Comment by mfontani

I keep track of upstream image changes using https://github.com/crazy-max/diun

... but I also separately ensure all software installed in a docker image is pinned to a version, and have a process I run daily to check whether the upstream packages versions have changed, in which case I rebuild the images which then get the updated (possibly security) version.

It's fiddly, and a lot of bash and perl. I'd welcome a similarly trust-able tooling from a reputable source.