Pardon the somewhat vague nature of this bug report. I was thinking about this and figured I'd share my thoughts. Feel free to close and ignore if it doesn't make sense.
A few times now I've been dinged by CommandBox's server command updating my copy of Lucee and then I lose all my settings. I initially corrected this by adding a version to my cfengine value in my server.json file, but I still got dinged a few times when a minor version was released.
To be clear, CB wasn't at fault here, it was doing what it was told to do I suppose, and I could have used settings in Application.cfc, but in this case I wasn't 100% sure of where the client was going to deploy the code so I wanted to be a bit more safe.
Finally, today, when it happened again and I lost my setting, I looked at the command prompt, made note of the version, and updated my cfengine value from lucee@5 to firstname.lastname@example.org+34. So in theory, I've "locked" it now and it won't update.
But what I'm wondering is if there is a way to handle this a bit nicer maybe. For example, a setting that says, "Once you've gotten the server, don't update".