Security posture
How long prod runs behind available releases, what is past its end of life, and where Goliash cannot see. Counted from when the first newer release came out; for risk registers and audits.
94 days Median exposure 90th percentile 840 days, in prod
11 Behind for 30+ days 8 of them 90+ days
0 Past end of life 0 more within 60 days
0 Accepted risk acknowledged in Goliash, with who and until when
1 Blind spots stale targets, targets without digests, services without a known upstream
Exposure in prod
| Service | Running | Fix | Exposed | Why |
|---|---|---|---|---|
| redis | 7.2.4 | 7.4.0 | 873 days since 2024-05-19 | minor |
| keycloak | 24.0.5 | 26.0.0 | 840 days since 2024-06-20 | major |
| rabbitmq | 3.12.14 | 4.0.3 | 807 days since 2024-07-23 | major |
| fluent-bit | 3.0.7 | 3.1.4 | 805 days since 2024-07-25 | minor |
| vault | 1.17.2 | 1.18.0 | 730 days since 2024-10-09 | minor |
| postgres webshop | 15.5 | 15.8 | 138 days since 2026-05-24 | minor |
| postgres identity | 15.6 | 15.8 | 113 days since 2026-06-18 | minor |
| image-resizer | 3.9 | 3.13 | 94 days since 2026-07-07 | minor |
| payments-api | 1.4.2 on demo-prod-us | 1.7.0 | 82 days since 2026-07-19 | minor |
| traefik | v3.1.2 | v3.2.0 | 43 days since 2026-08-27 | minor |
| orders-api | 3.9.0 | 3.11.0 | 31 days since 2026-09-08 | minor |
| nginx | 1.26.1 | 1.27.0 | 14 days since 2026-09-25 | minor |
| invoice-pdf | 20 | 22 | 6 days since 2026-10-03 | major |
| checkout | 2.3.1 | 2.4.0 | 4 days since 2026-10-05 | minor |
Built on an unsupported base
rebuild on a newer base image| Service | Base image | End of life |
|---|---|---|
| checkout | node:18-alpine | ended 2025-04-30 |
| invoice-pdf | python:3.9-slim | ended 2025-10-31 |
| orders-api | golang:1.22-alpine | ended 2025-02-11 |
Supply chain
what runs, as images| Moving tags latest, stable: the version cannot be known | 0 |
| Tags pushed again one tag running as different images | 0 |
| Untrusted registries outside GOLIASH_ALLOWED_REGISTRIES | 0 |
| Digest unknown a tag pushed again would go unnoticed | 3 |
Blind spots
where the numbers above may be incompleteEvery target reported recently.
The newest release is known for every service in prod.
1 targets report no image digests, so a tag pushed again would go unnoticed there; see why.
Generated 2026-10-09 11:48 UTC for Default by Goliash.