Wheels 4.2.1

Changed

• Updated Lucee to 7.0.5.41. New apps from wheels new, the starter app and the framework's own lucee.json now pin Lucee 7.0.5.41 (previously 7.0.0.395), and the Lucee 7 test image and CI lanes run 7.0.5.41 (previously 7.0.1.100). Lucee 7.0.5.41's Express bundle ships Tomcat 11.0.22. Existing apps keep the version in their own lucee.json; change lucee.version to 7.0.5.41 to update.
• On Lucee 7.0.5 and later, HTML that view helpers encode (encode=true or encode="attributes") uses fewer character references. Lucee's ESAPI extension 3.x encodes only the characters that matter in each context, so /, :, (, ), [, ] and spaces stay literal and a double quote becomes " rather than "; earlier Lucee releases encode them as /, : and so on. <, & and quotes are still encoded wherever they were, and browsers render both forms the same. Its canonicalization also keeps a backslash that precedes a quote (\") instead of dropping it, so such a value is rendered as written. Tests that compare helper output against hard-coded encoded strings may need updating.
• The Wheels CLI's runtime is LuCLI 0.6.2.4, which updates the CLI's bundled dependencies (Jackson, JLine, and the Tomcat and Commons Lang libraries it ships on its classpath). No behaviour change.

Fixed

• Adobe CF 2023 update 26 / 2025 update 14 changed regex replacement parsing so the backslash-u case escape emits a literal u, which made a controller named main resolve as umain, corrupted hyphenated controller/action names, and prefixed /wheels/info setting labels with u. Wheels now upper-cases those four sites by walking characters instead of using a replacement escape (#4646)
• Adobe CF 2023 update 26 / 2025 update 14 also emit the \l / \U regex replacement case flags as literal letters: hyphenized route names, flash argument keys and named-route derivation now use engine-neutral equivalents and produce identical output on unpatched engines (#4646)
• Fixed association JOIN caching for H2 tenants whose datasources fold identifiers differently: a memoised JOIN built for one tenant could be reused for another. The JOIN memo key now includes the adapter's identifier-quoting mode, and H2's fold-case classifier is a separately tested pure function (#4629)
• select= expressions that contain SQL functions with commas (CONCAT, IF, COALESCE, …) are no longer corrupted when used with include= or a distinct group-by query (#4634)
• XML rendering no longer throws when the data contains a null value: null struct, array, query and component values are emitted as type="null" elements and a null top-level value renders as a well-formed <data type="null"/> document. The date/time form helpers also coerce a null bound value to the empty selection instead of passing it to the select renderers (#4638)
• Extra query columns (custom select= aliases, joined columns, driver metadata) now follow the same key-casing rule as model properties when rows are returned as structs or JSON: lowercased when resetPropertiesStructKeyCase is enabled (the default), raw casing when it is disabled. Camel-cased select aliases therefore serialize in lowercase by default (#4640)
• App test runs that omit useTestDB now honor set(allowTestsAgainstPrimaryDatasource=true) even when a <datasource>_test datasource is registered, running on the primary datasource with a warning as documented; the DebugBar Test Suite panel's runner and "Open full runner" links pass useTestDB=false in that configuration so they no longer swap the datasource unexpectedly (#4642, #4643)
• wheels analyze now reports TODO/FIXME/HACK/XXX/BUG markers that open a /* block comment or a doc-comment continuation line ( * FIXME ...), not only // and <!--- comments
• wheels analyze no longer reports ordinary comments whose word merely starts with a marker (BUGGY, TODOS, HACKATHON, XXXL) as todo-comment technical debt; TODO/FIXME/HACK/XXX/BUG now match only as whole words, and the optional trailing colon is still accepted
• .env values now coerce to numbers only when they are plain integers, so 007, 1e3 and +5 stay strings instead of being truncated to 7 and 1, and a value that is a lone quote no longer errors. Apps generated by wheels new keep the old parser in their own public/Application.cfc until they copy the change.
• The H2 migrator now quotes generated DDL identifiers in the datasource's own fold case, so migrations can create reserved-word tables and columns (e.g. "order" / "group" in the H2 upper fold) and still alter, rename or drop existing unquoted schemas. With identifier folding off it keeps the legacy unquoted path, and migratorObjectCase only applies in that case. Phase 1 of the cross-adapter DDL quoting work (#4629)
• H2 now quotes table and column names in the datasource's own fold case (upper by default, lower with DATABASE_TO_LOWER=TRUE), so reserved-word columns such as order and group work in queries and order= clauses. Datasources with case folding disabled (DATABASE_TO_UPPER=FALSE) keep today's unquoted SQL unchanged (#4440)
• Cache keys for values the canonical cache-key encoder cannot represent (nested deeper than 64 levels, or holding objects it cannot serialize) now include argument names, so two calls that pass the same value under different argument names no longer share a key. On RustCFML, which has no cfwddx, such values now get a key instead of throwing.
• Identifier quoting now doubles a closing delimiter that appears inside a table or column name (" becomes "", a backtick becomes two, ] becomes ]]), so the generated SQL stays well-formed and such a name stays a single identifier. This applies to the SQLite, PostgreSQL, CockroachDB, Oracle, MySQL and SQL Server model adapters, and to the SQLite, MySQL and SQL Server migrators, where a dotted schema.table name is still quoted part by part. Oracle does not allow a double quote inside a quoted name at all, so there the escaping only keeps the SQL well-formed. Names without those characters are quoted exactly as before.
• The Oracle migrator now quotes generated DDL identifiers uppercase, matching the Oracle model adapter, so migrations can create reserved-word tables and columns (e.g. "ORDER" / "GROUP") and still alter, rename or drop existing unquoted schemas. TABLESPACE identifiers are quoted too, and migratorObjectCase only applies to adapters that do not quote DDL. Phase 3 (final) of the cross-adapter DDL quoting work (#4629)
• The PostgreSQL and CockroachDB migrators now quote generated DDL identifiers lowercase, matching their model adapters, so migrations can create reserved-word tables and columns (e.g. "order" / "group") and still alter, rename or drop existing unquoted schemas. migratorObjectCase only applies to adapters that do not quote DDL. Phase 2 of the cross-adapter DDL quoting work (#4629)
• renderWith() no longer throws a NullPointerException when JSON-rendered data contains null values, and the date/time form helpers no longer call isInstanceOf() on a null or non-object value (#4633)