Changelog

[1.2.1] - 2026-05-14

Fixed

• README ForgeBox version and download badges pointed at the wrong package slug (toml instead of cftoml), so both badges showed "package not found" on the rendered README. The badge URLs and the linked package pages now use the correct cftoml slug.

[1.2.0] - 2026-05-12

Added

• Opt-in TOML 1.1.0 parser support via the spec option. Default remains "1.0.0"; pass { spec: "1.1.0" } to enable. New 1.1.0 parser features:
  • Multi-line inline tables (newlines, comments, and trailing commas inside { ... })
  • \e escape sequence (U+001B)
  • \xHH escape sequence (exactly two hex digits, U+00HH)
  • Optional seconds in datetime values (HH:MM accepted, synthesized to HH:MM: 00)
  • Non-ASCII bare keys (Unicode letters and digits inside table headers and key paths)
• Four emitter knobs for opting into 1.1.0-only output: inlineMultiline, useExtendedEscapes, omitZeroSeconds, useBareDigitKeys. Default behavior even in spec = "1.1.0" mode is 1.0.0-compatible output unless these knobs are set, so callers can safely parse 1.1.0 inputs and re-emit them for 1.0.0 consumers.
• cfTOML.ConfigError raised when a 1.1.0-only emitter knob is set under spec = "1.0.0".
• BurntSushi/toml-test 1.1.0 corpus driver. Run tests/conformance/run-conformance.cfm?spec=1.1.0.
• Case-sensitive ordered struct support on engines that provide it (Adobe CF 2021+, BoxLang, Lucee). The parser probes structNew("ordered-casesensitive") (and Lucee's linked-casesensitive) at init time and uses it for the parsed data tree, so [section] and [Section] no longer collide. CF 2016/2018 keep the case-insensitive [:] fallback.

Fixed

• All malformed inputs now throw a cfTOML.*-prefixed exception. Datetime range violations (out-of-range hour, mday, month, etc.), Unicode escape out-of-range and surrogate-range violations, and non-UTF-8 file encodings previously surfaced as engine-native Expression, Application, or Template exceptions. They are now wrapped as cfTOML.ParseError.
• Top-level and inline-table key positions accept quoted-string segments (STRING_BASIC and STRING_LITERAL). Previously, a key like "foo.bar" = 1 or {"key" = "value"} parsed as a quoted-value mistake. TOML 1.0.0 has always allowed quoted keys; the parser now matches the spec.
• Mixed quoted/bare dotted key paths like "name".'last' = "Dent" parse correctly.
• Empty quoted segments ("", '') survive dotted-path splitting and table-header parsing. [""], ''.x, and "".'' = "x" are valid TOML 1.0.0 patterns.
• Whitespace around dot separators in dotted paths is now trimmed correctly ([ j . "ʞ" . 'l' ] produces ["j", "ʞ", "l"], not ["j", "ʞ ", " 'l'"]).
• Tokens like inf, nan, true, false are accepted as bare keys when they appear in key position (the lexer greedily emits FLOAT/BOOL for them, but the parser now treats those token types as valid key segments).
• Bare keys can start with - (-key = 1, [-], [---] parse correctly).
• FLOAT-shaped lexemes like 10e3 and 3.14 are accepted as keys when at start-of-statement (3.14 = "pi" parses as dotted key 3.14).
• Trailing-dash lookahead on INT lexing: 2000-datetime = "x" now lexes as a single bare key rather than splitting into INT(2000) and KEY(-datetime).
• \u and \U escape decoders explicitly reject the surrogate range (U+D800..U+DFFF) and (for \U) codepoints above U+10FFFF. High codepoints (U+10000+) now produce correct UTF-16 surrogate-pair output via Character.toChars().
• All-digit bare keys (1234 = "value") are now accepted in TOML 1.0.0 mode. The spec note says "bare keys are allowed to be composed of only ASCII digits, e.g. 1234, but are always interpreted as strings"; an earlier internal misreading had gated this behind 1.1.0.
• The \u, \U, and \xHH escape decoders use Java's Character.toChars() for the resulting codepoint instead of CFML's chr(). chr(0) on Adobe CF returns an empty string, which silently dropped the NUL character from inputs like "�"; the Java path preserves the full Unicode scalar across the entire range U+0000..U+10FFFF.
• The conformance runner's typed-JSON helper uses structNew("ordered-casesensitive") (with engine fallbacks) instead of [:], so test data with keys differing only in case no longer merges before comparison.
• The conformance runner reads expected JSON via Jackson (com.fasterxml.jackson.databind.ObjectMapper) instead of CFML's deserializeJSON(), so the expected struct stays case-sensitive too.
• The typed-JSON helper checks java.lang.String class before the numeric-looking-string fallback, so a quoted TOML scalar like version = "4" is reported as a string instead of being silently promoted to integer.
• Double precision: the typed-JSON helper uses java.lang.Double.toString(d) instead of CFML's toString(), which on Adobe CF truncates to roughly 11 significant digits. Full IEEE-754 precision now survives serialization for comparison.

Changed

• The conformance fetcher (tests/conformance/fetch-corpus.ps1) now applies the toml-test files-toml-1.0.0 manifest to the 1.0.0 corpus, matching how it already filtered the 1.1.0 corpus. The previous unfiltered copy left 1.1.0-only valid tests in the 1.0.0 set, which skewed the 1.0.0 numbers downward. Re-run the fetcher after upgrading to pick up the filter.
• dateTimeReturn = "cfdate" (default) is no longer zone-lossy on offset datetimes. Previously the parser dropped the zone and returned the raw wall-clock from the source, so 1979-05-27T07:32: 00Z and 1979-05-27T07:32: 00-08:00 both produced the CFML datetime 1979-05-27 07:32: 00 regardless of where the server ran. The parser now converts offset datetimes to the server's local zone via java.time.OffsetDateTime.atZoneSameInstant(ZoneId.systemDefault()), so the returned CFML datetime represents the same instant as the source. Local datetimes (no offset in source) still keep their wall-clock verbatim because there's no zone to interpret. Code that relied on the old zone-dropping behavior should switch to dateTimeReturn = "iso8601" (raw RFC 3339 string) or "javatime" (zone-aware java.time.* objects).
• Fractional-second precision is preserved in cfdate mode. Sources like 1979-05-27T07:32: 00.456 and 07:32: 00.7Z now carry their milliseconds through to the returned CFML date via dateAdd("l", ms, dt). Beyond three digits the fraction is truncated; shorter fractions right-pad (.7 -> 700ms). CFML's native createDateTime() lacks a millisecond argument on CF2016, which is why the dateAdd workaround is used uniformly.
• The emitter builds the DATETIME_LOCAL string from year/month/day/hour/minute/second accessors rather than dateTimeFormat() masks because CFML's mask vocabulary is engine-dependent (Adobe CF and Lucee: mm is month, nn is minute; BoxLang: mm is minute, nn is unknown). Component-based emission is identical on every supported engine.
• Whole-number Doubles emit as TOML integers (1 rather than 1.0). On Lucee, every numeric literal is stored as java.lang.Double regardless of whether the source was 1 or 1.0, so emit-side distinction between integer and float is not portable. Callers who need a TOML float in the output should pass a non-whole value or use int64Mode = "string" with a decimal-shaped string.
• The emitter calls formatter.format(value) rather than value.format(formatter) on java.time.* objects. BoxLang shadows the CFML format(value, mask) built-in over the Java instance method, so the second form is rejected with a "format mask must be string" error. Calling the formatter as the receiver bypasses the shadowing on every engine.
• The conformance runner reads files via java.io.FileInputStream + InputStreamReader with a strict UTF-8 decoder rather than ByteBuffer.wrap(byte[]) + decoder.decode(). BoxLang cannot dispatch the static wrap() method on the abstract ByteBuffer class via createObject; the InputStreamReader path uses instance methods only and works everywhere.
• The runner's per-spec corpus selection uses a plain if/else block instead of a ternary, and the valid/invalid test loops are extracted into named functions. BoxLang's bytecode generator reports "Bad return type" on a mix of template-scope ternaries and large <cfif>-equivalent then-blocks; the function-and-block refactor resolves the verification failure without affecting other engines.
• tests/Application.cfc and tests/conformance/Application.cfc compute the /cfTOML mapping target from getDirectoryFromPath(getCurrentTemplatePath()) & ".." instead of expandPath(".."). BoxLang resolves expandPath("..") from a sub-template differently than Adobe CF and Lucee, putting the mapping one directory too high and making new cfTOML.cfTOML() fail to resolve.

Conformance

Measured across the full engine matrix (Adobe CF 2016/2021/2023/2025, Lucee 5/6/7, BoxLang 1.13) against the BurntSushi/toml-test corpus (pinned at toml-test v1.5.0, manifest-filtered per spec):

• TOML 1.0.0 on Adobe CF 2021/2023/2025: 182/182 valid (100%) + 371/371 invalid (100%), 0 runtime errors
• TOML 1.1.0 on Adobe CF 2021/2023/2025: 187/187 valid (100%) + 361/361 invalid (100%), 0 runtime errors
• TOML 1.0.0 on Adobe CF 2016, Lucee 5/6/7, BoxLang 1.13: 180/182 valid + 371/371 invalid, 2 expected errors
• TOML 1.1.0 on Adobe CF 2016, Lucee 5/6/7, BoxLang 1.13: 185/187 valid + 361/361 invalid, 2 expected errors

The 2 errors on the case-insensitive engines are valid/key/case-sensitive.toml and valid/inline-table/key-dotted-4.toml, which require keys differing only in case to round-trip distinctly. Adobe CF 2021+ provides structNew("ordered-casesensitive") that preserves case under dot-notation access; older Adobe and the other engines either lack the struct type or implement it in a way that breaks dot-notation, so the parser falls back to the case-insensitive ordered [:] literal. The unit suite passes 634/634 on every supported engine.

Every valid TOML input parses into the correct typed structure, and every invalid input is rejected with a cfTOML.*-prefixed exception. Strict-mode work that closed the remaining invalid-side gap: control-character rejection across the five string/comment lexer sites, leading-zero integer and float rejection, case-sensitive true/false/inf/nan, array and inline-table separator state machines (rejecting [,], [1,,2], [1 2], {x=3 y=4}), trailing-token rejection after statements ([error] this = "...", a = 1 b = 2), datetime offset hour/minute range validation, multiline-string line-continuation strictness (\<space>x is invalid), bare-key segment validation in table headers (rejecting [name=bad], [a[b], [key#group], [invalid key]), table-conflict tracking for dotted-key intermediates ([fruit]; apple.color="red"; [fruit.apple] now throws), static-array vs array-of-tables distinction in header walks, KV-pair dotted-key rejection when walking through AoT or another header's explicit table, inline-table immutability (rejecting {a = {b=1}, a.c = 2}), and strict UTF-8 byte-level validation in the conformance runner via java.nio.charset.StandardCharsets.UTF_8.newDecoder().onMalformedInput(REPORT).

Notes

• Library version (1.2.0) is independent of TOML spec version. v1.2.0 supports both TOML 1.0.0 (default) and TOML 1.1.0 (opt-in). Future major versions may change the default; library version increments separately from spec adoption.
• Skipped library version 1.1.0 to avoid implying the library is locked to a specific TOML spec version.
• Cargo (the largest TOML consumer) has not adopted 1.1.0 yet. The default remains 1.0.0 for that reason.

1.0.0 (2026-05-11)

Initial release. Full TOML 1.0.0 parser and emitter with round-trip semantic equivalence.

Phase summary

• Phase 1: Project foundation, framework-less test harness, tokenizer for the easy 80% of TOML lexical features (bare keys, decimal integers, booleans, single-line basic strings, comments, newlines, position tracking).
• Phase 2: Tokenizer extensions for all scalar value lexemes (literal strings, multi-line basic/literal strings, hex/octal/binary integers, floats with exponent and special values, all four datetime variants) plus decode helpers (decodeBasicStringEscapes, decodeMultiLineBasicEscapes, parseIntegerLexeme, parseRFC3339).
• Phase 3: Parser MVP - top-level KV pairs, [table] headers, dotted keys, duplicate-key detection, table-redefinition detection. tomlDeserialize and tomlReadFile wired end-to-end.
• Phase 4: Container tokens ([, ], ,, {, }), bracket-depth tracking, array parsing, inline tables (with immutability), array-of-tables (with conflict detection), quoted-segment paths.
• Phase 5: Emitter (tomlSerialize, tomlWriteFile). Three-pass table walk (scalars, nested [a.b], AoT [[a.b]]). Options: sortKeys, indent, inlineThreshold, onNull, queryAsArrayOfTables. Round-trip semantic equivalence verified.
• Phase 6: BurntSushi/toml-test conformance corpus integration, 10-engine matrix scripting, full documentation, ForgeBox publish prep.

Public API

• tomlDeserialize(toml, options) - parse string to ordered struct
• tomlReadFile(path, options) - read and parse UTF-8 TOML file
• tomlSerialize(data, options) - serialize struct to TOML string
• tomlWriteFile(path, data, options) - serialize and write to file

Supported engines

Adobe ColdFusion 2016/2021/2023/2025, Lucee 5/6/7, BoxLang 1+.