[Looking for Charlie's main web site?]

Version numbers of libraries underlying ColdFusion 2016

Note: This blog post is from 2016. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.
Are you wondering what updates (in terms of version numbers) have been made to the libraries underlying CF2016?

For instance, what's the version of Solr? (It's considerably upgraded over what was in CF11 and 10). What about Java, Tomcat, Hibernate, ehCache, Quartz, jQuery, and so on?

In this post, I offer a rundown of what seem the most significant libraries and their versions, as deployed in the first release of ColdFusion (2016 Release). I also explain how I found these version numbers, which isn't always obvious, in case that may help others. But I also offer some commentary on why this is an important issue to some, and I offer some counterpoints to the demands some have that every library should always be the absolute latest version (and why that's just not practicable).

If you just want the version numbers without the "waffle", look for the bulleted list of them below. :-)

This is a continuation of a multi-part series of posts on the introduction of CF2016.

(Before proceeding, let me note first that while I do not like that clumsy new name "ColdFusion (2016 Release)", it is the official name. And while most will call it CF2016, I have added the full name here and in some other blog posts on the release, in case some folks may search for it by that full name.)

What is meant by "the libraries underlying CF"?

As most know, one of the benefits of ColdFusion is that it bundles many libraries (some free, some commercial) which underlie most of the features in CF. When you do a CFDOCUMENT, for instance, you're relying on something called IceBrowser which is embedded within CF. (If you ask most people who pay attention to such things, they would say it was iText, but in fact it's the IceBrowser app which makes the itext calls.)

And why do the library versions matter? Why do some complain if not updated?

An unfortunate side-effect of this bundling of libraries is that Adobe must pick SOME version to use, when building a given version of CF, and then they will proceed (perhaps for months) to build it out, test it, and then release it. And even then, months may pass before another update to CF, or a couple of years to a new version.

In that time, the library-maker may have updated their library, and folks who care about such details often lament that CF's included libraries are out of date, and either are missing important bug fixes in that library, or new features that it enabled, or both.

But Adobe's in a rather tough position: if they update the library while building a new version (like during the timespan of their building CF 2016), they need to re-test things before that new version can be released.

And even updating such a library in an update of CF (as those come out every few months) is also a dicey proposition, if such a new library may not only implement bug fixes or new features, but also perhaps changes in behavior. Again, it's then incumbent on Adobe to make sure that that new library (and any updates to it since the version they first embedded) has not caused incompatibilities in how CF and users' code process things.

Sometimes people complain that the problem is they'd like (or find people trying) to leverage some aspect of such a library by calling it directly themselves, and they know that a new version of the library would allow them to access that feature, but the Adobe-provided one is "old". And they may wish they could just drop in the updated version of the library to override that which came with CF, but then you can run into problems with either version/classloading conflicts, or other code on the server which now may not work due to that new library they wanted, and so on. And course this leads some to just decry entirely the use of some thing, as is the case with the Javscript-based UI tags, which leverage jQuery, Ext, YUI, and so on.

And I won't deny that sometimes they do seem to drag their feet of such updates. For instance, the version of Solr included in CF11 was 3.4, which was the same version included in CF10! It was quite dated. But we don't know if there was some issue with later updates that required substantial changes within CF, that led them to have to prioritize not implementing that update. We rarely hear such details. While some choose to presume the CF team is being lazy or disinterested, I give them the benefit of the doubt that in some cases they may know things we don't and that they don't feel compelled to elaborate.

All that said, while some will clamor that Adobe should/must include always the very latest version of any embedded library, whenever it comes out or soon after, it just doesn't seem likely or workable. (Take your complaints about that to Adobe. There's really no sense in making your case here. There's no guarantee they're listening. Open a bug report instead.)

So what are the current CF2016 library versions?

OK, history and histrionics aside, let's get to the versions of libraries included in CF 2016.

Again, note that I am not listing here every single library (there are a few dozen) but just the several that I see people most often seemingly concerned about, and as I said I am listing them as of the initial release of CF 2016 (yesterday, Feb 16 2016, as I write). I'm not promising to keep this updated as of subsequent releases/updates.

As for how I got the version numbers, I'll share a little more after these details.

  • Antisamy 1.5.3 (OWASP security library)
  • Axis 2 1.7.0 (web services library, and note that's "Axis 2" v 1.7.0, not "Axis")
  • Derby 10.11 (embedded DB)
  • Ehcache 2.10.0 (caching library)
  • Esapi 2.1.0 (OWASP Enterprise Security API)
  • Ext JS 4.1 (JS library which underlies various UI tags)
  • Ewsapi 1.1.5 (MS Exchange API)
  • Hibernate 4.3.10 (ORM library)
  • Httpclient 4.4.1 (underlies CFHTTP and more)
  • Jetty 9.3.6v20151106 (underlies Solr, HTMLTOPDF, and more)
  • Java 1.8.0_72 (the JVM which underlies all of CF)
  • JDBC Drivers (the built-in Merant DB drivers, such as for SQL Server, Oracle, and even MySQL. CF no longer includes the MySQL-provided driver, but you can add it yourself)
  • jQuery 1.6.1 and jQuery UI 1.8.16 (JS library which underlies various UI tags and Admin interface features)
  • Lucene 5.2.1 (underlies Solr, the embedded search engine in CF)
  • NekoHTML (CyberNeko HTML Parser) 1.9.16
  • POI 3.12 (underlies MS Office Integration features)
  • PostgreSQL 9.4-1201 (db driver)
  • Quartz 2.2.1 (underlies CF Schedule tasks)
  • Servlets 3.1 (underlies CF/Tomcat processing)
  • Solr 5.2.1 (the embedded search engine, used by CFSEARCH/CFINDEX/CFCOLLECTION, etc.)
  • Tomcat (the application server which underlies CF, when deployed in traditional "Server" configuration)
  • YUI 2.3.0 (JS library which underlies various UI tags)
  • Zingcharts 2.3 (underlies cfchart)
  • Is there a library you feel I missed which should be listed?

As an aside, I'll note as well that if you connect CF to an external web server, like IIS or Apache, the date of the connector (isapi_redirect.dll, or mod_jk*.so files), at leas as of this initial release before any updates, is 1/20/16.

Before anyone may chime in to point out how it's woeful that Adobe STILL has not updated library "whatever", consider first what I said above about how they have to be concerned with backward compatibility, though surely important bug fixes (and especially security-oriented ones) should trump that.

Consider also that it may be that CF's use of some library may simply not have changed enough to warrant using some newer library (but I realize some will find that to be a meager excuse for them not updating. Again, see what I say above about how we may not know all that Adobe is considering, and they may not be being "lazy" in their choice, as well as where to take you complaints, the bugbase.)

So, wondering how I did determine the versions that I show? Think I got any wrong? I'm open to corrections. Read on.

How did I determine these versions?

Since it's critical for some people to know the exact version of things, I will share here how I found these version numbers. I could either mistakenly look in the wrong place or the wrong way, so I offer this info to help others either confirm for themselves what I see. It will also help anyone interested assess the version info for libraries in some subsequent update or new version of CF, in case I don't do another post like this. :-)

  • In some cases, the info is shown in the CF Admin's "System Info" page (the "i" icon in the top right corner), as is the case with the Tomcat and Java versions
  • In other cases, the version number is offered on the file itself (as was the case with the antisamy-1.5.3.jar). Note that such Java-based libraries are stored as jar files, and most (for CF) are found in the [cf]\cfusion\lib folder, though some are stored elsewhere.
  • Sometimes such jars has no version number on it (as is the case with the solr-solr.jar). In that case, what I did was copy the jar file, then renamed the .jar extension to .zip (jar files really are simply compressed folders following a certain Java convention for filenames, folders, etc.). Then I opened that zip, and looked at the META-INF\MANIFEST.MF file in there, which is plain text, and generally offers a version number ("Specification-Version") for the library in question
  • Sometimes you can get the version from something provided by other means, such as the Solr Admin, which for me was available at http://localhost:8989/solr/admin/
  • Some of these libraries are not Java but instead Javascript, as it the case with the jQuery library (used for some CF UI tags and also for the CF Admin's "browse" button, which since CF10 is no longer a Java applet). That jQuery library is stored in [cf]\cfusion\wwwroot\cf_scripts\scripts\ajax\jquery, and I just opened the jquery.js file to get the version number offered in the comments. Same with the ext library, using the ext-all.js file in the ajax\ext folder and YUI in ajax\yui
  • As for the JDBC drivers, note that those provided by Adobe for SQL Server, Oracle, and even MySQL, and so on are licensed by Adobe from Merant and they're actually stored in the macromedia_drivers.jar file (in the cfusion\lib folder, like most other library jars). But you won't readily find any version numbers there, even digging down into the zip as I discuss above. But there are in fact ways to get the JDBC driver version, and I had blogged about it back in 2006. The same concepts apply, and I even just added a comment there to clarify a minor difference in later versions of CF
  • Finally, note also that there are some libraries CF uses where I could not (myself) easily determine the version, such as the jasper (which underlies CFREPORT) and FCKEditor (which underlies CFTEXTAREA), which is why they are not listed above. If anyone figures out how to determine their version

Certainly, if I got anything wrong, please let me know and I'll update the info here, acknowledging your contribution.

And I hope the list here is helpful, now or for someone finding it in a blog post in the future. Some people don't pay attention to "what's new" with a CF release until they can get their org to finally move to it, perhaps a year or more after its release.

And last, let me say one more time: if you want to complain about the fact that some specific library "should be updated", this is not the place to say that. Raise it in the Adobe Adobe bugbase. If you want to add something here which you may feel would help others, do feel free to add that here.

For more content like this from Charlie Arehart: Need more help with problems?
  • If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
  • See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed
Thanks Charlie. How about Apache POI for MS Excel and Word integration.
# Posted By Kevin | 2/17/16 2:09 PM
Thanks for the kind regards, Kevin, and I'v'e now added it, along with postgreSQL which I had missed.
Thanks Charlie. Really appreciate having a central list of new library versions.

Was happy to see they have finally made the jump to Solr 5 - though now to work out what out of the box features of Solr they have crimpled for Standard vs. Enterprise CF2016 :( Hopefully this time rather than removing standard Solr features from CF Standard they leave it alone and just add new features to CF Enterprise.
# Posted By Mark Picker | 2/17/16 4:51 PM
Great list Charlie. One of the librairies we use a LOT is cfchart (ZingCharts). Do you happen to know if that was upgraded as well?
Thanks Charlie, one of the best value adds in CF is zingcharts which looks like it's Build 2.1.5 in CF 2016 (current version is 2.3.0 so not too far off for a change)
# Posted By Doug Cain | 2/18/16 9:37 AM
Let me address the 3 recent comments here at once:

@Mark, I'm not seeing any mention of any changes in CF2016 to any aspect of Solr (whether new or changed features, at all, or any that may be limited to Enterprise-only). So the bottom line seems to be that yes, Solr is updated, and there may be some implicit benefits to that, or people can try to leverage the new features themselves (whether using Java calls or manipulating HTTP URLs, since the way CF works with Solr is to send various URLs to the embedded Jetty server which then passes them into Solr, returning the results, all done transparently when using tags like CFSEARCH, CFINDEX, and CFCOLLECTION.

@David, looks like @Doug answered your question, and thanks for that. I'm curious how you determined it, though. I have tried to find that, to no avail. The chart.jar has no version on its filename, of course, and the manifest within it doesn't indicate that version (it refers to 1.0, but I don't think that's accurate, either.) Can you let us know how you find it ot be 2.1.5? Did you perhaps make some call to something within the library using Java (perhaps within CFML)?
Hi Charlie,

Zingcharts is pure javascript and the main library is named cfchart-html.js in cf_scripts ->scripts->chart. You'll find the build number in there.

The jars which emulate the cfchart server side functionality are actually a zingchart build of rhino which allows the javascript to be rendered server side if required. We have been through a whole investigation in how this works and the rhino build has a set version of zing charts baked in which is a pain if you want to use the latest js build. We ended up using the js version and piped it through phantom js if we need server side rendering.

I believe zingcharts has a node solution for server side rendering to, but have never seen much information about it.

Useful to know that apparently the CF license allows you to use the latest js build which is very handy as they do add new features quite often and plenty of bug fixes. Bottom line is cfchart does't get you very far with the rich functionality zingcharts has so best in most cases to use it directly.

Probably more than your need to know but handy stuff.
# Posted By Doug Cain | 2/20/16 4:25 PM
Thanks Charlie!
I just checked and the latest version of Solr is 5.5.0, but ColdFusion 2016 is using 5.2.1. Do you know why they did use the most updated version?

Hi Charlie,
You always light up the dark side of ColdFusion server, this is really great work I do appreciate it. Do you know if CF2016 still using iText? if yes which version if NO what library? On other hand I did not see you mentioning on CFPrint library i believe it was called jpedal.
# Posted By Shirak | 5/22/16 12:17 AM
Hi Charlie, George Murphy here. You may want to mention that Hibernate Envers does not ship with Hibernate. Hibernate Envers creates an auditing table for all of your entities. This would have been sure nice to have included with Adobe 2016. One of my colleagues mentioned that one might be able to use maven to compile a full envers jar with dependencies and see if you could swap out the one that ships with ACF. Has anyone been able to use Envers with recent versions of Cf and if so what approach did you use.
Hi, George. I think that's probably better raised elsewhere. (I get that because it IS a library underlying CF, you thought this may be better than anywhere else.)

But there's just s no guarantee that anyone (from Adobe or anyone from the community) who cares about CF's hibernate support would see this suggestion you make and question you ask. (To be clear, I'm afraid I have no answer for that, and I don't use hibernate and rarely have been asked to support folks who do with challenges.)

Where would be better? I don't know. Perhaps the Adobe CF forums. I don't think there's one devoted to hibernate support.

Maybe the Facebook "coldfusion programmers" group, since it's become the most useful alternative I've seen.

Hope that's helpful. See you in Houston in a few weeks, Lord willing. :-)
I was recently contacted by Sencha regarding licencing of ExtJS 4.1. They said that we owe them a licence fee. Since the ExtJs 4.1 library is included in the Adobe 2016 software are we required to purchase their license? If no can you direct me to a document that may explain the license agreement with ExtJS 4.1 under Adobe Coldfusion 2016?
# Posted By Chad Fraser | 2/9/18 10:09 AM
Chad, I see that before asking here you had opened a thread in the Adobe CF forums:


I will go ahead and offer my full reply on this there. I started to reply here, but in searching for info to help (see my reply there) I came across your new forum thread.

That's a better place anyway, first because Adobe may respond there. (There's no reason to presume they'd see this discussion here.)

And second it's probably best for any subsequent discussion of this to happen there--rather than annoy the many commenters on this post, who would receive an email about each reply here and who may not care as much about this question. :-) For those that do, go check out the forum thread.
Copyright ©2024 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the html in this page?)

Managed Hosting Services provided by
Managed Dedicated Hosting