[zacblazic]

Overview

The proxy inherits a vulnerable version of the Brotli library (CVE-2026-111497) from its nginx base image. This moves it to the upgraded nginx 1.31.8 base, which includes the patched library, and picks up the latest headers-more release while the module is rebuilt anyway.

Changes

• Base image
  • Both stages move to zappi/nginx:1.31.8.
  • The headers-more build uses the nginx 1.31.8 source to match, checked against its PGP-signed release.
  • nginx-module-otel follows the base and resolves to 1.31.8+0.1.2-1~trixie.
• headers-more
  • v0.40 → v0.41, whose only functional change is a media type matching and charset replacement bugfix.
• Changelog
  • Adds the 1.31.8 entry.

Testing

• Builds locally against a local build of zappi/nginx:1.31.8.
• In the compose example, proxied requests return HTTP 200 with X-Trace-ID, headers-more clears Server and sets X-Robots-Tag, and the 18081 health check returns 200.
• CI fails until zappi/nginx:1.31.8 is released from the related PR.

Risk

• Low. Both dynamic modules load and behave as before against nginx 1.31.8.
• Apps pick up the image through their tag in kubernetes-config-pack, so rollback is pinning zappi/nginx-proxy:1.31.3-1 again.

Related

• [INFRA-493] Upgrade nginx to v1.31.8 docker-nginx#19

References

• INFRA-493