Wheels 4.1.1 is out

[wheels-bot[bot]]

Wheels 4.1.1 is released: a CLI security fix, Adobe ColdFusion first-request fixes, multi-database migrations that no longer stall, and the rough edges people hit in 4.1.0.

• Security: GHSA-x3cm-2j3q-jgg4 (medium). The CLI now only sends state-changing commands, console code and the reload password to this project's own verified server, and the reload password travels in a header instead of the URL. There's also an open-redirect fix in redirectTo() and the CSRF check.
• Adobe CF 2023/2025: the first request after a restart no longer returns HTTP 500.
• Migrations: steps that use raw SQL, including against a second datasource, are recorded again, so the queue doesn't stall.
• Fixes: Oracle, SQL Server, H2, pagination, the query builder's offset(), strict CLI argument checking, wheels test exit codes, and more. See the CHANGELOG.

Upgrade: brew upgrade wheels / scoop update wheels / apt upgrade wheels / dnf upgrade wheels, then wheels upgrade check and wheels upgrade apply.

One manual step: copy the X-Wheels-Reload-Password block from the current public/Application.cfc template into your own. The blog post explains where it goes.

Known issue (apt only): if wheels fails with UnsupportedClassVersionError, your JAVA_HOME points to a JDK older than 21. Run unset JAVA_HOME or point it at Java 21. The fix ships in 4.1.2.

Questions or anything that doesn't behave as described: reply here or open an issue.