@RadDevon You can also use tools like Renovate or Dependabot to create a pull request once an image in your docker-compose files is updated (runs on GitHub, GitLab, Gitea, Forgejo, etc.)

That leaves you with running tests in your CI pipeline and setting up a deployment step afterwards.

@RadDevon While using latest in a production environment is not considered a good idea, I've been using Watchtower in my homelab for years to keep running images up to date without any issue.

Some apps also provide major version tags (e.g. Postgres), so you avoid breaking changes (as long as they adhere to semver).