142 Moving to ColdFusion 2025: Cheers and Challenges with Charlie Arehart

Show notes

• Charlie, you always open Hidden Gems by saying there's more new stuff in a release than people ever realize. Looking back at CF2025, what's the one gem that surprised even you?
  • Does this include hidden gems in CF 2026 (aka CF 2025 update 8)?
• ACF 2026 introduces native artificial intelligence (AI) and large language model (LLM) integration, Model Context Protocol (MCP) support, Retrieval-Augmented Generation (RAG), vector databases, new ColdFusion Markup Language (CFML) features, security enhancements, developer tooling, monitoring capabilities, and performance improvements.
• The installer now lets you set an allowed IP for the admin on any profile, and it reminds people about wsconfig. You pushed for both of these. Thanks! For shops that only touch a CF installer once every few years, how much does a small usability win like this actually move the needle?
• Enabling HTTPS for the built-in CF Admin is basically trivial now, and you can force HTTPS only. On port 8500. Here's the thing that should scare people. In your consulting work, how many admins were you finding like that before CF2025? What's the worst thing you've seen happen because of it?
  • Since ACF 2016 admin not visible publicly by default
• Containers got a real upgrade. 60 to 70 percent faster startup, secrets support, CCS inside containers, better docs. 
  • CF has had container support since ACF 2018!
  • For teams already on Docker or moving toward Kubernetes, what's the day one win they should expect?
• Subscription licensing
  • With pure subscription licensing now the only path, how are procurement and finance teams reacting compared to the old perpetual model? What should a mid-sized shop be building into their multi-year budget forecast, and where's the true up risk hiding?
    • Subscription budget is same as upgrading every 2 years
  • Dev license 2 concurrent requests limit
  • CF2025 is subscription only now. You've got the public pricing numbers and you point out a lot of people were already on subscription through cloud AMIs or ETLAs. This is the number every budget owner actually wants before they'll sign off on anything. Purely on total cost of ownership, how does this compare to the old perpetual plus upgrade discount model for a mid-sized shop, over say a five year run?
• API Manager doesn't need a CF license key anymore. That feels like a quiet one but it's huge. Who should be looking at this now that it's free, and what are people actually using it for?
  • Came out with ACF 2016
  • Useful for API monitoring, throttling, versioning and security
• The new null coalescing operator, multi-exception catch, trailing commas, createObject loadPaths, these all feel overdue. 
  • Which of these do you think will actually change how people write CFML day to day, versus just being nice to have?
• CSP and nonce support are built in now. For teams that have been fighting with Content-Security-Policy headers, how much of that pain does CF2025 actually solve, and what still has to be handled outside CF?
  • For better app security
  • Beware CFDump needs fixing if you use CSP - alt CSP header for this
  • Click Dump to expand or contract sections
• The removals list is longer than any release I can remember! 
  • Prior depreciented functions were now removed.
  • YUI based UI tags, cfencode, Axis1, COM, parameterExists, tags as CFCs, ThreadTerminate. 
  • HTMLEditFormat() → EncodeforHTML()
  • This is the part where every CIO I talk to gets nervous, because somewhere in their app is one ancient tag holding the whole thing together, and nobody left on staff remembers why, kind of like nobody remembers who actually planted the tree that's now blocking the road. Of everything you've helped migrate so far, which removal is causing the most real pain?
• Key terms defined
  • Deprecated = still works, but developers are warned not to use it. Replacement is normally available.
  • Removed/obsolete = no longer supported; code using it may fail to compile, load, or execute.
  • Unsupported but present = an intermediate state used by some vendors: it may still work, but bugs may not be fixed.
  • Behavioral breaking change = feature remains, but its semantics change enough that old code may behave differently.

Adobe explicitly distinguishes deprecated, deprecated and unsupported, and removed. Deprecated ColdFusion functionality remains eligible for bug/security fixes; deprecated-and-unsupported functionality generally receives only security fixes; removed functionality is unavailable.

• Adobe updated the Compatibility Code Analyzer and Pete Freitag built a dedicated compatibility scanner into Fixinator. How good are these tools actually at catching the gotchas before they hit production, so people aren't finding out the hard way in front of customers?
  • You spend time on the breaking changes carried over from the March and June 2024 updates, searchimplicitscopes and the encryption algorithm change, plus the old dateformat capital D change from CF2021. This is exactly the kind of thing that makes a CTO put off an upgrade for three more years, one small silent change breaking something nobody tested. For someone jumping straight from CF2018 or CF2021 to CF2025, what's the realistic order of operations, because nobody wants to be Frodo walking into Mordor without Sam and a map?
• Java 21 and Tomcat 10.1 landed together. Beyond just being current, what real benefits, or new gotchas, are you seeing CF developers run into?
  • Quarterly Java updates
  • Future Java 25 support?
  • Deploy CF as a WAR requires CF Ent
• Looking at the full support matrix, Windows 2025 server is added. Sybase is gone, Solaris is gone, WebLogic and WebSphere are gone. 
  • Few orgs use these so it was an ROI decision to remove.
  • For organizations still stuck on those platforms, it's a bit of a fellowship breaking up, everyone has to pick a path forward. What migration paths are you actually recommending?
  • ZIP install alternative
• Past this one release, what should a CIO actually watch for as a signal that Adobe is staying committed to the platform, versus the risk of another long quiet stretch? Nobody wants to migrate now and then find themselves waiting at the gates of Moria for the next real update.
• What are you excited about for CF Summit East?
  • Reston VA near IAD airport

Mentioned in this episode

• Hidden Gems in CF 2025 CFmeetup youtube 
• ACF 2026 features 
• ACF 2026 features (cf2025 update 8)
• https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/whats-new.html
• ACF 2025 features
• Adobe ACF 2025 features
• https://guides.adobe.com/coldfusion/en/docs/introduction-to-coldfusion/whats-new-cf-2025.html
• Adobe CF issue tracker
• CFMeetup talk on CF 2025 migration
• Adobe CF Summit East (TT blog)
• https://teratech.com/adobe-coldfusion-2024-new-features/
• Adobe CF Summit East