focus exclusively on the security bulletin. Don't. Review the complete release notes and technical documentation. Look for changes involving areas your application depends on, including: CFML behavior. Has anything changed in functions, components, scopes, queries, regular expressions, serialization, or other language behavior? Java and JVM changes. Does the update require or recommend a different Java version? Does your application use Java libraries directly? Security defaults. Have defaults, permissions, authentication mechanisms, or protections changed? ColdFusion Administrator. Are there changes to configuration, permissions, packages, or administrative functionality? Bundled libraries. Have underlying Java libraries or other dependencies been upgraded? Bug fixes. This one is easy to overlook. A bug fix can sometimes change behavior that an application has unknowingly depended on for years. The question isn't simply: "What did Adobe fix?" It is also: "Does anything Adobe changed intersect with something our application depends on?" Never Let Production Be Your Test Environment For business-critical ColdFusion applications, updates should first be deployed into an environment that resembles production as closely as practical. That means more than checking whether the home page loads. Exercise the application. Test authentication. Run important business workflows. Test scheduled tasks. Verify database connectivity. Exercise external integrations. Check file operations. Test email. Review application and server logs. Validate Java integrations. Run automated tests if you have them. And pay particular attention to functionality that depends heavily on the ColdFusion runtime itself. The more important the application, the less appropriate a simple smoke test becomes. Automated Tests Become Extremely Valuable Here One of the best protections against update-related regressions is a good automated test suite. Unfortunately, many legacy ColdFusion applications don't have one. That doesn't mean you need to stop everything and spend six months writing tests before installing an update. Start with the workflows that matter most. Identify the functionality that would create a serious business problem if it stopped working and build tests around those areas first. Over time, that test suite becomes more than a development tool. It becomes part of your upgrade strategy. When a new ColdFusion update arrives, you can deploy it to staging, run the suite, and get a much faster indication of whether something fundamental has changed. For CFML applications, tools such as TestBox can make this process much easier to introduce incrementally. Have a Rollback Plan Before You Need One The worst time to decide how to roll back an update is after production has stopped working. Before deploying, determine: How you will restore the previous ColdFusion state Whether configuration changes also need to be reversed Whether packages or libraries changed Whether database or application changes accompany the deployment How long rollback will take Who has authority to make the rollback decision Then document it. A rollback plan doesn't mean you expect the update to fail. It means you've planned for the possibility that it could. Monitor the Application After the Update Passing your test suite doesn't mean the job is finished. Some problems only appear under real production traffic or in workflows that run infrequently. After deploying an update, pay closer attention than usual to: ColdFusion logs Application errors JVM behavior Memory usage Database connection pools Response times Scheduled tasks External integrations User-reported issues Establish a baseline before the update whenever possible. It becomes much easier to identify abnormal behavior when you know what normal looked like beforehand. Older ColdFusion Applications Require Extra Care The further an application is from its original development environment, the more important this process becomes. An application originally built for an older ColdFusion release may have survived years of incremental upgrades. That doesn't necessarily mean it is ready for the next one. It may depend on deprecated functionality, old Java libraries, undocumented configuration, legacy integrations, or runtime behavior that nobody on the current team knows about. And sometimes the developers who originally built the application are no longer there. At that point, what appears to be a ColdFusion update can become a modernization project. That's not necessarily a bad thing. It's often an opportunity to identify technical debt, improve testing, document the environment, update dependencies, strengthen security, and reduce the risk associated with future upgrades. What If You Discover a Problem? Finding a compatibility problem during testing is inconvenient. Finding it in production is much worse. If an update causes unexpected behavior, resist the temptation to immediately start changing application code everywhere. First determine where the change is coming from. Is it ColdFusion itself? A JVM change? A bundled library? A package? A security setting? An application server configuration? A third-party dependency? Or application code that was relying on undocumented or unintended behavior? Once you understand the cause, you can decide whether the right response is a configuration change, application fix, temporary workaround, rollback, or escalation to Adobe. That investigation is often where experienced ColdFusion support becomes valuable. Treat ColdFusion Updates as Part of Your Modernization Strategy If every ColdFusion update creates uncertainty, that's telling you something about the application. The long-term solution isn't to stop updating. It's to make updating less dangerous. That may mean introducing automated testing, documenting your infrastructure, upgrading Java dependencies, removing deprecated functionality, improving observability, containerizing environments, or gradually modernizing parts of the application. But there is another question worth asking: If you're already investing time and resources to keep a legacy CFML application compatible with a changing runtime, is continuing on the same runtime automatically the best long-term choice? For many years, ColdFusion teams had relatively few practical alternatives. That's no longer the case. Your CFML Application May Have More Options Than You Think BoxLang provides a modern JVM-based runtime capable of executing existing CFML applications through its CFML compatibility layer. That distinction matters. Evaluating BoxLang doesn't necessarily mean rewriting your application, converting all your CFML code, or committing to a migration. You can start by testing. Run the existing application in a controlled BoxLang environment. Exercise the same workflows you would test during a ColdFusion upgrade. Identify compatibility issues. Review dependencies. Measure performance. Determine what would need to change — and, just as importantly, what wouldn't. In fact, much of the work you're already doing to prepare for a safe ColdFusion upgrade can help answer the BoxLang question as well: What CFML functionality does the application depend on? What Java libraries does it use? What external integrations are involved? What scheduled processes need to work? What database drivers and connections are required? What functionality needs automated testing? What assumptions has the application accumulated over the years? You don't have to speculate about whether another runtime could support your application. You can test it. The result may be that staying on Adobe ColdFusion is still the right decision for your organization. Or you may discover that moving to BoxLang is considerably more achievable than you expected. Either way, you now have something valuable that you didn't have before: a choice. And having a tested alternative can fundamentally change the way you think about the next ColdFusion upgrade, licensing decision, or modernization project. Planning a ColdFusion Update? If you're running a business-critical ColdFusion application and aren't sure what will happen when you apply the next update, you don't have to find out in production. Ortus Solutions can help assess your ColdFusion environment, identify upgrade risks, test application compatibility, troubleshoot update-related issues, and build a safer path toward a supported and maintainable platform. And if you're already investing in that assessment, it may be the perfect opportunity to answer another question: Could this application run on BoxLang? We can evaluate both paths — upgrading your existing Adobe ColdFusion environment and testing your application on BoxLang — so that your next technology decision is based on evidence rather than assumptions. You don't have to decide to migrate to BoxLang to find out whether you could. Planning a ColdFusion upgrade or curious how close your application already is to running on BoxLang? Talk to the Ortus Solutions team. https://www.ortussolutions.com/blog/updating-adobe-coldfusion-isnt-always-just-installing-the-latest-patch Wed, 21 Oct 2026 12:30:00 GMT cristobal@ortussolutions.com (Cristobal Escobar) https://www.ortussolutions.com/blog/updating-adobe-coldfusion-isnt-always-just-installing-the-latest-patch Ortus Solutions today announces BoxLang AI 3.6, the release that connects the AI framework to the rest of the BoxLang productivity platform. Your agents can now drive a real browser via bx-playwright, speak and master audio via bx-audio, stream text-to-speech token by token, talk to any MCP server over stdio — and do all of it with the same fluent BoxLang syntax they always have. https://www.ortussolutions.com/blog/boxlang-ai-36-your-agent-now-has-eyes-ears-and-a-voice Tue, 20 Oct 2026 09:06:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang Community Into The Box News Releases https://www.ortussolutions.com/blog/boxlang-ai-36-your-agent-now-has-eyes-ears-and-a-voice Ortus Solutions today announces the general availability of BxAudio 1.0, the audio module for BoxLang. Synthesize instruments and drums, arrange them on a beat grid, master to a loudness target, speak text with open license voices, score a video and play sound in a game. All of it from BoxLang, on the JVM. No Python. Nothing native to install. https://www.ortussolutions.com/blog/bxaudio-10-make-mix-master-and-speak-audio-from-boxlang Tue, 20 Oct 2026 09:05:00 GMT lmajano@ortussolutions.com (Luis Majano) https://www.ortussolutions.com/blog/bxaudio-10-make-mix-master-and-speak-audio-from-boxlang Your application is slow. Something is failing. Where do you start looking? On October 28, 2026, at 11:00 AM CDT, join Luis Majano, Ortus Solutions CEO and BoxLang creator, for a live, hands-on look at how observability and AI come together in BoxLang. BoxLang Under the Lens: Observability Meets AI introduces BxLens, Lensy, and the additional monitoring capabilities of BoxLang+. See how to investigate application behavior, understand diagnostic information, and move toward proactive application intelligence. Register on Eventbrite Stop Guessing. Start Seeing. Meet BxLens, the new observability and diagnostics module for BoxLang. BxLens brings request tracing, SQL queries, HTTP calls, errors, JVM metrics, and server health into one debugging bar and operations console. During the session, Luis will explore how BxLens helps you identify bottlenecks, troubleshoot production issues, and understand what your application is doing in real time. If you’ve ever wondered what’s happening beneath a slow request or an application error, this is your opportunity to see BoxLang diagnostics in action. Get AI Insights. Stay in Control. Next, meet Lensy, your AI-powered operations assistant. Lensy analyzes diagnostics, explains problems in plain language, and recommends actions. You remain in control through explicit approvals. Luis will introduce Lensy and demonstrate how it brings AI-assisted analysis into the troubleshooting process. See the Bigger Picture with BoxLang+ The session will also demonstrate how BoxLang+ extends observability with: Multi-server monitoring Intelligent alerts Scheduled reports AI observability for agents, models, tokens, and costs Explore how these capabilities support the move from reactive debugging to proactive application intelligence, all without deploying additional monitoring agents. Join Luis for the Live Demo Get a hands-on introduction to BxLens, Lensy, and BoxLang+, with live demonstrations led by the creator of BoxLang. Webinar: BoxLang Under the Lens: Observability Meets AI Date: October 28, 2026 Time: 11:00 AM CDT Speaker: Luis Majano, Ortus Solutions CEO and BoxLang creator See what’s happening under the hood. Register on Eventbrite. Register Stay Connected with the BoxLang Ecosystem September brought exciting advancements in BoxLang, from new language capabilities and AI-powered development to modernization resources and community initiatives. And there's much more to come! Whether you're exploring BoxLang for the first time or already building with it, there's a growing ecosystem of tools, resources, and developers ready to help you take the next step. Subscribe to Our Newsletter Get the latest BoxLang releases, tutorials, AI innovations, community stories, upcoming events, and exclusive content delivered straight to your inbox. Subscribe Join the BoxLang Community Connect with developers around the world, ask questions, exchange ideas, and contribute to the growing BoxLang ecosystem. BoxTeam Slack — Connect directly with the BoxLang team and fellow developers. Community Forum — Ask questions, share knowledge, and explore community discussions. Start Exploring BoxLang Ready to dive deeper? Explore our official resources, documentation, and development tools: BoxLang — Discover the language, its capabilities, and the latest updates. BoxLang AI — Explore AI-powered development, agents, and integrations. Documentation — Access guides, references, and technical documentation. Try BoxLang — Experiment with BoxLang directly in your browser. GitHub — Explore the source code, contribute, and follow ongoing development. BoxLang Around the World. Building the Next Generation of Developers. https://www.ortussolutions.com/blog/boxlang-under-the-lens-observability-meets-ai-free-webinar Mon, 19 Oct 2026 19:59:00 GMT vcampos@ortussolutions.com (Victor Campos) https://www.ortussolutions.com/blog/boxlang-under-the-lens-observability-meets-ai-free-webinar The bx-image module can now generate and read QR codes. Two new functions, a string member function, and two new bx:image actions. No extra dependencies for you to manage. https://www.ortussolutions.com/blog/qr-codes-come-to-boxlang-images Wed, 14 Oct 2026 13:06:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang CacheBox ColdBox MVC CommandBox ContentBox CMS LogBox WireBox https://www.ortussolutions.com/blog/qr-codes-come-to-boxlang-images Ortus Solutions today announces CBSecurity 3.9, a major step forward for securing ColdBox applications. This release adds 12 ready-made security middleware that you attach directly to routes and route groups, with no firewall rules required. https://www.ortussolutions.com/blog/cbsecurity-39-12-security-middleware-for-coldbox-declared-right-on-the-route Tue, 13 Oct 2026 18:55:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang CacheBox ColdBox MVC CommandBox ContentBox CMS LogBox WireBox https://www.ortussolutions.com/blog/cbsecurity-39-12-security-middleware-for-coldbox-declared-right-on-the-route Adobe ColdFusion 2021 reaches the end of extended support on November 10, 2026. If your application still runs on this release, the time to decide what comes next is now. Adobe ended core support for ColdFusion 2021 on November 10, 2025. The current extended support period is best effort and does not include security patches or hotfixes. When it ends on November 10 2026, organizations will no longer have that support option from Adobe for ColdFusion 2021. What does the end of extended support mean? The date does not mean that your application will suddenly stop working. Your ColdFusion server may continue running as it does today. The change is that you can no longer count on Adobe’s extended support for that release if you encounter a problem. In practical terms, that can affect your ability to: Get help from Adobe diagnosing a ColdFusion 2021 issue. Receive a hotfix if a product defect affects your application. Get a security update for a newly discovered vulnerability in that release. Rely on Adobe to help resolve issues that arise as your operating system, Java version, database, or other infrastructure changes. ColdFusion 2021 already passed the end of core support in 2025. Adobe identifies Update 23 as the final update for the release. The end of extended support therefore marks the end of the additional, best-effort assistance period; it does not mark the first day without security patches. This does not mean every application will fail or that a security incident is inevitable. It means your organization will have fewer options for vendor assistance if something goes wrong, and will need to manage the technical and security risks itself. That may involve additional monitoring, compensating security controls, in-house troubleshooting, or moving to a supported platform. Older ColdFusion versions may already be outside support If your application runs on a ColdFusion version older than 2021 and you have not taken action, check its lifecycle now. You may already be operating outside the version’s support period, without a current upgrade or migration plan. Running unsupported software does not automatically mean your application has been compromised. It does mean that you may not receive fixes for newly discovered problems, and that your team could have to investigate or mitigate issues without help from the vendor. That creates risk for security, uptime, maintenance, and future modernization work. Your application will keep running. The risk does not go away. The impact depends on your system. A stable application with strong internal expertise and security controls may be manageable in the short term. A business-critical application with limited documentation, aging infrastructure, or few people who understand the code may need more urgent attention. A migration or upgrade also takes planning. Teams may need to review custom code, third-party libraries, Java versions, integrations, infrastructure, and testing coverage. Starting that work only when support ends can leave too little time to evaluate options and test changes. Choose a path that fits your application There is no single right answer for every ColdFusion system. Depending on your application, team, and timeline, you might: Stabilize and maintain the application while planning a longer-term modernization. Evaluate BoxLang as an alternative runtime for CFML applications. Modernize selected parts of the system incrementally. BoxLang supports CFML through its compatibility capabilities, which can make it a migration option for some applications. Compatibility depends on the application’s code, frameworks, libraries, and integrations, so a technical assessment should come before any migration decision. Start with an assessment Ortus Solutions helps teams troubleshoot and support ColdFusion applications, assess modernization options, and plan migrations. We can review your current version, application dependencies, infrastructure, and business constraints, then help you identify a practical next step. If you are running ColdFusion 2021, or an earlier release, do not wait for the deadline to start planning. Schedule a free 30-minute assessment with Ortus Solutions. Sources: Adobe ColdFusion 2021 support timeline · ColdFusion 2021 updates https://www.ortussolutions.com/blog/acf2021-extended-support-ends-on-november-10-is-your-application-ready Tue, 13 Oct 2026 15:27:00 GMT cristobal@ortussolutions.com (Cristobal Escobar) https://www.ortussolutions.com/blog/acf2021-extended-support-ends-on-november-10-is-your-application-ready Ortus Solutions today announces the general availability of TestBox 7.2, the biggest TestBox release in years. Built on the new bx-playwright 1.0 module, BoxLang specs can now drive a real browser, assert with web-first matchers that wait until they pass, and keep the screenshots, traces and videos of every failure. Around it, TestBox gains spec retries, a Run Failed option, a rebuilt set of HTML reporters with Ask AI on every failure, and a new Agent reporter that lets AI agents read a test run at minimal token cost. https://www.ortussolutions.com/blog/testbox-72-real-browser-testing-smarter-reports-and-agent-ready-results Tue, 13 Oct 2026 15:00:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang IDE OpenSource Releases TestBox https://www.ortussolutions.com/blog/testbox-72-real-browser-testing-smarter-reports-and-agent-ready-results Ortus Solutions today announces the general availability of bx-playwright 1.0, fluent browser automation and testing for BoxLang, powered by Microsoft Playwright. It ships alongside TestBox 7.2 and ColdBox 8.3, which bring real-browser testing straight into your specs. Drive Chromium, Firefox and WebKit, test full user journeys, render PDFs and images, and give your AI agents a real browser to verify the BoxLang applications they build. https://www.ortussolutions.com/blog/bxplaywright-10-real-browsers-fluent-boxlang-built-for-ai-agents Tue, 13 Oct 2026 15:00:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang CacheBox ColdBox MVC CommandBox ContentBox CMS LogBox WireBox https://www.ortussolutions.com/blog/bxplaywright-10-real-browsers-fluent-boxlang-built-for-ai-agents Ortus Solutions today announces the general availability of ColdBox 8.3, a feature release focused on real-browser testing and route composition. Annotate a BaseTestCase spec with @browser and drive a real browser against your running ColdBox application, with named route helpers that know your routes. And with the Playwright driver behind it, the same browser can render PDFs and screenshots of your ColdBox views. This release also brings named route middleware with registerMiddleware(), route metadata shared by a whole group(), integration tests that run route middleware like a real request, and thread-safe WireBox scope wiring. https://www.ortussolutions.com/blog/coldbox-830-test-and-render-your-app-with-a-real-browser Tue, 13 Oct 2026 15:00:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang CacheBox ColdBox MVC CommandBox ContentBox CMS LogBox WireBox https://www.ortussolutions.com/blog/coldbox-830-test-and-render-your-app-with-a-real-browser Sentry 2.2.0 Released! Sentry 2.2.0 brings tracing, structured logs, metrics, browser feedback, and a handful of welcome fixes to your CFML and BoxLang applications. There’s quite a bit packed into this minor release! And yes, it is a minor release. Your existing error reporting continues to work, and all of the new integrations are opt-in. You can upgrade for the bug fixes without turning on anything else. Let’s get to the changes. What’s New? See where the time goes Getting an exception into Sentry is helpful. But sometimes the problem is a request that takes five seconds and doesn’t throw an exception at all. Which query was slow? Did we miss the cache? Were we waiting on another service? This release adds tracing for requests, queries, background jobs, CacheBox operations, and outbound HTTP calls. These spans give you a breakdown of the work happening inside a transaction. You can enable request tracing in your ColdBox configuration: moduleSettings.sentry = { DSN: getSystemSetting( "SENTRY_DSN", "" ), environment: "production", release: "my-app@1.0.0", enableRequestTracing: true, tracesSampleRate: 0.1 }; This example samples 10% of requests. Adjust that rate for your application’s traffic and your Sentry usage. You can also wrap your own application code in a span: sentry.withSpan( "load inventory", function( span ) { return loadInventory(); } ); Now that operation has a name and a duration in the trace. Much easier to investigate than “something in this handler is slow.” Query tracing Database queries are often a good place to start when tracking down a slow request. Sentry 2.2.0 adds query instrumentation through runtime listeners and compatible qb hooks, depending on your engine and installed versions. For direct queries, you can use withQuerySpan: result = sentry.withQuerySpan( sql, function( span ) { return queryExecute( sql, parameters, options ); }, "postgresql" ); The wrapper records the query’s duration and status while preserving the callback’s result or exception. SQL literals are scrubbed, and bindings and result data aren’t collected. The automatic integrations have some runtime requirements, so check the documentation before enabling them. The manual wrapper is useful wherever you need explicit coverage. Background jobs, caches, and external calls The work doesn’t always end when the request does. Queue tracing can connect a job back to the request that scheduled it, with separate measurements for waiting and processing. Cache instrumentation records hits and misses without collecting the cached values. HTTP wrappers let you measure calls to other services and propagate trace headers to configured destinations. These integrations help answer some very practical questions: are jobs spending their time waiting or working? Is the cache helping? Is our application slow, or is the service it calls slow? Structured logs, metrics, and check-ins There are also new APIs for structured logs and metrics: captureLog sends structured diagnostic messages. counter, gauge, and distribution record measurements. withMonitor reports check-ins for scheduled work. For example, you can wrap an hourly task like this: sentry.withMonitor( "hourly-work", function() { return performWork(); }, { schedule: { type: "interval", value: 1, unit: "hour" }, checkin_margin: 2, max_runtime: 10 } ); This gives Sentry the schedule and matching check-ins for the work. Logs, metrics, and monitors have separate enablement settings, so you can choose which ones to add. Available monitor features depend on your Sentry plan. Browser Feedback, Screenshots, and Replay A bug report that says “it didn’t work” can leave you with a lot of questions. What page was the user on? What had they entered? What happened just before the problem? The new browser companion adds a feedback widget with screenshots and session replay, along with browser tracing and supported Web Vitals. The release includes built browser assets, so a plain CFML or BoxLang layout can use them without adding a Node build to the application. Bundler-based applications can use the included browser sources instead. The widget supports keyboard and touch interaction, screenshot review and removal, and retries when delivery fails. Your application decides who is eligible to use it, which makes it possible to start with a small group of users. There’s an important detail here: opening the feedback widget uploads the recent replay buffer. The message and screenshot are uploaded when the user submits the report. The widget explains that behavior to the user. Capture uses conservative masking by default. If you want ordinary page content and form values to be readable, that requires an explicit capture policy. Review that policy for your application before enabling it. Bug Fixes There are several fixes for existing error reporting as well: Fixed a race where concurrent exception capture could access the Sentry singleton before initialization finished. Fixed timestamp generation so UTC ISO timestamps and epoch timestamps agree on CFML and native BoxLang. Improved stack-trace handling when a source file can’t be found. Made rewritten index.bxm URLs behave consistently with index.cfm URLs. That last one came from a real report. The module already removed /index.cfm from rewritten request URLs, but it didn’t do the same for /index.bxm. A request for /foo/bar could therefore appear in Sentry as /index.bxm/foo/bar. Now both root front controllers are handled consistently. The release candidate also passed all 13 engine/framework CI combinations, browser tests and builds, and formatting checks. Getting Started Install Sentry 2.2.0 with CommandBox: box install sentry@2.2.0 If you already use the module, your existing configuration can stay in place. Pick an integration that would help you understand your application and start there. There’s no need to turn everything on at once. You can find configuration examples and integration requirements in the observability guide. As always, issues and pull requests are welcome. I’d love to hear what you’re using it for! https://www.ortussolutions.com/blog/sentry-220-released Thu, 08 Oct 2026 19:59:00 GMT vcampos@ortussolutions.com (Victor Campos) https://www.ortussolutions.com/blog/sentry-220-released Ortus Solutions today announces the official release of the BoxLang package for Sublime Text 4, the newest member of the BoxLang productivity tool suite. https://www.ortussolutions.com/blog/boxlang-for-sublime-text-released Thu, 08 Oct 2026 14:20:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang Community Into The Box News Releases https://www.ortussolutions.com/blog/boxlang-for-sublime-text-released Ortus Solutions today announces the general availability of RuleBox 2.0.0, a modern, natural-language rules engine for BoxLang and ColdBox applications. It is a BoxLang-only rewrite, and it ships with rules as data, declared rulebooks, dry runs, an audit trail, and a built-in Rule Visualizer. https://www.ortussolutions.com/blog/rulebox-20-a-natural-language-rules-engine-for-boxlang-and-coldbox Wed, 07 Oct 2026 11:01:00 GMT lmajano@ortussolutions.com (Luis Majano) BoxLang CacheBox ColdBox MVC CommandBox ContentBox CMS LogBox WireBox https://www.ortussolutions.com/blog/rulebox-20-a-natural-language-rules-engine-for-boxlang-and-coldbox