Unfortunately we can’t keep the base image static for 6-12 months. Packages installed in the docker image get security updates, and we have to get those rolled out to people on the stable branch.
In this instance we had a choice between creating and maintaining a totally separate ‘Ruby 3.1’ image for the stable branch, or backporting small tweaks so that the stable branch would run on the latest image. We chose the latter because it was less work and less risk. It means that everyone is using the same image that we rigorously test and deploy on our hosting.