Beta 5

Cumulative updates; everything new in 4.x so far:

• Bug Fixes
  • Fix inverted cache timing calculation - one instance was computed as (startTime - endTime), producing a negative value.
  • Fix queryToArray polyfill return type - Function signature declared struct but the implementation returns an array.
  • Docs: exceptionLogAdapter default - Documentation incorrectly said LogToEmail; actual default is LogToDevNull and has been for quite some time.
  • Fix: if you use an exception log adapter, its config was available on the dashboard, which possibly leaked api keys/etc. The config modal on the dashboard now shows "redacted" if you have exception log adapter config rather than the contents of that config.
• Improvements
  • Dashboard resources are now sortable by matching order (this was the only way, previously), Alpha by URI, and Alpha by Name. New default is alpha by name. Your selection is persisted in LocalStorage.
  • Added support for taffy_minlength, taffy_maxlength, taffy_min, taffy_max, and taffy_pattern metadata on resource method arguments. These are DISPLAY ONLY - Taffy does not enforce them. But they are handy for documentation.
  • Added Atkinson Hyperlegible from google fonts. By default the docs and dashboard now use Atkinson Hyperlegible -- a font designed for accessibility -- from Google Fonts. I realize not everyone wants to allow google fonts usage, so you can disable it with variables.framework.allowGoogleFonts (default: true). Doing so will fall back to more typically available system fonts.
  • Updated generated API docs to use the same design as the new dashboard
  • Replace evaluate() with invoke() for setter-based DI - evaluate() is a known injection vector and anti-pattern. invoke() is the modern CFML approach. Pretty sure the evaluate approach was a relic of old ACF/Railo support that we no longer maintain.
  • Replace duplicate logic for handling detection of docs/dashboard requests with reusable handleDashboardRequest().
  • Decouple baseSerializer from application scope - noData() no longer reads application._taffy.settings directly. Added instance variable with setter, injected by the framework. Enables standalone unit testing without mocking the application scope.
• Removed
  • Remove dead Railo references - No need to keep structKeyExists(server, "railo") checks.
• Tests
  • Add end-to-end HTTP tests - New test API app (tests/testapi/) with echo resources and e2e spec making real cfhttp requests. Covers GET/POST/PUT/DELETE, URI token extraction, JSON deserialization, custom headers, 404/405 responses, and X-HTTP-Method-Override tunneling.
  • Fix e2e test compatibility across Lucee 5, 6, and 7 - Handle byte array fileContent on Lucee 5, getDirectoryFromPath() trailing-slash behavior on Lucee 7, charset encoding, and output whitespace leakage.
• CI
  • Fix Lucee 7 CI - CFConfig (which applies the /Taffy CFML mapping from .cfconfig.json) doesn't support Lucee 7 and is uninstalled. Added a taffy symlink in the webroot so extends="taffy.core.api" resolves at compile time without the mapping.
• Housekeeping
  • Update box.json version to 4.0.0.

4.x.x Breaking changes! ⚠️

The only intentional breaking change is dropping support for older CFML engines/versions.

This release is a COMPLETE REWRITE of almost the entire codebase. In the process, we're finally stepping away from support for Adobe ColdFusion 8. If you're still on that version, God help you.

I was testing against Lucee 5.x because that's the earliest CFML engine I have at my disposal easily right now. In theory it should be compatible with ACF 2016+, possibly earlier. If anyone wants to figure out what the minimum capable ACF version is, that would be nice.

• All CFC's have migrated to full-cfscript
• jQuery, Bootstrap, and LessCSS have all been removed in favor of vanilla JS+CSS (dashboard + docs)
• Test suite completely rewritten and updated to latest version of Testbox
• Dashboard design overhauled... It's the same, but different.
• Generated API docs got the same treatment as the dashboard