Adobe shipped Update 25 for the 2023 release yesterday. Unlike Update 24 (which was a coordinated security patch across both supported versions), this one's classified as a general maintenance release, no CVEs listed.
What's actually in it, for anyone who wants the short version before digging into the full release notes:
- 40+ OEM library upgrades: Log4j 2.25.4, Jetty 9.4.58, Apache Maven 3.9.16, several Apache Commons libs
- Query-of-Queries fixes: better datatype handling and more consistent null-value behavior for varchar columns, plus improved column type metadata preservation
- SFTP cipher negotiation fixes: if you're connecting to an older SFTP server and hitting cipher failures, this is relevant
- 27 bug fixes total across the Administrator (mail server connection persistence, LDAP/AD group auth), core runtime, database, Solr, and cfschedule ("Last Run" tracking accuracy)
- Spread operator fix for nested struct references
Nothing urgent since there's no CVE attached, but the library upgrades and Query-of-Queries fixes are worth not sitting on indefinitely.
Full release notes: https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2023-release-update-25.html
I wrote up a slightly more detailed breakdown here if useful: https://www.devlearningtools.com/blog/coldfusion-2023-release-update-25 — full disclosure, that's my own site, a free CFML course + tools, not trying to hide that.
Top comments (0)