Same category of risk as the gitea :nightly issue: floating dev/beta tags let watchtower silently pull unvetted upstream builds. couchdb had no tag at all (implicit :latest); filebrowser and statping only publish beta/dev channels upstream so pinned to the exact version in use rather than a moving target.