Do the upstream changes in the base image get picked up automatically

[bobbyphilip]

To make my question clearer, openssl 1.1.1s is now part of the latest [alpine image]. (https://pkgs.alpinelinux.org/packages?name=openssl&branch=v3.16&repo=&arch=&maintainer=)
Do these changes in the base image filter down to the node image automatically, or does someone need to make a PR

[nschonni]

Yes, that is done by the official images. You can see the explanation and some additional links in https://github.com/nodejs/docker-node/blob/main/SECURITY.md

[dmitrybaranovsky]

@nschonni : my sincere apologies if this has been implied in your answer, but I need to clarify. We've been using bullseye-slim v18. Few days ago there was an update from 18.12.0 to 18.12.1 to fix the latest openssl CVEs. Will there be an update to https://github.com/nodejs/docker-node/blob/main/18/bullseye-slim/Dockerfile? Thanks!