Published container image uses expired Bullseye security metadata

Summary

The published ghcr.io/stac-utils/pgstac:v0.9.11 container image uses Debian Bullseye repositories whose security metadata has expired.

As a result, downstream Docker images that install additional PostgreSQL packages cannot be rebuilt from scratch.

Additionally, the v0.9.12 GitHub release is available, but the corresponding GHCR image tags do not appear to be published.

Reproduction

Downstream Dockerfile:

FROM ghcr.io/stac-utils/pgstac:v0.9.11

RUN apt-get update \
    && apt-get install -y --no-install-recommends postgresql-17-pgvector \
    && rm -rf /var/lib/apt/lists/*

Run a clean build:

docker compose build --pull --no-cache db

The build fails with:

E: Release file for
http://deb.debian.org/debian-security/dists/bullseye-security/InRelease
is expired (invalid since 7h)

The failure occurs during:

RUN apt-get update

A normal build may succeed when the Docker layer is cached, but a fresh build consistently reproduces the issue.

Container Tag Verification

The following tags are unavailable:

ghcr.io/stac-utils/pgstac:v0.9.12
ghcr.io/stac-utils/pgstac:0.9.12

The existing v0.9.11 image is available, but its Bullseye security repository metadata is expired.

Expected Behavior

The latest pgstac release should have a corresponding published GHCR image, and the image should use a supported Debian base with valid package repository metadata.

Requested Fix

Could you please:

1. Rebuild the image using a currently supported Debian base image.
2. Confirm that the resulting image can run apt-get update successfully during a clean Docker build.

This issue affects downstream projects that extend the pgstac image and install packages such as postgresql-17-pgvector.

Start with the downstream Dockerfile and reproduce the failure using docker compose build --pull --no-cache db, then inspect the repository's container build and GHCR publishing entry points. Done means the v0.9.12 GHCR tags are available, the image uses a supported Debian base, and a clean build completes apt-get update successfully.