Stack Update Policy
Last updated July 11, 2025
Table of Contents
This document describes Heroku’s policies for when and how we update existing stacks and our schedule for introducing new stacks.
Updates to existing stacks
Heroku will update packages on currently available stacks approximately twice a month. More frequent updates will occur in response to urgent upstream security fixes for packages in the stack’s base image. Each time the base image is updated, we will publish a changelog entry that contains a list of changed packages.
When making updates to stacks, Heroku strives to make the updated stack binary-compatible with the current stack and generally try to make as few changes as possible over the lifetime of a stack. This is to maximize stability and continuity for apps running on Heroku. Once added, packages will not be removed for the lifetime of a stack.
Before rolling out an update to a stack’s base image, we extensively test it with internal apps. Then we gradually roll out the update on the platform.
If you’re using Heroku’s default buildpack-powered build system and stacks, you don’t need to redeploy your app to pick up these changes. Your application’s slug is applied on top of the most recent base image for the stack each time a dyno starts. Running dynos are automatically restarted, so there’s no need to manually restart your app.
If your app instead uses Heroku’s container stack (most apps don’t), you must rebuild your app’s Docker image to pick up any updates in the base image specified in your Dockerfile.
The base images of Heroku’s stacks are built from Ubuntu Long Term Support (LTS) releases and so the package versions are those available for the corresponding Ubuntu LTS release.
It is therefore expected that the package version numbers (such as the OpenSSL version) will not match
the version numbers elsewhere, since as part of the Ubuntu security and bug fix backport process
typically only the version number suffix (eg -1ubuntu1.2) is incremented.
Instead, use Ubuntu’s CVE search tool to determine the fix status and package version for a particular CVE ID.
Addition of new stacks
Heroku stacks are currently based on Ubuntu Linux from Canonical. We strive to introduce updated stack versions as Long Term Support (LTS) versions are released upstream, which happens around April in even-numbered calendar years. Heroku stack releases will generally trail the Ubuntu release by some months to ensure that packages have stabilized and to give Heroku time to build and test the new stack.
Retirement of old stacks
Old stacks are retired when they are no longer receiving support from Canonical (typically five years after Canonical first introduced the LTS release in question; see the Stacks page for the end-of-life date of each stack). Heroku will notify users with apps on old stacks before they are retired. Notifications are in the form of changelog entries and direct emails to owners and collaborators on apps running on stacks that are about to be retired.
Retiring a stack does not affect built apps on that stack, which will continue to run indefinitely, but can no longer be deployed without first upgrading to a newer stack once the retired stack has reached end-of-life.
Customers are advised to always keep their apps updated to the latest stack in order to receive stability and security updates for their applications.