[iloktionoff]

Problem

The final stage of the Dockerfile uses alpine:3.20, which reached its End of Life on April 1, 2026. As a result, this base image no longer receives security patches from the Alpine team. Any new vulnerabilities discovered in its packages will remain unpatched, creating a growing security risk for users of the pgplex/pgschema Docker image. Security scanners such as Trivy will also report TRIVY-EOSL (End of Service Life) warnings, and future CVEs will not be detectable because the vulnerability database no longer tracks this version.

Solution

Update the final-stage base image from alpine:3.20 to alpine:3.23.

• alpine:3.23 is a currently supported stable branch.
• It will receive security updates until November 1, 2027.
• The pgschema binary is statically compiled with CGO_ENABLED=0, so it has minimal runtime dependencies. The risk of incompatibility when moving from Alpine 3.20 to 3.23 is therefore very low.

Changes

- FROM alpine:3.20
+ FROM alpine:3.23

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates the final Docker image from alpine:3.20 to alpine:3.23.

• The Docker image now runs on Alpine 3.23.

_{Reviews (1) · Last reviewed commit: "Update Alpine base image to 3.23" · Reviewed by Greptile}

[tianzhou]

LGTM. Thanks for the contribution.

[Copilot]

🟢 Approval recommended

The runtime base-image update to Alpine 3.23 has no active review issues.

No open issues 🎉

What changed in this PR

Updates the pgschema Docker runtime image to a supported Alpine release so it continues receiving security patches.

Changes:

• Upgrades the final-stage base image from alpine:3.20 to alpine:3.23.
• Leaves the build process and container entrypoint unchanged.

File	Description
Dockerfile	Updates the runtime base image to Alpine 3.23.

_{Review effort: Balanced}