Still gonna break everyone’s CI until they manually update the tag. (And who guarantees that these tags will stay alive after they pull this)
This is exactly why so many of us have advocating for private registries and copies of every image you run in production. Pulling straight from Docker Hub was always a risk.