We're finally ready to update to CF2021. I vaguely remember there was some discussion with the sequence of doing CF updates at the same time as JVM updates. Am I remembering that right?

yeah, recent Java (11.0.20+) changed how they process zip files, so you need a jvm flag to be able to run updates on or before 11.

That was it!! I found this on @carehart site 🙂 https://www.carehart.org/blog/2023/10/10/solving_problems_applying_latest_cf_updates