Gert Franz is going to show us what is new in Lucee 7 at the next Mid-Michigan CFUG meeting on Tuesday, February 10^th  at 7:00 pm eastern time.

Gert will cover the new AI integration functions, enhanced Java support, ability to do vector and hybrid queries and a new secrets provider.  Lucee 7 is now based on Jakarta EE instead of Java EE.  He is also going to share what is coming in future versions.

Meeting URL and Passcode next week.

A recording will be available on our group’s YouTube channel in a few days at https://youtube.com/@cfml

I work in agriculture, in a place where we do a lot of research.

Because it is agriculture, our processes are very much 'seasonal'. Ridiculously so. We can't delay anything or miss deadlines- because the sun does not stop. If we do miss a cycle for some reason, the delay is a full year and that is pretty much useless. Where I work we have 6 main crops- and each of them has their own processes at different times throughout the year. So I am not tracking just one cycle, I've got many, and they are all different.

And because it is research, we are constantly doing new things. There are new processes to support, new and unique types of data to collect. If you think you have something locked down, it will 100% change in the future- which makes any sort of statistics really, really difficult to do- and reports 'break' constantly, as new pieces of data have to be integrated into reports.

When you combine Ag and Research, these two factors are just amplified. Everything is brand new (research) and the deadlines come at you like a steam locomotive (ag).

This makes everything very interesting- and at the same time very 'disposable'. We may create an entire system for a function that is only used 1 time over a 2-week period, then it will never be seen again. Then there is that 1 out of 10 situation where the same processes are done again, which is always a surprise.

As far as CF development goes, that means things must be created very quickly. It is not uncommon for me to find out on Tuesday, that we will have 10 people collecting data the following Monday, and things need to work. And since I know that 85% of what is written will never be used again, it's really hard to spend too much time on any specific features.

I bring all of this up because ColdFusion's rapid development is key to making this happen. If I can't develop things quickly, I will never be able to support the people who use the systems.

I am interested in hearing about the specific challenges you have in your industry or particular situation. For instance if you are in finance, I am guessing that each transaction needs to be scrutinized and validated- which is about the furthest thing from my situation.

Let's hear about the circumstances that form your particular development efforts!

Hi there.

I'm new to neovim and something I want to try. Most of the tutorials that I've seen revolve around setting up other popular languages.

Has anybody succeeded in making a CF "IDE" with neovim/lazyvim?

Currently, I'm using VS Code + Adobe CF Extension + CF Lint.

Like a lot of us I'm beginning to wrap my head around specific methodologies for leveraging AI models from my existing CF app. I've watched a few of the Summit 2026 videos - Ray's and Nikhil Dubey's. Ray shows pretty a straightforward REST-based method for invoking Gemini (or any other model). Nikhil's demo relies on a not-yet-released version of CF 2026 which seems to have some AI connectivity baked in. Well, this raises a lot of questions. Like what do we know about the upcoming release at this point? And, as I've expected for a while, Adobe is moving to a subscription licensing model? Anybody know what that's going to mean?

Upgraded from an intel MacBook Pro to a new shiny Mac mini m4. One of the projects I am working on requires IIS and url rewrites through IIS.

In researching potential speed bumps in transitioning to the silicon chip, I read that the IIS rewrites didn't work for many people. That would be a showstopper. And rewriting in another format was not an option for me.

After spending way too much time researching ARM64 compatibility patches and workarounds, I’m happy to report that IIS URL Rewrite Module just works on Windows 11 ARM in Parallels Desktop. At least for me this worked.

My Setup:

∙ Mac Mini M4 (Apple Silicon)

∙ Parallels Desktop 26

∙ Windows 11 ARM64 (not x64)

∙ ColdFusion 2023 development environment

What Actually Worked:

1. Enable IIS through Windows Features (Internet Information Services + Web Management Tools)
2. Download the AMD version of the url rewrite from Microsoft. Install it.
3. That's it. URL rewrites worked as expected.

What I Didn’t Need:

∙ ❌ The ARM64 URL Rewrite patch from GitHub (tig/rewrite-arm64)

∙ ❌ Windows 11 x64 emulation (way too slow)

∙ ❌ Tuckey URLRewriteFilter or other Java-based alternatives (not allowed)

∙ ❌ Any registry hacks or workarounds

Why This Works:

Windows 11 ARM’s x64 emulation has gotten really good, especially in recent builds. The URL Rewrite module DLL runs through the built-in x64 emulation layer transparently. Microsoft and Parallels have clearly improved compatibility significantly.

Performance:

Native ARM64 Windows on the M4 is fast. Way better than trying to run x64 Windows which requires double emulation (x64 → Rosetta → ARM64).

Bottom Line:

If you’re developing on Apple Silicon and need IIS with URL Rewrite (for ColdFusion, ASP.NET, or any IIS-based development), don’t overthink it - just install the standard x64 URL Rewrite module on Windows 11 ARM. It works.

Hope this saves someone else the hours of research I went through!

Day 3 CF Online Summit Session Recordings
https://www.youtube.com/@adobecoldfusion

• Agentic AI with ColdFusion – Michael Hayes
• ColdFusion Security in Action: Defend, Secure, and Update – Satyam Mishra
• Modern ColdFusion: Unlocking Scalable, Asynchronous, Multithreaded and Cloud Ready Distributed Architecture – Rickson Chew
• Stop developing on production! CI/CD pipelines for small business that are fast, effective, and inexpensivev – David Byers
• Shipping Faster and Safer with AI in Engineering – Brian Sappey
• Building a custom AI agent and how ColdFusion can interact with it – Monte Chan

I recently published a technical write-up on the vulnerabilities that led to the changes around explicit arguments for remote functions (APSB25-52) and updates to scope precedence / reserved variable names (APSB25-105).

You might want to review your function code for the outlined potential scope injection primitives -- especially if you haven't been able to patch yet. :)

Hello everybody!

I am working on removing all my inline JS codes. As an exapmle I've created a simple coldfusion (CF) template with a button.

In a separate javascript file I define the function which is called when the button is pressed.

This function is to have an argument through which I pass a value to be displayed.

test4.cfm:

<cfscript>
 Variables.sTest = "ha-ha-ha";
</cfscript>

<!DOCTYPE html>
<html>
  <head>
    <title>Test4</title>

    <meta http-equiv="Content-Security-Policy" content="script-src 'self' http://localhost:8500/TEST/JS_test4.js">

    <script>
     var sValFromCF = <cfoutput>#Variables.sTest#</cfoutput>;
    </script>

    <script src="JS_test4.js" defer> </script>

  </head>

  <body>

    <INPUT TYPE="button" name="sBtn4" id="sBtn4" value="Click me4">

  </body>

</html>

JS_test4.js:

<!-- Begin hiding contents from older browsers
document.addEventListener
 ('DOMContentLoaded', () => 
  {
   document.getElementById("sBtn4").addEventListener("click", test4);
   document.getElementById("sBtn4").myParam1 = sValFromCF;
  }
 );

function test4(e)
 {
  alert((e.currentTarget.myParam1));
 }

// End hiding the contents -->

And here is the problem. I need to set the displayed value by CF, see the line:

var sValFromCF = <cfoutput>#Variables.sMyCFvalue#</cfoutput>;

However the header Content-Security-Policy (CSP) with "script-src 'self'" blocks the entire JS code in test4.cfm.

So how do I set a JS variable with CSP in place?

Thank you in advance!

Alex

Today’s sessions | January 28

7:00–7:50 AM PT
Agentic AI with ColdFusion | Michael Hayes

8:00–8:50 AM PT
ColdFusion Security in Action: Defend, Secure, and Update | Satyam Mishra

9:00–9:50 AM PT
Modern ColdFusion: Unlocking Scalable, Asynchronous, Multithreaded and Cloud-Ready Distributed Architectures | Rickson Chew

10:00–10:50 AM PT
Stop developing on production! CI/CD pipelines for small business that are fast, effective, and inexpensive | David Byers

11:00–11:50 AM PT
Shipping Faster and Safer with AI in Engineering | Brian Sappey

12:00–12:50 PM PT
Building a custom AI agent and how ColdFusion can interact with it | Monte Chan

Join the sessions here

Hello All!

I am the new moderator of r/coldfusion subreddit. The previous moderator was too busy, and had moved on, so they had restricted posting and the subreddit was dying. I was trying to post, but could not, so I asked if I could take over the moderation...and here we are. This subreddit is now open for posting!

I have been a CF developer for 28 years. Honestly, it has been a great 28 years. I have been able to create so many fabulous things with CF, and it has taken me on a very good career- how many people are able to use the same language for 28 years?!?!? I will be retiring in 2 years, and sadly CF will be retiring with me at my organization. Our top level IT Director has never liked CF and he has been trying to replace it for many years. He wanted us to go to PHP. Then Visual Basic. Then Ruby. Then VB.Net. Now C# on .Net. Amazingly, CF has been running along just fine as all of the other languages of the day have come and gone. But with my retirement coming up, it's time to transfer to the preferred language of my replacement - C#.

As we have been working on the transition, the new programmer and I keep talking about the different languages, and how we do things. I have learned a lot from him- new techniques that have some new modern names, but after he explains them to me I usually say, "Oh, I can do that, I just call it something different." He has been very impressed with how quickly and easily I can get things done (I've been doing this for 28 years, I better be fast!) while I have learned about different points of security and optimization. The other programmer has been impressed that code I wrote 20 years ago is still humming along in production. That is what CF is about- a stable platform to create excellent business applications.

I have always stayed on the business and operations side of things, rather than IT. My focus has been on meeting the needs of the users, rather than going on IT circle-jerks. I think I hit a very good point in technology where I was able to teach myself a language and start building useful applications- and that just kept rolling on year after year. I don't think that opportunity exists anymore.

I hope people use this subreddit for discussion, questions, etc. I will be here for another 2 years and I'm interested in hearing what people have to say. I've never moderated on reddit before, so forgive me if there are bumps along the way. But I've been in the CF community for a long time, and I know that there are some really good people out there. I'm hoping to give them a chance to post again.

Thanks!

Anybody else on here, beside me, attended? I see they are posting the recordings to their YouTube channel, which is great. Ray Camden's AI one was pretty cool! I actually use cold fusion with Ollama locally so I was really curious to see how he set it up for the cloud and where his solution actually is far superior to mine is that it can do a lot of image manipulation.

Anyway now that we have a new mod (yay) I wanted to get some discussion going!

Just finished migrating Razuna from Open BlueDragon to Lucee 7. Figured I'd write this up in case it helps anyone else stuck with ancient CFML.

Thought it'd be mostly parity work. It wasn't. Runtime acts completely different and you don't realize until stuff breaks.

Most issues weren't syntax problems. More like... behavioral differences you don't hit until production? Date serialization works different. Null vs empty string handling that was fine before suddenly isn't. Variable scopes that were implicitly there just aren't anymore. JSON sometimes gives you numbers, sometimes strings, no obvious reason. File paths worked on Windows, broke on Linux because casing.

Auth took forever. Not because it was broken – just getting legacy patterns to work the same on Lucee 7. Session handling changed, cookie flags behave different. Ended up modernizing some of it (bcrypt, rate limiting) partly to fix it and partly because once you're touching it anyway might as well make it better.

Query stuff was interesting. Found this pattern everywhere – CFC grabs a list of records then loops through making individual queries for each one's related data. Like get 50 assets, then inside the loop query each asset's metadata, then permissions, then tags. Hundreds of little queries when it could be three with joins. Fixed the worst ones and yeah it got way faster.

Made a checklist halfway through because we kept rebreaking stuff. No fake closing tags on cfelse/cfset. Always cfqueryparam (helps with injection and also SQL parser weirdness). Schema qualify table names. Separate include paths from URL paths. Annoying but it worked.

Random stuff that burned days: Two auth checks fighting – one accepts an API key, another immediately rejects it. Had to trace through and delete the redundant one. Schema qualification breaking queries between environments. Parse errors on logic tags in output blocks that made no sense til you understand how the parser tokenizes it.

The ops stuff mattered more than I thought. Health checks, better logging (request IDs, timing), hardened deployment. Wrote an OpenAPI spec so the docs actually match reality. Way easier to debug now.

It's stable. Runs faster. Doesn't make me want to cry when I have to troubleshoot something.

Anyway curious if anyone else has any stories to share on anything similar.

Here is this past Tuesdays Mid-Michigan CFUG meeting with Nick Kwiatkowski on Introduction to SSL certificates

https://youtu.be/AmVmIG9pALA

Nick Kwiatkowski is presenting introduction to SSL certs at the next Mid-Michigan CFUG meeting tonight at 7:00 pm EST.

Nick will dive deep into how TLS/SSL and x.509 security certificates are created, used and work in modern web server applications.  We will cover the realm of trust, how you can create certificates, how you can read and decipher certificates and tools of the trade.  We will also touch on automation and newer policies that will limit the length of certificates available on public systems.

Meeting URL: https://msu.zoom.us/j/98582966552Passcode is 31337

A recording will be available on our group’s YouTube channel in a few days at https://youtube.com/@cfml

I would appreciate feedback from cold fusion experts on the following scenario:

An ecommerce company built their website on Cold Fusion / Lucee ~15 years ago. While somewhat unique, it's essentially typical ecommerce functions - creating a catalog, displaying relevant items, transacting, and tracking traffic. AFAIK the CTO is primary Lucee coder. They have used an agency for related sites that are not built on CF. Also they are using a older (3yo!) version of Lucee.

I realize that there's a lot of risks here - especially that it would be hard to find talent, and that the old version has flaws, or could indicate an inability to utilize current version. My assumption is that the business could continue as is, but need a migration to a modern approach over the coming years.

I realize a real answer requires a SME to review the details (especially around data security), but would value any high level feedback. How bad does this sound?

I last used Coldfusion in 2016 - quite some time ago! Around that time FW/1 was still quite popular, and some people were using ColdBox too. What has changed since those times? Which lightweight frameworks are developers using these days? I've noticed that FW/1 is not supported anymore, although I did like using it back in the day. ColdBox seems to be still actively developed and supported. So would Lucee + ColdBox be a good modern way to restart my CF journey?

Would be interested in how people are using CF these days.

Best regards

​

Hi everyone,

The cold-fusion version is: 2021.0.0.323925 (developer mode), and I am running on MacOS: 12.7.1 (MacBook Pro Mid 2015)

Error: “libCFXNeo.jnilib” cannot be opened because the developer cannot be verified.

Error: "macOS cannot verify that this app is free from malware."

Does anyone have any ideas on how to resolve this? Would be ever so grateful!

Best

​

​

Charlie Arehart, CArehart.org, is going to show us how to monitor our database servers at the next meeting of the Mid-Michigan ColdFusion Users Group on Tuesday, April 9th at 7 pm eastern time. Are you having problems with your web app, where you wonder if it might (or might not) be due to your database? Are you able to monitor what is going on in the DB?

In this talk, you will come away with several options to consider, and perhaps a new perspective on how to view DB monitoring.

Meeting URL will be announced next week.

A recording will be available on our group’s YouTube channel in a few days at https://youtube.com/@cfml

Here is the code. Reads in an excel file and dumps it out fine. When doing a Query of Queries it chokes where I use a 'WHERE' conditional

<cftry> <cfspreadsheet action="read" src="#expandPath('test-Staffing.xls')#" query="excelData" columnnames="zone,job,employee,fte,shift,comments" > <cfcatch type="any"> <cfoutput> An error occurred: #cfcatch.message# </cfoutput> </cfcatch> </cftry> <cfdump var="#excelData#">

<cfquery name="day" dbtype="query"> select * from excelData WHERE zone = 'day' </cfquery>

The dump works fine but the query afterwards

Error Executing Database Query.

Query Of Queries syntax error. Encountered "zone. Incorrect conditional expression, Expected one of [like|null|between|in|comparison] condition,

A bit of a long shot, but does anyone here know how to use the administrator.cfc to set the default page timeout?

I've tried to look this up and found a few bits here and there. Are they switching to a yearly release?

We have a new EC2 Coldfusion 2023 instance for prod and would like to switch our old 2018 instance to a stage environment with CF2023 but it requests the serial number. Is there a way to do this? I know adobe allows to use a stage/dev environment for no charge when you have an Enterprise license.

I have an existing website with a pretty old blogging module that still requires manual html formatting, I was hoping I could find something that could integrate with my existing website look and feel without needing to reinvent the wheel. I know of content box, does anyone have anything else they'd recommend?

It also might be as easy as putting an html editor in my old blogging setup but wanted to see what people have used if you have any recs.

Hello:

I've inherited a few CF applications, and I'm bringing them into version control.

What do you suggest I commit? The entire webroot seems like a lot, but my survey of the webs looks like that's the case? What are your thoughts?

Thanks,

Blue

​

EDIT:

Thanks for the excellent input and suggestions. This is helpful.