recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(custom-html): add nginx 1.31.3 release notes

Browse Source
This commit is contained in:
cc-ci
2026-07-24 03:40:00 +00:00
parent 117685343b
commit 095b1dc75f
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cc-ci-plan/upstream/custom-html.md
View File

@ -11,5 +11,6 @@
- compose.sftp.yml and compose.sso.yml are other optional overlays; linuxserver/openssh-server uses `latest` tag and is not version-pinned.
- Breaking change in nginx 1.31.0: HTTP/2 and HTTP/3 requests with Connection/Proxy-Connection/Keep-Alive/Transfer-Encoding/Upgrade/TE headers are now rejected.
- Breaking change in nginx 1.29.7: keepalive in upstream block is enabled by default; proxy_http_version changed to 1.1; Connection proxy header no longer sent by default.
- nginx 1.31.3 (15 Jul 2026) is a security patch release: CVE-2026-42533 (heap buffer overflow in `map` directive with regex matching / non-cacheable variable in string expression), CVE-2026-60005 (uninitialized memory access with unnamed regex captures + `slice` directive / background cache update → memory disclosure or worker crash), CVE-2026-56434 (use-after-free in `ngx_http_ssi_filter_module` processing crafted proxied backend response). Two non-security `Change`s: HTTP/2 response header/trailer size now limited by `proxy_buffer_size`/`grpc_buffer_size` in `ngx_http_proxy_v2_module`+`ngx_http_grpc_module`; external-entity loading disabled by default in `ngx_http_xslt_filter_module` (new `xml_external_entities` directive re-enables it). Plus bugfixes (HTTP/2 out-of-order pseudo-headers, flow control, Upgrade header in HTTP/2/3 responses). NONE of these changes affect the custom-html static-file-serving use case (no `map`, no `slice`/cache, no SSI, no xslt, no proxy_v2/grpc). No breaking config changes — no operator action required beyond the image pull.
- nginx 1.31.2 (17 Jun 2026) is a security patch release: CVE-2026-42530 (HTTP/3 QUIC use-after-free), CVE-2026-42055 (heap buffer overflow with ignore_invalid_headers off + large_client_header_buffers + HTTP/2/gRPC backend), CVE-2026-48142 (charset_map UTF-8 heap overread). No breaking changes for static-file-serving use case.
- alpine/git is a thin Docker wrapper around git (no formal release notes; version tracks bundled git). Source repo: alpine-docker/git (NOT alpine-git/alpine-git).