From d681f8de357d4879f6f972b4a4a890afe5eff431 Mon Sep 17 00:00:00 2001
From: Zac Blazic <zacblazic@gmail.com>
Date: Thu, 29 Oct 2026 16:29:31 +0200
Subject: [PATCH 1/5] Upgrade nginx to v1.31.8

---
 Dockerfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 68f84ec..a6e4e95 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM zappi/nginx:1.31.3 AS builder
+FROM zappi/nginx:1.31.8 AS builder
 
 USER root
 
@@ -16,9 +16,9 @@ RUN apt-get update -y && \
 WORKDIR /usr/src/
 
 # Download nginx source
-ARG NGINX_VERSION="1.31.3"
+ARG NGINX_VERSION="1.31.8"
 ARG NGINX_PKG="nginx-${NGINX_VERSION}.tar.gz"
-ARG NGINX_SHA="a7657c50811c2d92d9895395e8b873ef60398142c4db21eb647811c38f6dd525"
+ARG NGINX_SHA="0652b760b3b772d2ec17b47c2fc15d9a95e6fe35cd5b877eadc1a62d9bc75af1"
 RUN wget "http://nginx.org/download/${NGINX_PKG}" && \
     echo "${NGINX_SHA} *${NGINX_PKG}" | sha256sum -c - && \
     tar --no-same-owner -xzf ${NGINX_PKG} --one-top-level=nginx --strip-components=1
@@ -37,7 +37,7 @@ RUN cd nginx && \
     make modules
 
 # Production container starts here
-FROM zappi/nginx:1.31.3
+FROM zappi/nginx:1.31.8
 
 USER root
 

From 66027fb34134bf9e42f434b13b75ef97053189fa Mon Sep 17 00:00:00 2001
From: Zac Blazic <zacblazic@gmail.com>
Date: Thu, 29 Oct 2026 16:29:32 +0200
Subject: [PATCH 2/5] Update changelog

---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e037735..9d3047a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.31.8
+
+* Update base image to `zappi/nginx:1.31.8`, picking up the patched
+  Brotli for CVE-2026-111497.
+
 ## 1.31.3-1
 
 * Return `X-Trace-ID` on every response, including `202` and `4xx`/`5xx`.

From ce196f5ed1a512fa0240db18e51f6a6876711e97 Mon Sep 17 00:00:00 2001
From: Zac Blazic <zacblazic@gmail.com>
Date: Thu, 29 Oct 2026 16:32:48 +0200
Subject: [PATCH 3/5] Upgrade headers-more to v0.41

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a6e4e95..608a20d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,9 +24,9 @@ RUN wget "http://nginx.org/download/${NGINX_PKG}" && \
     tar --no-same-owner -xzf ${NGINX_PKG} --one-top-level=nginx --strip-components=1
 
 # Download headers-more module source
-ARG HEADERS_MORE_VERSION="0.40"
+ARG HEADERS_MORE_VERSION="0.41"
 ARG HEADERS_MORE_PKG="v${HEADERS_MORE_VERSION}.tar.gz"
-ARG HEADERS_MORE_SHA="c14cb5e6c998590c209efbf77bd7637ce2cab02332e4192756a8af5b26ba4284"
+ARG HEADERS_MORE_SHA="800eba641c29b89dfd00a97ccac314a2b7768bdd85ea37ed819452494a5633cd"
 RUN wget "https://github.com/openresty/headers-more-nginx-module/archive/${HEADERS_MORE_PKG}" && \
     echo "${HEADERS_MORE_SHA} *${HEADERS_MORE_PKG}" | sha256sum -c - && \
     tar --no-same-owner -xzf ${HEADERS_MORE_PKG} --one-top-level=headers-more --strip-components=1

From e1f2c43652ab7fc020644437ad6b30b0a203c398 Mon Sep 17 00:00:00 2001
From: Zac Blazic <zacblazic@gmail.com>
Date: Thu, 29 Oct 2026 16:32:49 +0200
Subject: [PATCH 4/5] Update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9d3047a..496cb97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 * Update base image to `zappi/nginx:1.31.8`, picking up the patched
   Brotli for CVE-2026-111497.
+* Upgrade `headers-more-nginx-module` to `v0.41`.
 
 ## 1.31.3-1
 

From 8dc258126f5ae4378664992a6646470cb79797dd Mon Sep 17 00:00:00 2001
From: Zac Blazic <zacblazic@gmail.com>
Date: Thu, 29 Oct 2026 16:43:06 +0200
Subject: [PATCH 5/5] Simplify changelog entry

---
 CHANGELOG.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 496cb97..3ca92ce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,8 +2,7 @@
 
 ## 1.31.8
 
-* Update base image to `zappi/nginx:1.31.8`, picking up the patched
-  Brotli for CVE-2026-111497.
+* Update base image to `zappi/nginx:1.31.8`.
 * Upgrade `headers-more-nginx-module` to `v0.41`.
 
 ## 1.31.3-1