LoginSign Up
← Back to all sparks
Q

Quay

INFRA · APIS
Velocity5.0

Container image registry with security scanning

quay.io ↗

Quay keeps both enterprise branches on a monthly CVE-patch metronome — and nothing else.

container-registrysecuritycve-patchinglts-maintenancebuild-pipeline
◆Current state
All ten releases in this window are security maintenance: dependency bumps for CVEs, SSRF hardening in mirroring and proxy cache, and a robot-token visibility fix for readonly superusers. The October pair (3.12.23 and 3.10.27) patches the same four CVEs — immutable, qs, lxml, WebOb — plus a compression bump. Neither line has shipped a user-facing feature in four months.
◆Where it's heading
The 3.10 and 3.12 lines move in lockstep, typically within hours to days of each other, on a roughly monthly cadence. New Containerfile.art files for ART/Konflux builds point to packaging work on Red Hat's build pipeline rather than product changes. Feature work, if any, is not surfacing in these maintenance branches.
◆Prediction
Expect the next 3.12.x/3.10.x pair in roughly a month with another batch of CVE bumps. The entries give no signal of when or whether new capabilities will land on these lines.

◆Recent moves

  1. 20d ago

    Quay 3.12.23 patches four CVEs and adds ART build file

    The 3.12 half of the October pair: CVE bumps for immutable, qs, WebOb and lxml, a compression update, and a Buildx pin in CI. The added Containerfile.art is build-pipeline plumbing, not a user-facing change.

    View source ↗
  2. 20d ago

    Quay 3.10.27 backports October CVE fixes to LTS

    Same CVE set as 3.12.23 landed on the 3.10 line hours earlier, continuing the twinned-release pattern. A Konflux-oriented Containerfile is the only non-dependency change.

    View source ↗
  3. 1mo ago

    Quay 3.12.22: security patches, robot token exposure fix

    Five CVEs patched plus a fix that hides robot account tokens from global readonly superusers — a privilege boundary correction that matters for organizations with tiered admin access. Standard maintenance release, no feature changes.

    View source ↗
  4. 1mo ago

    Quay 3.10.26: security patches, robot token exposure fix

    The 3.10 LTS branch receives the same security fixes as 3.12.22 — CVE patches and the robot account token visibility correction — within two days. Consistent with Quay's branch-parallel maintenance cadence.

    View source ↗
  5. 2mo ago

    Quay 3.12.21: SSRF blocked in mirroring, CVEs patched

    SSRF prevention added to repository mirroring sources — blocking server-side request forgery via mirrored registry URLs. Several CVEs addressed via dependency bumps. No feature changes.

    View source ↗
  6. 2mo ago

    Quay 3.10.25: SSRF blocked in mirroring, CVEs patched

    Same SSRF mitigation and CVE patches as 3.12.21 backported to the 3.10 line. The two branches continue to receive matching fixes within the same release window.

    View source ↗