chore: upgrade app nginx to 1.31.8 #10

2026-10-23T02:33:02Z

autonomic-bot commented

2026-10-23 02:33:02 +00:00

Upgrade: nginx 1.31.7 → 1.31.8 (custom-html)

Bumps the app nginx image on the same stable-tag scheme (1.31.x), preserving the existing tag+digest pin style. abra recipe upgrade cannot parse tag+digest pins (Docker references with both a tag and digest are currently not supported), so the bump and digest re-resolution were done by hand.

Image tag table

service	image	current	new
app	nginx	`1.31.7@sha256:6c3fee1d…522f47`	`1.31.8@sha256:6e67f8ea…a60def`

New digest resolved with docker buildx imagetools inspect nginx:1.31.8 --format '{{.Manifest.Digest}}' → sha256:6e67f8eaac94fc456588d4ff6c470d984841f5b5dc4279863d5cbe6ec5a60def (multi-arch index digest, same pin style as before).

Upstream release notes: app nginx 1.31.7→1.31.8: https://nginx.org/en/CHANGES

Operator Action Required

None. 1.31.8 (21 Oct 2026) is a regular bugfix release with no security fixes. Notable changes:

internal JSON parser string-event API change (no njs/JSON use in this recipe);
working_directory is now relative to the nginx prefix instead of the CWD (not used here);
HTTP/3 SIGBUS, kernel-TLS/OpenSSL 3.2 recv() alert, and Solaris build fixes.

None affect custom-html's static-file serving. No config, env, volume, or migration changes.

Advisory scan

Deterministic scan (window 1.31.7 → 1.31.8, image nginx=1.31.7:1.31.8): 0 CVEs fixed by this upgrade, no failed sources.
Adjudication pass: 57 older nginx CVEs were surfaced from the changelog but all belong to releases at or before 1.31.7; none fall in the 1.31.7→1.31.8 window. (1.31.7's five CVEs were fixed by the previous upgrade.)

Verification

Direct --chaos deploy on the cc-ci server: nginx 1.31.8 started cleanly and served HTTP 200; dev deploy torn down and verified gone.
!testme on this PR is the gate.

Release

The recipe version label is intentionally not bumped in this PR. After merge, publish with:

abra recipe release custom-html -z

(patch bump: image bugfix only, no recipe feature/config change)

Nothing was merged — this PR awaits operator review.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Upgrade: nginx 1.31.7 → 1.31.8 (custom-html) Bumps the `app` nginx image on the same stable-tag scheme (1.31.x), preserving the existing tag+digest pin style. `abra recipe upgrade` cannot parse tag+digest pins (`Docker references with both a tag and digest are currently not supported`), so the bump and digest re-resolution were done by hand. ### Image tag table | service | image | current | new | |---------|-------|---------|-----| | app | nginx | `1.31.7@sha256:6c3fee1d…522f47` | `1.31.8@sha256:6e67f8ea…a60def` | New digest resolved with `docker buildx imagetools inspect nginx:1.31.8 --format '{{.Manifest.Digest}}'` → `sha256:6e67f8eaac94fc456588d4ff6c470d984841f5b5dc4279863d5cbe6ec5a60def` (multi-arch index digest, same pin style as before). **Upstream release notes:** app nginx 1.31.7→1.31.8: https://nginx.org/en/CHANGES ### Operator Action Required None. 1.31.8 (21 Oct 2026) is a regular bugfix release with **no security fixes**. Notable changes: - internal JSON parser string-event API change (no njs/JSON use in this recipe); - `working_directory` is now relative to the nginx prefix instead of the CWD (not used here); - HTTP/3 SIGBUS, kernel-TLS/OpenSSL 3.2 `recv()` alert, and Solaris build fixes. None affect custom-html's static-file serving. No config, env, volume, or migration changes. ### Advisory scan - Deterministic scan (window 1.31.7 → 1.31.8, image `nginx=1.31.7:1.31.8`): **0 CVEs fixed by this upgrade**, no failed sources. - Adjudication pass: 57 older nginx CVEs were surfaced from the changelog but all belong to releases at or before 1.31.7; none fall in the 1.31.7→1.31.8 window. (1.31.7's five CVEs were fixed by the previous upgrade.) ### Verification - Direct `--chaos` deploy on the cc-ci server: nginx `1.31.8` started cleanly and served HTTP 200; dev deploy torn down and verified gone. - `!testme` on this PR is the gate. ### Release The recipe version label is intentionally **not** bumped in this PR. After merge, publish with: ``` abra recipe release custom-html -z ``` (patch bump: image bugfix only, no recipe feature/config change) Nothing was merged — this PR awaits operator review. Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-10-23 02:33:03 +00:00

chore: upgrade app nginx to 1.31.8

cc-ci/testme cc-ci: success

Details

29b2e517a4

autonomic-bot requested review from trav 2026-10-23 02:33:03 +00:00

autonomic-bot requested review from notplants 2026-10-23 02:33:03 +00:00

autonomic-bot commented

2026-10-23 02:33:22 +00:00

!testme

autonomic-bot commented

2026-10-23 02:33:34 +00:00

🌻 cc-ci — custom-html @ 29b2e517 ✅ passed

full logs · dashboard

🌻 **cc-ci** — `custom-html` @ `29b2e517` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/75/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/75) [![level](https://ci.autonomic.zone/runs/75/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/75) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/75) · [dashboard](https://ci.autonomic.zone/)

autonomic-bot commented

2026-10-25 03:16:15 +00:00

Auto-closed by cc-ci canonical sweep: its changes are already in upstream main (merged upstream); mirror main re-synced

autonomic-bot closed this pull request

2026-10-25 03:16:16 +00:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/custom-html#10