Breaking Changes ⚠️

Dropped support for older CFML engines (Adobe ColdFusion 8 and below). Tested against Lucee 5+; should work on ACF 2016+.
Complete rewrite of the entire codebase (no intentional functional breaks beyond the engine drop).

New Features

OpenAPI/Swagger JSON generation plus links from the dashboard and docs UI to the generated swagger JSON.
- Add hint metadata attributes to your components, functions, and arguments to control the generated OpenAPI spec. See the docs for details.
Input constraint documentation new taffy_minlength, taffy_maxlength, taffy_min, taffy_max, and taffy_pattern metadata on resource method arguments. Display-only (Taffy does not enforce), useful for generated docs.
Dashboard resource sorting sortable by matching order (previous default), Alpha by URI, or Alpha by Name (new default). User preference persisted in LocalStorage.
variables.framework.allowGoogleFonts (default: true) opts into Atkinson Hyperlegible for dashboard/docs; disable to fall back to system fonts.

All CFCs migrated to full cfscript.
jQuery, Bootstrap, and LessCSS removed from dashboard/docs in favor of vanilla JS + CSS.
Dashboard UI redesigned.
Generated API docs redesigned to match the dashboard.

Now testing against Lucee 5, 6, and 7; fixed various compatibility issues across versions.
Default returnExceptionsAsJson to false to prevent inadvertent stack trace disclosure.
Exception log adapter config was visible in the dashboard config modal and could leak API keys/secrets. Now shown as "redacted".
Fixed inverted cache timing calculation (one branch computed startTime - endTime, producing negative values).
Fixed queryToArray polyfill return type (declared struct, implementation returns array).
Fixed isInstanceOf in factory.cfc failing on Lucee (mapped-path metadata traversal).
Worked around Lucee metadata-checking oddities.
Fixed regression: query params configured in the dashboard weren't sent with the request.
Fixed 3 bugs in the script-based api.cfc that broke all e2e tests.
Docs correction: exceptionLogAdapter default is LogToDevNull, not LogToEmail.

Test suite completely rewritten and updated to latest Testbox.
Replaced stub ConfigurationSpec tests with real assertions.
Added end-to-end HTTP tests via cfhttp. New test API app (tests/testapi/) with echo resources. Covers GET/POST/PUT/DELETE, URI token extraction, JSON deserialization, custom headers, 404/405 responses, and X-HTTP-Method-Override tunneling.
E2E compatibility fixes across Lucee 5, 6, and 7 (byte-array fileContent on L5, getDirectoryFromPath() trailing-slash behavior on L7, charset encoding, output whitespace leakage).
Lucee 7 CI fix: CFConfig doesn't support Lucee 7, so added a taffy symlink in the webroot so extends="taffy.core.api" resolves at compile time without the mapping.
box.json bumped to 4.0.0.