diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index dc6a4d558..8028aca76 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -170,7 +170,7 @@ jobs:
           if [[ $PYTHON_VERSION == "2."* ]]; then pip install sphinx==1.8.5; fi
           if [[ $PYTHON_VERSION == '3.'* ]] ; then pip install sphinx; fi
           if [[ $PYTHON_VERSION == '3.12'* ]] ; then \
-              XAPIAN_VER=1.4.20; \
+              XAPIAN_VER=1.4.22; \
           else
               XAPIAN_VER=$(dpkg -l libxapian-dev | tail -n 1 | awk '{print $3}' | cut -d '-' -f 1); echo $XAPIAN_VER; \
           fi
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index d52845637..e0e1cfea1 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -31,7 +31,7 @@ its item class. To identify a particular issue or user, we combine the
 class with the number to create a unique label, so that user 1 (who,
 incidentally, is *always* the "admin" user) is referred to as "user1".
 Issue number 315 is referred to as "issue315". We call that label the
-item's *designator*.
+item's :term:`designator`.
 
 Items in the database are never deleted, they're just "retired". You
 can still refer to them by ID - hence removing an item won't break
@@ -411,7 +411,7 @@ propname     selects the values the item properties given by propname must
              etc)
 ============ =============================================================
 
-You may manually write URLS that contain these arguments, like so
+You may manually write URLs that contain these arguments, like so
 (whitespace has been added for clarity)::
 
     /issue?status=unread,in-progress,resolved&
@@ -445,9 +445,17 @@ Access Controls
 
 User access is controlled through Permissions. These are are grouped
 into Roles, and users have a comma-separated list of Roles assigned to
-them.
+them. Roles can allow you to access:
 
-Permissions divide access controls up into answering questions like:
+- an entire class of items (e.g. issues)
+- only certain fields of a class (e.g. you can see the username but
+  not the phone number of other users)
+- fields or classes based on your  relationship to an item (e.g.
+  you can see the phone number of your user entry since you are the
+  owner of your user entry)
+
+Other permissions divide access controls up into answering questions
+like:
 
 - may the user edit issues ("Edit", "issue")
 - is the user allowed to use the web interface ("Web Access")
@@ -460,7 +468,6 @@ the customisation documentation. Examples of new access controls are:
 - don't give users who register through e-mail web access
 - let some users edit the details of all users
 
-
 E-Mail Gateway
 ==============
 
@@ -505,7 +512,7 @@ brackets and after the class item name. So ``[issue2]`` and
 Any "re:" or "fwd:" prefixes are stripped off the subject line before
 we start looking for real information.
 
-If an item designator (class name and id number, for example
+If an item :term:`designator` (class name and id number, for example
 ``issue123``) is found there, a new "msg" item is added to the
 "messages" property for that item, and any new "file" items are added to
 the "files" property for the item.
diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 653434ef9..e8ec1f3bb 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -24,7 +24,7 @@ ARG source=local
 ARG pythonversion=3.11
 
 #FROM python:3-alpine
-FROM python@sha256:caafba876f841774905f73df0fcaf7fe3f55aaf9cb48a9e369a41077f860d4a7 as build
+FROM python@sha256:3a619e3c96fd4c5fc5e1998fd4dcb1f1403eb90c4c6409c70d7e80b9468df7df as build
 
 # Inherit global values https://github.com/moby/moby/issues/37345
 ARG appdir
@@ -133,7 +133,7 @@ RUN if [ -n "$pip_mod" ]; then pip install --no-cache-dir ${pip_mod}; fi
 # build a new smaller docker image for execution. Build image above
 # is 1G in size.
 # FROM python:3-alpine
-FROM python@sha256:caafba876f841774905f73df0fcaf7fe3f55aaf9cb48a9e369a41077f860d4a7
+FROM python@sha256:3a619e3c96fd4c5fc5e1998fd4dcb1f1403eb90c4c6409c70d7e80b9468df7df
 
 # import from global
 ARG appdir