chore: upgrade app to nginx 1.31.3 #5

Open

autonomic-bot wants to merge 3 commits from upgrade-1.14.0+1.31.1 into main

pull from: upgrade-1.14.0+1.31.1

merge into: recipe-maintainers:main

recipe-maintainers:main

recipe-maintainers:pr-20260518-194117

recipe-maintainers:regression-bad-backup

recipe-maintainers:regression-bad-restore

recipe-maintainers:v5-stale-docroot

recipe-maintainers:ci/d4-recipe-local

recipe-maintainers:pr-20260525-181102

Conversation 10 Commits 3 Files Changed 2 +2 -2

autonomic-bot commented 2026-06-17 00:08:08 +00:00

Owner

Copy Link

Extends the evolving custom-html upgrade PR: bumps the app nginx image 1.31.2 -> 1.31.3 on top of the existing 1.31.2 + alpine/git v2.54.0 work carried by branch upgrade-1.14.0+1.31.1. Diff vs upstream main 2b82eba:

service	image	current (main)	new
app	nginx	1.31.1	1.31.3
git	alpine/git	v2.52.0	v2.54.0

(The coop-cloud.${STACK_NAME}.version label is intentionally left at 1.13.0+1.31.1 per the recipe-upgrade convention — the label + git tag publish happens at release time, see below.)

Operator Action Required

None for the static-file-serving use case. nginx 1.31.3 (15 Jul 2026) is a security patch release. The only Changes touch features custom-html does not use:

• HTTP/2 response header/trailer size now limited by proxy_buffer_size / grpc_buffer_size in ngx_http_proxy_v2_module + ngx_http_grpc_module;
• external-entity loading disabled by default in ngx_http_xslt_filter_module (new xml_external_entities directive re-enables it).

No migration, no config change. No breaking changes carried over from the intermediate 1.31.2 either (those were HTTP/3/charset_map/gRPC-backend CVEs, also unused here). Just deploy and you are on the patched build.

Upstream release notes

• app nginx 1.31.2 -> 1.31.3: https://nginx.org/en/CHANGES (entry "Changes with nginx 1.31.3", 15 Jul 2026)
• intermediate app nginx 1.31.1 -> 1.31.2: https://nginx.org/en/CHANGES (entry "Changes with nginx 1.31.2", 17 Jun 2026)
• git alpine/git v2.52.0 -> v2.54.0: https://hub.docker.com/r/alpine/git/tags (thin Docker wrapper around git, no formal changelog)

Recommended release (after merge — operator step)

abra recipe release custom-html -z

(NO --dry-run — this publishes the label + tag + push.) semver reasoning: security/patch upstream -> recipe patch -z.

Verification

Direct --chaos deploy on the cc-ci Swarm (dev-custom-html, since torn down): nginx 1.31.1 -> 1.31.3 converged via a clean rolling worker update, served HTTP 200 through the proxy network, no errors in logs. !testme (cc-ci recipe CI) results below. NOT merged — for operator review.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Extends the evolving custom-html upgrade PR: bumps the `app` nginx image `1.31.2` -> `1.31.3` on top of the existing `1.31.2` + `alpine/git v2.54.0` work carried by branch `upgrade-1.14.0+1.31.1`. Diff vs upstream main `2b82eba`: | service | image | current (main) | new | |---------|-------|----------------|-----| | app | nginx | 1.31.1 | **1.31.3** | | git | alpine/git | v2.52.0 | v2.54.0 | (The `coop-cloud.${STACK_NAME}.version` label is intentionally left at `1.13.0+1.31.1` per the recipe-upgrade convention — the label + git tag publish happens at release time, see below.) ## Operator Action Required None for the static-file-serving use case. nginx 1.31.3 (15 Jul 2026) is a security patch release. The only `Change`s touch features custom-html does not use: - HTTP/2 response header/trailer size now limited by `proxy_buffer_size` / `grpc_buffer_size` in `ngx_http_proxy_v2_module` + `ngx_http_grpc_module`; - external-entity loading disabled by default in `ngx_http_xslt_filter_module` (new `xml_external_entities` directive re-enables it). No migration, no config change. No breaking changes carried over from the intermediate `1.31.2` either (those were HTTP/3/charset_map/gRPC-backend CVEs, also unused here). Just deploy and you are on the patched build. ## Upstream release notes - **app** nginx `1.31.2` -> `1.31.3`: https://nginx.org/en/CHANGES (entry "Changes with nginx 1.31.3", 15 Jul 2026) - intermediate **app** nginx `1.31.1` -> `1.31.2`: https://nginx.org/en/CHANGES (entry "Changes with nginx 1.31.2", 17 Jun 2026) - **git** alpine/git `v2.52.0` -> `v2.54.0`: https://hub.docker.com/r/alpine/git/tags (thin Docker wrapper around git, no formal changelog) ## Recommended release (after merge — operator step) ``` abra recipe release custom-html -z ``` (NO `--dry-run` — this publishes the label + tag + push.) semver reasoning: security/patch upstream -> recipe patch `-z`. ## Verification Direct `--chaos` deploy on the cc-ci Swarm (`dev-custom-html`, since torn down): nginx `1.31.1 -> 1.31.3` converged via a clean rolling worker update, served HTTP 200 through the proxy network, no errors in logs. `!testme` (cc-ci recipe CI) results below. NOT merged — for operator review. Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-06-17 00:08:08 +00:00

chore: upgrade to 1.14.0+1.31.1 e668be0f81

autonomic-bot requested review from trav 2026-06-17 00:08:08 +00:00

autonomic-bot requested review from notplants 2026-06-17 00:08:08 +00:00

autonomic-bot commented 2026-06-17 02:08:28 +00:00

Author

Owner

Copy Link

!testme

!testme

autonomic-bot commented 2026-06-17 02:08:41 +00:00

Author

Owner

Copy Link

🌻 cc-ci — custom-html @ e668be0f ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `e668be0f` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/737) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/737) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/737) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot changed title from chore: upgrade to 1.14.0+1.31.1 to chore: upgrade app to nginx 1.31.2, git to alpine/git v2.54.0 2026-06-22 20:48:36 +00:00

autonomic-bot added 1 commit 2026-06-22 20:48:36 +00:00

chore: upgrade app to nginx 1.31.2, git to alpine/git v2.54.0 817ee13659

autonomic-bot commented 2026-06-22 20:49:00 +00:00

Author

Owner

Copy Link

!testme

!testme

autonomic-bot commented 2026-06-22 20:49:02 +00:00

Author

Owner

Copy Link

🌻 cc-ci — custom-html @ 817ee136 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `817ee136` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/945) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/945) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/945) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot commented 2026-06-26 03:26:24 +00:00

Author

Owner

Copy Link

!testme

!testme

autonomic-bot commented 2026-06-26 03:26:49 +00:00

Author

Owner

Copy Link

🌻 cc-ci — custom-html @ 817ee136 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `817ee136` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/958) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/958) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/958) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot changed title from chore: upgrade app to nginx 1.31.2, git to alpine/git v2.54.0 to chore: upgrade app to 1.31.2, git to v2.54.0 2026-07-03 02:19:25 +00:00

autonomic-bot commented 2026-07-03 02:19:32 +00:00

Author

Owner

Copy Link

!testme

!testme

autonomic-bot commented 2026-07-03 02:19:45 +00:00

Author

Owner

Copy Link

🌻 cc-ci — custom-html @ 817ee136 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `817ee136` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/969) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/969) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/969) · [dashboard](https://ci.commoninternet.net/)

autonomic-bot added 1 commit 2026-07-24 03:46:22 +00:00

chore: upgrade app to nginx 1.31.3 01a55eef76

autonomic-bot changed title from chore: upgrade app to 1.31.2, git to v2.54.0 to chore: upgrade app to nginx 1.31.3 2026-07-24 03:46:37 +00:00

autonomic-bot commented 2026-07-24 03:46:43 +00:00

Author

Owner

Copy Link

!testme

!testme

autonomic-bot commented 2026-07-24 03:47:09 +00:00

Author

Owner

Copy Link

🌻 cc-ci — custom-html @ 01a55eef ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `01a55eef` ✅ **passed** [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1132) [](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1132) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1132) · [dashboard](https://ci.commoninternet.net/)

All checks were successful

Hide all checks

cc-ci/testme cc-ci: success

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin upgrade-1.14.0+1.31.1:upgrade-1.14.0+1.31.1

git checkout upgrade-1.14.0+1.31.1

Sign in to join this conversation.

Reviewers

No Reviewers

notplants

trav

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

autonomic autonomic-bot notplants trav

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/custom-html#5

No description provided.