I keep track of upstream image changes using https://github.com/crazy-max/diun https://github.com/crazy-max/diun ... but I also separately ensure all software

I keep track of upstream image changes using https://github.com/crazy-max/diun https://github.com/crazy-max/diun ... but I also separately ensure all software installed in a docker image is pinned to a version, and have a process I run daily to check whether the upstream packages versions have changed, in which case I rebuild the images which then get the updated (possibly security) version. It's fiddly, and a lot of bash and perl. I'd welcome a similarly trust-able tooling from a reputable source.