Adobe Coldfusion 2023 patch 26 breaks Wheels

[mikegrogan]

I think this would apply to ACF 2025 as well. This is an Adobe issue! But i spent the last 30 minutes debugging, so I figured I'd share in case anyone else just upgrade to the lastest patches.

I figured it out thanks to @carehart as always.
https://www.carehart.org/blog/2026/10/14/coldfusion_updates_released_oct_13_2026

https://tracker.adobe.com/#/view/CF-4234761
https://tracker.adobe.com/#/view/CF-4234762

The latest release has a regex issue. After upgrading to patch 26 my wheels application was trying to load my login action under "main" controller. However it was looking for "umain". It had renamed the "main" to "umain".

I finally tracked down the issue to a regex at

wheels/vendor/wheels/Dispatch.cfc

Line 1363 in 1ab638c

local.rv.controller = ReReplace(local.rv.controller, "[^0-9A-Za-z-_\.]", "", "all");

. This even goes back to Wheels 2.5. We have one last site on 2.5 and it's broken there too.

[mikegrogan]

Upon further review this is actually the correct line that causes the issue

wheels/vendor/wheels/engineAdapters/Base.cfc

Line 184 in 1ab638c

local.cName = ReReplace(local.cName, "(^|-)([a-z])", "\u\2", "all");

issue referenced here: https://tracker.adobe.com/#/view/CF-4234761

[bpamiri]

Thanks Mike — confirmed, and thanks for the precise pointer to the ReReplace case-escape line.

Adobe's Oct 13 updates (CF2023 update 26 / CF2025 update 14) broke regex replacement case escapes: Wheels uses ReReplace(..., "\u\N", ...) in engineAdapters/Base.cfc (controller names — the main→umain path), engineAdapters/BoxLang/BoxLangAdapter.cfc, Dispatch.cfc (action names) and a display helper. Adobe tracks it as CF-4234761 / CF-4234762; their hotfix in CF-4234762 fixes some regex issues but not all. Charlie Arehart's Oct 14 post has the links and the hotfix pointer.

Interim options for anyone hitting this now: apply Adobe's hotfix, or roll back the Oct update. Wheels-side, we're replacing the \u case-escape replacements with engine-neutral string handling (no regex case-escape dependency), which restores main → Main on all engines including patch 26/14. I'll post the PR link here when it's open.

This is a useful report — thank you for taking the time to trace it.

[bpamiri]

Shipped: the fix is merged in #4649 (commit e5db922 on develop).

What changed: the four \u replacement sites now uppercase by walking characters instead of relying on regex replacement case escapes — controllerNameToUpperCamelCase('main') → Main, dotted controllers and hyphenated actions are correct again, and the /wheels/info labels are unchanged. No \u/\U/\l/\L remains on those paths, so the Adobe u26/u14 regression can't affect them.

Coverage: expected-output specs on Lucee 7, Adobe 2023/2025 (pre-patch), BoxLang and RustCFML, plus a guarded differential against the old regex on engines where \u still works. We could not run a patched u26/u14 build locally — the CI images are pre-patch — so if you're on update 26/14 after installing this Wheels version, please confirm here that main resolves correctly. The \l/\U sites (hyphenize, flash keys, named routes) are tracked separately in #4646.

Thanks again for the trace — it made this a small, precise fix.