FWIW beyond what you see on the surface there are some significant differences between TurnKey and Bitnami. You may not be that interested but I can't help but use this opportunity to spruik TurnKey. I hope you'll forgive my indulgence! If you want to skip my rant, then please feel free to scroll down to "But to the crux of your question(s):" (in bold).

We've been around about the same period of time (us since 2008; them since 2007). We both package open source software in a "ready to use" package that includes dependencies/software stack. We both provide downloadable VMs and support launching direct to the cloud.

But that's pretty much where the similarities end. Perhaps to our detriment (in commercial business terms anyway) we have always focused on being open source and aimed to empower people by lowering the bar to access the immense amount of open source software out there. We always try to be as transparent as possible whilst using a business model that allows us to keep the lights on in a sustainable way.

Our whole build chain is open source and free to download (so you can build your own appliances if you desire or if you don't trust us you can replicate the existing ones in your own network). Whilst Bitnami's products are integrations of open source software (as are ours), their "installers" are not transparent. All of our build code is on GitHub for public inspection.

We leverage the existing OS security measures so the majority of components (all in some appliances) receive auto security updates to included software. Rather than provide "installers" (as Bitnami do) we believe that by providing a full OS with the software stack on top, our appliances provide a more stable and reliable product. Their VMs are simply an Ubuntu image with software preinstalled by their "installer"; ours are a fully integrated (Debian based) Operating System.

Sorry about that; enough of my bleating about how awesome we are...

We are aware that sometimes the software version included in our appliances does get quite out of sync with upstream. Occasionally there is good reason for that, but usually to just comes down to a labour bottleneck. Ideally we'd like to keep our software more up to date but it takes a huge amount of effort. We have plans in the pipeline to make updates easier for us (so quicker to release) but that is still in it's infancy and probably won't see the light of day for some time.

But to the crux of your question(s):

I'm not sure if you've checked it out, but if you choose to use our integrated backup and migration tool (TKLBAM) you can update the included software yourself and use TKLBAM to migrate to newer TurnKey versions as they are released. As I mentioned in response to a recent question the "point releases" are generally of limited value to current users (at least with their current running servers anyway).

The way TKLBAM is configured by default; it will generally migrate your whole site. In the case of PHPList it will actually include the install of PHPList itself. So if you don't update PHPList a TKLBAM migration will keep the old version. If you update PHPList then the migration will also include the updated version of PHPList.

However I suggest that you don't just take my word for it. I would encourage you to check it out yourself. If you update the version of PHPList software in your appliance and then run a full backup. Then test that by restoring to a new (temporary) instance of our PHPList appliance. If it doesn't work as I'm suggesting it does, please let us know. Furthermore, if you encounter any issues, please post and we will try to help as much as we can.

Regardless, I would really love to hear how your PHPList update experience goes. If you hit any gocthas please post back and I will try to help. If you can take notes as you perform your upgrade and share them somewhere public (e.g. post here or in a new thread) I'm sure that it will be helpful for other users in a similar situation to you.

And we always love user feedback. In many respects new user feedback is particularly valuable as we can get insight into the pain points that you might experience (and the things we are doing right). Many things that may seem obvious to us; may not really be that obvious to newer users...