borinquenkid commented on PR #16027:
URL: https://github.com/apache/grails-core/pull/16027#issuecomment-5149659087

   Re: patch cadence for `gvenzl/oracle-free` — checked the tag history on 
[Docker Hub](https://hub.docker.com/r/gvenzl/oracle-free/tags). The last 5 
releases (each one re-publishes every tag variant, including the 
`slim-faststart` tag this PR uses):
   
   | Date | Version |
   |------|---------|
   | 2026-05-30 | 23.26.2 |
   | 2026-02-11 | 23.26.0 |
   | 2026-02-01 | 23.9 |
   | 2025-08-02 | 23.8 |
   | 2025-07-06 | 23.7 |
   
   Roughly one update every 1–4 months, most recently ~2 months ago.
   
   On the security-risk question: the Docker Hub page documents an explicit 
support-tier system per tag — 🔵 "Always Supported" / 🟢 "Supported" tags get bug 
fixes and regular updates, 🟡 "Deprecated" gets bug-fixes only, 🔴 "Unsupported" 
gets no further updates. Right now only `latest`, `slim`, `full`, and `23.26.x` 
(with variants) are in the actively-supported tier; the older per-minor-version 
tags (`23.9` and below, including everything this PR would've pinned to at 
review time) are already unsupported. Worth pinning to a moving tag 
(`slim-faststart`) rather than a fixed old version if we go this route, so CI 
always pulls a currently-patched image — which is what this PR already does.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to