Wheels 4.0.5 released — a hardening release, now installable anywhere

[bpamiri]

Wheels 4.0.5 is out. It's really two releases: 4.0.4 was a large hardening pass (100+ commits across security, performance, and deploy), and 4.0.5 makes all of it installable the same way on every major platform, including arm64 Linux. 4.0.4 shipped and was superseded by 4.0.5 the same day, before any announcement — so this single post (and this thread) covers both.

Read: https://blog.wheels.dev/posts/wheels-4-0-5-released

What's in it

Security

• Open-redirect hardening: $isSafeRedirectUrl() now normalizes input per WHATWG URL parsing (stripping embedded tab/CR/LF) and rejects backslash / schemeless-authority tricks (/\evil.com, https:/evil.com).
• Information disclosure: the HTML and JSON branches of /wheels/info no longer render secrets — csrfCookieEncryptionSecretKey and the full application metadata (datasource credentials, ORM settings) are gone from the output.
• Fail-closed defaults: the production block on /wheels/* dev-UI handlers is now a fail-closed allowlist, and the URL reload gate refuses to act unless a non-empty reloadPassword is configured.
• Path traversal: $getRequestFormat rejects non-alphanumeric url.format values.
• A new trustProxyHeaders setting (default false) governs whether X-Forwarded-* is believed — isSecure(), maintenance-mode IP exceptions, and the reload rate-limit key all stop trusting client-supplied forwarded headers unless you opt in.

Performance

• Lock-free fast path for model() and controller() on cache hits.
• Memoized URLFor() route lookups (with negative caching) and a per-datasource schema-column cache.
• O(1) action-dispatch gate (was an O(n) list scan); memoized status-code map and partial column lists.

wheels deploy — ~20 Kamal-port fixes: works on fresh hosts, all-or-nothing fleet lock, bounded secret resolution, secret redaction in failure output, correct rollback --destination overlay, on-server audit trail, stricter IPv6 host validation.

Cross-engine

• Adobe ColdFusion: authorized reloads that returned HTTP 500 on case-sensitive filesystems — every stock Linux Adobe deployment — are fixed, along with a Lucee-only cfabort; that 500'd GET / on Adobe.
• BoxLang: hardened null handling across the router, dispatcher, and error handler.
• Oracle / SQL Server: identity retrieval after INSERT now uses the JDBC driver's generated keys instead of @@IDENTITY / MAX(ROWID).

New capabilities: wheels jobs work/status (background-job worker loop), wheels upgrade apply (framework swap), wheels upgrade check --strict, a subpath setting, and a /up warm-up endpoint in scaffolded apps.

…and roughly eighty fixes in total (routing scope()/namespace() callbacks, CORS duplicate-header arbitration, multi-node RateLimiter storage, honest migrate/seed/test exit codes, hasMany shortcut associations, and more). Full list: CHANGELOG.

Install / upgrade — now including arm64

brew upgrade wheels                                          # Homebrew
scoop update wheels                                          # Scoop
sudo apt update && sudo apt install --only-upgrade wheels    # apt
sudo dnf upgrade wheels                                      # dnf

The Linux .deb/.rpm are now architecture-independent (the CLI launches through a portable java -jar runner), so apt install / dnf install work on arm64 (aarch64) — Raspberry Pi, AWS Graviton, Ampere — as well as x86_64. And a CI job installs through all four channels on real runners every day and asserts the version, so a broken install gets caught before you hit it.

If you installed 4.0.4, just upgrade to 4.0.5 — everything in 4.0.4 is in it.

Discussion

Questions, upgrade reports (especially from arm64 Linux and stock Adobe-on-Linux deployments), or anything that broke — drop them in this thread.