postgres:15.12-debian-bookworm image with patched libxml2 fix?

[ghost]

Hi ail. As the title states, is there a time line on when an docker image will be made available for remediating the libxml2 security vulnerability impacting postgres:15.12?

Specifically, looking for the docker image that would contain:

CVE-2025-27113 is fixed in 2.9.14+dfsg-1.3~deb12u2 for libxml2

https://security-tracker.debian.org/tracker/CVE-2025-27113

Thank you in advance.

[yosifkit]

postgres:15.12 is not supported for image rebuilds. We only build the latest release of each supported PostgreSQL major version, so for 15 that would currently be postgres:15.14.

If you want the most up-to-date system packages while balancing stability, I'd recommend a tag like postgres:15-bookworm or postgres:15-trixie in order to get any image rebuilds as well as any PostgreSQL patch releases. And it will protect you from changes that happen on OS release like the recent Debian Bookworm to Debian Trixie that happened for the plain tags like postgres:15. With the *-bookworm and *-trixie tags you can then test and choose when you are ready to move. We build images for the two most recent releases of Debian and Alpine to give users the time to migrate.

[ghost]

@yosifkit -- thank you very much for sharing your standard op process and confirming the status! I will remediate with one of the other available tags and go from there!