boxlang-runtime-spring-boot — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-spring-boot (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The boxlang-spring-boot-starter automatically configures BoxLang as a view engine inside any Spring Boot 3.x application. Spring controllers return logical view names, which Spring resolves to .bxm template files. Spring Model attributes are available directly in templates via the BoxLang variables scope.
Requirements: Spring Boot 3.x · BoxLang 1.11.0+ · JDK 21+
dependencies {
implementation "io.boxlang:boxlang-spring-boot-starter:1.0.0"
}<dependency>
<groupId>io.boxlang</groupId>
<artifactId>boxlang-spring-boot-starter</artifactId>
<version>1.0.0</version>
</dependency>Adding the dependency activates BoxLangAutoConfiguration, which registers:
BoxLangViewResolver — resolves view names to classpath:/templates/<name>.bxmBoxRuntime.getInstance())No additional configuration is required to get started.
Return a logical view name (without path or extension) from a controller method:
@Controller
public class HomeController {
@GetMapping("/")
public String home( Model model ){
model.addAttribute( "title", "Welcome" );
model.addAttribute( "message", "Hello from BoxLang!" );
return "home"; // → classpath:/templates/home.bxm
}
@GetMapping("/users")
public String users( Model model ){
model.addAttribute( "users", userRepository.findAll() );
return "users"; // → classpath:/templates/users.bxm
}
}Templates live in src/main/resources/templates/ and use the .bxm extension:
src/
└── main/
├── java/ ← Spring controllers, services
└── resources/
├── application.properties
└── templates/
├── home.bxm
├── users.bxm
└── partials/
└── header.bxm.bxm Template — Accessing Model AttributesSpring Model attributes are available directly in the BoxLang variables scope:
<!-- src/main/resources/templates/home.bxm -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title><bx:output>#encodeForHTML( title )#</bx:output></title>
</head>
<body>
<h1><bx:output>#encodeForHTML( title )#</bx:output></h1>
<p><bx:output>#encodeForHTML( message )#</bx:output></p>
</body>
</html>All three forms are equivalent:
<bx:output>#title#</bx:output>
<bx:output>#variables.title#</bx:output>
<!--- or use script inside a bx:script block ---><!-- templates/users.bxm -->
<bx:output>
<ul>
<bx:loop array="#users#" item="user">
<li>#encodeForHTML( user.name )# — #encodeForHTML( user.email )#</li>
</bx:loop>
</ul>
</bx:output><bx:if condition="#isLoggedIn#">
<p>Welcome back, <bx:output>#encodeForHTML( currentUser.name )#</bx:output>!</p>
<bx:else>
<p><a href="/login">Log in</a></p>
</bx:if><!DOCTYPE html>
<html>
<head>
<bx:include template="/templates/partials/head.bxm">
</head>
<body>
<bx:include template="/templates/partials/nav.bxm">
<main>
<!-- page content here -->
</main>
</body>
</html>BoxLang settings are namespaced under boxlang.*:
# Template prefix/suffix (defaults shown)
boxlang.webserver.templatesPath=classpath:/templates/
boxlang.webserver.templatesSuffix=.bxm
# BoxLang home directory
boxlang.home=/opt/boxlang
# Log level
boxlang.logging.level=INFO
# View resolver order (lower = higher priority; coexist with Thymeleaf etc.)
boxlang.viewResolver.order=1BoxLangViewResolver participates in Spring's standard resolver chain. Configure the resolver order to establish priority:
# BoxLang handles .bxm; Thymeleaf handles .html
boxlang.viewResolver.order=1
spring.thymeleaf.order=2You can access the BoxLang runtime directly from any Spring bean:
import ortus.boxlang.runtime.BoxRuntime;
import ortus.boxlang.runtime.scopes.Key;
@Service
public class BoxLangService {
private final BoxRuntime boxlang = BoxRuntime.getInstance();
public String renderSnippet(){
// Execute an inline BoxLang expression
return boxlang.executeStatement( "now().format('yyyy-MM-dd')" );
}
}boxlang-spring-boot-starter on the classpathsrc/main/resources/templates/ with .bxm extensionencodeForHTML() before outputapplication.properties via environment variable placeholders, not hard-coded~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.