The :18 tag and its immutable :18-YYYYMMDD siblings, built from main. Older date tags are not patched -- rebuild from main to pick up a new base.

Most of what you would report here lives upstream: this image is postgres:18 (pinned by digest) plus barman[cloud,aws] from PyPI. A vulnerability in Postgres or Barman itself belongs to those projects; what we can fix here is the digest we pin and how we build on it.

Report privately via GitHub Security Advisories, not a public issue.

No SLA -- this is a small project. You will get an acknowledgement and an honest answer about whether and when it will be fixed.