Document dependency-refreshed compatible self-hosted core and plugin image sets

Request

Please document an immutable, compatible image set and dependency inventory for self-hosted PostHog core and posthog-node/plugin services.

Refreshing the operating-system layer cannot update the embedded JavaScript dependency graph. Conversely, selecting a newer plugin image independently from the core image can introduce application or schema compatibility changes. Consumers need a supported way to refresh both.

Could the self-hosting release documentation include:

• A recommended compatible core/plugin image pair, identified by source revision and image digest.
• An SBOM for each image, including transitive JavaScript packages and OS packages.
• Guidance on dependency-patch rebuild cadence and whether an existing self-hosted release receives refreshed images.
• Required database/schema migration order, ingestion/plugin compatibility checks and rollback limitations when moving to the recommended pair.

This is a maintenance/support-path question, not a report of a new vulnerability or a claim that current releases contain a particular vulnerable package. No customer data, environment names or scan attachments are included.

If dependency fixes are not yet present in a supported published artifact, please provide refreshed builds or a tracked release target. If they are already available, a link to the first fixed digest and its inventory would let consumers upgrade without unnecessary forks.

The issue names no repository files, tests, or entry points. Start by locating the self-hosting release documentation and image build or release metadata, then determine whether the requested compatible pair, SBOM inventories, refresh cadence, migration order, compatibility checks, and rollback limits can be documented from existing project information.