NOW LIVE! ColdFusion 2025, 2023, and 2021 July security updates

We fixed ours by cleaning the felix cache

1. Stop Coldfusion
2.  delete the cfusion/bin/felix-cache directory
3. Start Coldfusion

Paul, there are a couple of ways to look at what you've presented--and yes, a workaround, though we should better understand and confirm your problem as well. 

First, as you may know the new docker images for each update tend to come out a couple days after the update's initial release.

That said, one should be able to do the update (or package updates) within the container...but like with a regular cf instance, that needs to be able to access the Adobe servers which hold the update files. And it's not unusual for a container environment to be configured such that IT CANNOT make outbound network requests, as a security protection.

And just as with a regular cf instance, the update technotes do discuss how one can instead perform a manual offline update, which entails a couple extra steps. Those could work in a container.

But it's indeed odd that you say this message "just happened" unexpectedly: it would normally happen only to someone (with any form of cf deployment) who somehow told cf to update to a package whose version was higher than the current update level of cf (what they refer to in the admin Package Management ui as the "core" update.)

If you look at your dockerfile, compose file, or kubernetes manifest (whatever means you're starting cf as a container), you should find you have the installModules env var set to name what packages you want implemented (Or you may find an importModules, which names a file listing the packages to be implemented.) Those package names can include version numbers, but I'd not expect yours to already name the next version--and I'd not expect it to "automatically seek the highest available version".

Anyway, let us know your value for that env var. And note that for now you could workaround this problem by instead setting that env var to name the update 14 version of those packages, thus "pinning" the package version. Again, you should not have to do that.

Then let's see if Adobe or others have more to offer. I also hope to setup a demo if your situation, especially with whatever values you have for installModules or importModules.