XX-jre-alpine non-alpine-version-specific tags not updated to refelct release of XX-jre-alpine-3.23 in December

[rhanton]

It would be super-awesome if the jenkins jobs could be updated to push the same tagged container image data to the non-versioned tags such that the image for these tags becomes equal:

• 17-jre-alpine = 17-jre-alpine-3.23
• 21-jre-alpine = 21-jre-alpine-3.23
• 25-jre-alpine = 25-jre-alpine-3.23

as the current state is instead:

• 17-jre-alpine = 17-jre-alpine-3.22
• 21-jre-alpine = 21-jre-alpine-3.22
• 25-jre-alpine = 25-jre-alpine-3.22

Which is causing us issues due to the alpine vulnerabilities of v3.22 that have been patched in v3.23. Thank you!

[rhanton]

Here's visualization of the issue:

[DamianFekete]

The (draft) PR for this: #866

Approving this but we won't merge this until January (the latest tags will be switched as part of the January PSU release)

I didn't know what a PSU is

containers/README.md

Lines 36 to 37 in 80d820a

	For JDK version updates, we update the dockerfiles and release on a

For JDK version updates, we update the dockerfiles and release on a
quarterly cadence Temurin releases a Patch Set Update (PSU).

[philippe-granet]

@DamianFekete
https://foojay.io/pedia/cpu-and-psu/

A CPU is a Critical Patch Update, and the key term here is "critical".
A PSU is a Patch Set Update and is a superset of the CPU. Java SE Patch Set Updates (PSU) contain all of the fixes in the corresponding CPU, as well as additional non-critical fixes.

[rgoltz]

I'm ran into the same issue while debugging some CVEs and would appreciate some clarification.

From what I understand, the Alpine major version for the 21-jre-alpine tag is managed via dockerhub_doc_config_update.sh#L43, which is part of eclipse-temurin. However, the 21-jre-alpine image does not appear to be rebuilt regularly. The most recent update to this tag was on 8 Nov 2025, which means it is now two months old. As a result, the 21-jre-alpine tag is still using Alpine 3.22 (as defined in adoptium/containers), and its patch level for Alpine-OS-libs is from November 2025. Since then, several CVEs have been fixed for Alpine 3.22, but 21-jre-alpine is stale.

I also see that there are already versioned tags such as 21-jre-alpine-3.23 that are based on Alpine 3.23? - so it seems my understanding above of your code might not have been correct?

In order to make the right choose for applications built on top of 21-jre-alpine, I have a few questions:

• Is the 21-jre-alpine tag still being maintained and updated?
• Are there any options or plans to regularly rebuild or update the 21-jre-alpine tag to refresh its Alpine base image while maintaining the same Java version, so that users benefit from updated security patches in Alpine?
• Should users of eclipse-temurin:21-jre-alpine continue using this tag, or is it now recommended to switch to the version-specific tags like 21-jre-alpine-3.23 (which means we need to update this tag later)?

Below you can find the "status" (in terms of CVEs) for 21-jre-alpine tag from today, 14 Jan 2026:

[karianna]

WRT to Alpine 3.23 - see #866. In general it is then up to Docker/DockerHub to then update the base layer to resolve CVEs (unless it's the JDK in which case we re-spin). See #858 (comment) for the gory details.