Feature Requests

Hello, is the coming up release of ColdFusion 2025 updates will bundle the newer version of log4j 2.25.5? There is currently a vulnerability right now with log4j and solr.war version 2.25.4.Thanks,Thao

A recent CF update requires to you to tweak the security-settings.json file if you are making outbound private network calls. If not configured correctly, your call will fail with only a log entry (This URL is not permitted by the outbound network security policy. To allow this connection, add it to outboundNetwork.allowList in security-settings.json or to this.security.outboundNetwork.allowList in Application.cfc).Instead of just making a log entry, it should actually throw an error.  We track any error thrown and email us the info so it can be fixed quickly.  One of our scheduled task was affected by this and CF silently made a log in the log file that my task is “suspended” because of the outbound call block.  Had it thrown an error instead, then it would have been caught and taken care of much quicker.Can we please throw an error if this happens?

I worked for quite some time to try to create a devcontainer setup that would: Allow me to use code completion and linting Allow me to use linting Allow me to use the Security Analyzer.The first two are easy. You need a specific environment, but you don’t need to set up a server or a project. The Security Analyzer appears to require: A specific environment A server RDS, with an account. A project. Setting up a project within a devcontainer is deeply unpleasant. You have container within a container, and it appears to require you to use a VS Code project, as well as the extension’s own project files. I tend to avoid using VS Code Workspaces with devcontainers in general, because I run into conflicts between the two.I got a far as the setup below. With this and a bunch of manual setup, I think I could possibly arrive at an environment where the Security Analyzer would work, but it would be a lot of labor, and very finicky. I want something I can hand off to another developer, and the onl

I want to check bug reports in this new category