chore: upgrade app nginx to 1.31.7 #9

Open

autonomic-bot wants to merge 1 commits from upgrade-2970375 into main

pull from: upgrade-2970375

merge into: :main

:main

:upgrade-2970375

:upgrade-4e5976f

:upgrade-1ca92f1

:forceSsl

:upgrade-1.14.0+1.31.1

:pr-20260518-194117

:regression-bad-backup

:regression-bad-restore

:v5-stale-docroot

:ci/d4-recipe-local

:pr-20260525-181102

Conversation 2 Commits 1 Files Changed 1

+1 -1

autonomic-bot commented 2026-10-16 02:16:47 +00:00

Owner

Copy Link

Copy Source

custom-html recipe upgrade — nginx 1.31.6 → 1.31.7

DEFAULT mode (recipe PR only; existing cc-ci tests; no test changes).

Image tag table

service	image	current	→ new
app	nginx	1.31.6@sha256:908dc23e…	1.31.7@sha256:6c3fee1d… (manifest-list digest re-pinned)
git	alpine/git	v2.54.0	unchanged (abra sees no newer tag)
ssh / sshstart	linuxserver/openssh-server	latest@sha256:946fa261…	unchanged (floating latest pin, intentional)

nginx is pinned tag+digest, so abra recipe upgrade cannot bump it (it FATAs on "tag and digest … not
supported"); the new tag+digest was resolved and applied by hand, preserving the pin style.

Upstream release notes

Upstream release notes: app nginx 1.31.6→1.31.7: https://nginx.org/en/CHANGES

nginx 1.31.7 (14 Oct 2026) is a security patch release. Five security fixes:

• CVE-2026-15176 — buffer overflow in a worker using alias when the URI was changed by rewrite.
• CVE-2026-93479 — buffer overflow evaluating string expressions with variables (document-root calc / logging).
• CVE-2026-95101 — HTTP/3: part of an unknown frame treated as request body (bypass client_max_body_size / inject into proxied request).
• CVE-2026-97629 — TLS session-ticket key rotation left one key uninitialized (session forgery).
• CVE-2026-97205 — use-after-free with AIO when an SSI page has include virtual.

Plus features (geoip MMDB support, backend SSL certificate verification by IP, QUIC reconfiguration +
binary upgrade with quic_bpf), a change (HTTP/2 now uses RFC 9218 prioritisation; RFC 7540 signals
ignored), and bugfixes.

Advisory scan

Deterministic scan (cc-ci-plan/advisory-scan.py custom-html --from 1.31.6 --to 1.31.7 --image nginx=1.31.6:1.31.7):
5 CVEs fixed by this upgrade — CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205,
CVE-2026-97629 — matching the release-note read exactly (union: 5). The 52 unclassified advisories are
historic nginx CVEs fixed at ≤1.31.6 (vendor CHANGES page only, no structured version window); an
--adjudicate pass confirmed none are newly fixed by this window. No scan source failed.

Operator Action Required

None for the custom-html static-file-serving shape. The recipe serves static HTML from a volume on
port 80 behind traefik (HTTP/1.1+HTTP/2; no HTTP/3/QUIC listener, no AIO/SSI, no rewrite+alias
path mapping, no session-ticket-rotation config). No breaking config changes, no migrations, no
dependency bumps. Being a security release, upgrading promptly is warranted.

Version label

Intentionally not bumped by this PR (label stays 1.14.1+1.31.6); the operator's release applies it:

abra recipe release custom-html -z

(no --dry-run; run after merge — this PR does not publish).

Evidence

• Step-2b direct deploy on cc-ci (dev-custom-html.ci.commoninternet.net, --chaos): deploy succeeded
  🟢; service 1/1 running nginx:1.31.7; clean startup logs (nginx/1.31.7); nginx -v =
  nginx/1.31.7; live HTTP 200 over HTTP/2 through traefik. Dev deploy torn down afterwards
  (0 leaked stacks / volumes).
• abra recipe lint custom-html -C -n: all error-level rules pass; only pre-existing warnings
  (R002 healthcheck, R004/R005 from the floating-tag sftp overlay).
• Diff vs upstream main: exactly the one-line nginx tag+digest change.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## custom-html recipe upgrade — nginx 1.31.6 → 1.31.7 DEFAULT mode (recipe PR only; existing cc-ci tests; no test changes). ### Image tag table | service | image | current | → new | |---------|-------|---------|-------| | app | nginx | `1.31.6@sha256:908dc23e…` | `1.31.7@sha256:6c3fee1d…` (manifest-list digest re-pinned) | | git | alpine/git | `v2.54.0` | unchanged (abra sees no newer tag) | | ssh / sshstart | linuxserver/openssh-server | `latest@sha256:946fa261…` | unchanged (floating `latest` pin, intentional) | `nginx` is pinned tag+digest, so `abra recipe upgrade` cannot bump it (it FATAs on "tag and digest … not supported"); the new tag+digest was resolved and applied by hand, preserving the pin style. ### Upstream release notes **Upstream release notes:** app nginx 1.31.6→1.31.7: https://nginx.org/en/CHANGES nginx **1.31.7 (14 Oct 2026)** is a security patch release. Five security fixes: - **CVE-2026-15176** — buffer overflow in a worker using `alias` when the URI was changed by `rewrite`. - **CVE-2026-93479** — buffer overflow evaluating string expressions with variables (document-root calc / logging). - **CVE-2026-95101** — HTTP/3: part of an unknown frame treated as request body (bypass `client_max_body_size` / inject into proxied request). - **CVE-2026-97629** — TLS session-ticket key rotation left one key uninitialized (session forgery). - **CVE-2026-97205** — use-after-free with AIO when an SSI page has `include virtual`. Plus features (geoip MMDB support, backend SSL certificate verification by IP, QUIC reconfiguration + binary upgrade with `quic_bpf`), a change (HTTP/2 now uses RFC 9218 prioritisation; RFC 7540 signals ignored), and bugfixes. ### Advisory scan Deterministic scan (`cc-ci-plan/advisory-scan.py custom-html --from 1.31.6 --to 1.31.7 --image nginx=1.31.6:1.31.7`): **5 CVEs fixed by this upgrade** — CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629 — matching the release-note read exactly (union: 5). The 52 unclassified advisories are historic nginx CVEs fixed at ≤1.31.6 (vendor CHANGES page only, no structured version window); an `--adjudicate` pass confirmed none are newly fixed by this window. No scan source failed. ### Operator Action Required **None** for the custom-html static-file-serving shape. The recipe serves static HTML from a volume on port 80 behind traefik (HTTP/1.1+HTTP/2; no HTTP/3/QUIC listener, no AIO/SSI, no `rewrite`+`alias` path mapping, no session-ticket-rotation config). No breaking config changes, no migrations, no dependency bumps. Being a security release, upgrading promptly is warranted. ### Version label Intentionally **not** bumped by this PR (label stays `1.14.1+1.31.6`); the operator's release applies it: ``` abra recipe release custom-html -z ``` (no `--dry-run`; run after merge — this PR does not publish). ### Evidence - Step-2b direct deploy on cc-ci (`dev-custom-html.ci.commoninternet.net`, `--chaos`): deploy succeeded 🟢; service 1/1 running `nginx:1.31.7`; clean startup logs (`nginx/1.31.7`); `nginx -v` = `nginx/1.31.7`; live HTTP **200 over HTTP/2** through traefik. Dev deploy torn down afterwards (0 leaked stacks / volumes). - `abra recipe lint custom-html -C -n`: all error-level rules pass; only pre-existing warnings (R002 healthcheck, R004/R005 from the floating-tag sftp overlay). - Diff vs upstream main: exactly the one-line `nginx` tag+digest change. Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants

autonomic-bot added 1 commit 2026-10-16 02:16:48 +00:00

chore: upgrade app nginx to 1.31.7 2970375772

autonomic-bot requested review from trav 2026-10-16 02:16:48 +00:00

autonomic-bot requested review from notplants 2026-10-16 02:16:48 +00:00

autonomic-bot commented 2026-10-16 02:16:54 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-10-16 02:17:27 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — custom-html @ 29703757 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `custom-html` @ `29703757` ✅ **passed** [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/54) [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/54) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/54) · [dashboard](https://ci.autonomic.zone/)

All checks were successful

Hide all checks

cc-ci/testme cc-ci: success

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin upgrade-2970375:upgrade-2970375

git checkout upgrade-2970375

Sign in to join this conversation.

Reviewers

No Reviewers

trav

notplants

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/custom-html#9