Latest Docker Containers and v1.6 vs 1.7 image equality

[Alestrix]

Hi,

After learning about CVE-2026-48842, which apparently is exploitable pre-auth, I wanted to upgrade to latest version. I re-pulled nonroot-latest, deleted the existing container and docker compose up'ed a new instance. Checking the About dialog I am still presented with a 1.6.14 note. docker inspect tells me that I do run the image I just freshly pulled ("Created" date of image: : "2026-05-25T07:53:48.980375961Z").

Checking the digest of the amd64 version of nonroot-latest I see it's ce870790a4f9. The really strange thing is that this exact digest is also the digest of, among others, these tags:

• 1.7.0-apache-nonroot: ce870790a4f9
• 1.6.15-apache-nonroot: ce870790a4f9

This looks to me as if

• The version string in the about dialog has not been updated
• There is no difference between the v1.6 and v1.7 images
• 1.6.16/1.7.1 is not yet available as docker imgage

Is this (the first two) a bug? Or is my understanding flawed?

Cheers
Alex

PS: Some more input:

$ docker inspect roundcube|jq .[0].Image
"sha256:d36de6d12028186da454b78dcee0264a2ef13ff2c5faf8b18295c12b3385920e"
$ docker inspect d36de|jq .[0].Created
"2026-05-25T07:53:48.980375961Z"
$ docker inspect d36de|jq .[0].Config.Env|grep ROUNDCUBEMAIL_VERSION
  "ROUNDCUBEMAIL_VERSION=1.7.0",