Here's a question that's been stuck in my head about doing manual updates. I always use a locally-hosted update-source site I created in IIS on my server, start that site in IIS, then I point the <packagesurl> value in the neo_updates.xml files to that local destination before doing my java -jar etc etc. Is it possible to use the actual Windows-based pathname to the bundlesdependency.json file (e.g., "X:\somedirectory\hotfix-packages-cf2021-019-330379\bundlesdependency.json") in the neo_updates.xml file instead?

Here's what I do for CF 2021. If any of this is inadvisable, please poke me. 1. Download the update through CF admin - NOT download and install! 2. Check that its checksum matches the one expected, if you have it. 3. Copy the full disk path out of the download dialog. 4. Stop all cf services. 5. Open an admin cmd prompt, paste this in, and hit return: 6. \path\to\java\jdk-11.0.26\bin\java.exe -Djdk.util.zip.disableZip64ExtraFieldValidation=true -jar \path\to\update\installer\hotfix-019-330379.jar –- ADJUST FOR JDK PATH AND HOTFIX FILENAME 7. The Installer UI will open. In the the "Select Installation Directory" step, change the Directory to your CF root, for example Z:\ColdFusion2021\ 8. When it finishes... 9. Check that the cf service is running as the user you intend. (It often used to start up under your account, not the one you configured for the service, but that's been fixed for a while.) 10. Restart CF, so everything is in the state it'd be in after a server restart. 11. Check cf admin and your sites. Is the bundlesdependency.json maneuver necessary following those steps? It doesn't seem to be.

@Dave Merrill - bottom line, yes - you do install it using the windows path and on top of it, you don't update neo_updates.xml or have the bundles available by URL. Interesting. I might try that on my local machine for kicks. Thanks!

My install is similar to Dave's with a few changes. I no longer do Step 4. The installer automatically stops the CFapp service automatically but I no longer run additional CF services. If you're still running others, maybe this step is still needed. At step 6, I just use jdk-11.0.19 binary to install updates. This was the last jdk release before the zip64 fiasco and it's worked well for me without any issues or screwing with java args. At step 9, I watch task manager and when CPU usage drops back to mostly idle that means it's finished caching the templates so I'll restart the host OS... I don't need any surprises later on that CF doesn't start because of the update when I'm doing OS updates.

All good info. Many thanks. I did the CF2025 update on a test server without editing any of the neo_update.xml files and did it like you both describe. I was pleased to see that it applied to the instance manager and 3 other instances. Editing all 4 neo_update files was always an error waiting to happen. Thanks, again!

@Jim Frankowski Changing that packagesurl (in the CF admin or the neo_updates.xml) is only needed by those whose server/machine running CF has no internet access (or the default URL offered for that packagesurl can't be reached for any reason). In such a case, the problem is that the auto-download of any updated packages (which takes place at the end of the update), and so the update would fail. The update technotes talk about this "offline manual update" process in some more detail (perhaps not enough for everyone's tastes). Hope that's helpful. Hope that helps,

Thanks for the clarification @carehart.

Thanks Charlie, dev has internet access, prod doesn't. Makes it crystal clear for when we upgrade. Thank you!

👍

@carehart Charlie, did you ever document a cmd line update process like I described above? I'm looking for "authoritative" sources of that info to add to our docs.

Well, if you mean use of that zip-related jvm argument, yes. I did that in a blog post when the JVM update came out in late 2023 that forced that. I wouldn't call it "authoritative", though. And as always, I had a lot more info than your nice, concise list. 🙂 BTW, Adobe also mentions it in each update technote. That's indeed more authoritative.

Yes I meant the jvm arg, and also the whole cmd line process. But adobe does document it in each release now, even if they talk about it like it's only something you need if your server doesn't have net access, where I've just found that method to be way more reliable in general.

agreed. And in fact I will give a talk tomorrow on solving common problems with CF updates, and I'll be mentioning how the command-line approach may be preferable for some, for many reasons. That said, many will still prefer to point and click. I'll offer tips to help them also. 🙂 More on the talk (description, live view and recording links, etc) here: https://www.meetup.com/coldfusionmeetup/events/307310535/