I just checked out the flowable-release-6.4.1
branch:
git clone -b flowable-release-6.4.1 https://github.com/flowable/flowable-engine.git
And noticed that the all-in-one Dockerfile refers to Tomcat v8.5.34
However, the all-in-one image on Docker Hub (tagged 6.4.1) refers to Tomcat v8.5.37
Even the master branch (6.5.0-SNAPSHOT) refers to Tomcat v8.5.34