Are upstream security fixes being incorporated into Postiz Docker releases?

[juanchi]

Hi Postiz team,

How are upstream security fixes for dependencies and Docker base images incorporated into Postiz releases? When those projects release security patches, are updated Postiz images published separately, or are the fixes included in the next regular release?

Is there any ongoing work to incorporate recent upstream security fixes, and where can self-hosted users track which Postiz image includes them?

Thanks!

[MohammadThabetHassan]

I checked how the images are built, since that answers most of this. build-containers.yml only runs on a tag push (or a manual dispatch), so there are no separate security rebuilds between releases: a fix reaches the image with the next tagged release. Each build does use --pull --no-cache, but Dockerfile.dev pins the base to node:22.20-bookworm-slim, and that tag is no longer being updated. You can see it in the config of the current image: v2.25.2 (same digest as latest, built 23 Oct 2026) still reports NODE_VERSION=22.20.0, and its base layers are dated 24 Sep 2025. The Dockerfile's apt-get install adds nginx and the build tools but never runs apt-get upgrade, so the Debian libraries already in the base (openssl, libc and so on) are from that same snapshot.

So right now neither Node security releases nor Debian security updates reach the image until someone bumps that FROM line. Until that happens, a small derived image closes most of the gap:

FROM ghcr.io/gitroomhq/postiz-app:v2.25.2
RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
COPY --from=node:22-bookworm-slim /usr/local/bin/node /usr/local/bin/node

Staying on the 22 line keeps the native module ABI the same, so the installed node_modules keep loading. Check the result with docker run --rm --entrypoint node <your-image> -v, and scan it with Trivy or Grype before and after to see what it actually removed. I haven't run a full Postiz stack on the swapped binary, so test a deploy before relying on it.

For tracking which release carries what, the image config is the reliable place, and you can read it without pulling the image:

docker buildx imagetools inspect ghcr.io/gitroomhq/postiz-app:v2.25.2 --format '{{json .Image}}'

It shows NODE_VERSION and the build date per platform. The real fix would be a PR moving the base to node:22-bookworm-slim (or a pinned current 22.x patch), so every release build picks up the latest Node and Debian fixes.