I have been nudged by our infosec bod observing we have 11 critical vulnerabilities in our Docker image. Looking at them... they're all from the underlying Lucee image we use. 9 of them already have fixes, and checking one it was fixed early last year, but is present in Lucee's 5.3.10.120 image, created a week or so ago. (https://security.snyk.io/vuln/SNYK-DEBIAN11-PCRE2-2808697) So I guess I'm wondering whether these things are checked as part of testing the image before releasing it, or whether they ought to be?

Here's a ticket Ortus put in recently based on a government scan. It may list some of the vulns you're concerned about. I think some of them weren't going ot get fixed until 5.4

That's a really good effort raising that ticket with such detail @bdw429s.

I have to admit I only ever pay attn to the critical ones... too many lower-priority ones to get my brain around 😕 Our infosec team only care about the criticals, that said.