Brad and Jason,
Thought I'd chime in here to share my experience with commandbox after updating to Big Slur, I mean Sur. Before I explain anything, I should let you know that I am running cb 4.0.0 with the Java runtime included. I don't think the version of command box is very important though- pretty sure it's the jre that Big Sur didn't like in my case.
I'm not sure if what I did to get cb up and running is "recommended" or not and I'm definitely not a MacOS /Big Sur expert or even a *nix system administrator. I don't know if this works on cb installs that do not include the jre. I can say that commandbox has been running like a champ for me ever since I "fixed" the jre.
The details are a bit blurry, but I'm pretty sure commandbox (the 'box' command) wouldn't even start after upgrading to big sur. I needed it desperately so I dug into the problem. I noticed that the error was referencing one of the lib*.dylib dynamic libraries in the ./jre/lib folder of the path where my 'box' app lives. If you aren't sure, type `which box` at a shell prompt. If you are using commandbox with jre, you'll find ./jre/lib in the folder box is in.
Basically, the error I was getting lead me to believe that one of the dynlib files was from an unknown source/developer and was being blocked by the OS. So I held down 'ctrl' and clicked the file, then clicked 'open'. When you do this, the prompt changes and allows you to bypass the unknown source message and run it anyway. After doing this and then firing up commandbox, I got a different error referencing another dynamic library file in the ./jre/lib folder. I ctrl+clicked and bypassed that one and launched cb again. This process repeated until finally, cb started up. I ran into similar problems when I tried doing other commands and I think in the end, I ctrl+clicked all of the dylib files - commandbox has worked ever since.
When you ctrl+click a file and select open, you should get a dialog that says "macOS can not verify the developer of <file>" and then a warning about opening your system to malware. If you click "open", an exception for that file will be permanently added and you will not see the warning again.
Not sure if this will be helpful but I thought I'd share.
Take care,
Joel C