nginx 1.25.4 + njs 0.8.3 + headers-more-nginx-module 0.37

Changes with nginx 1.25.4                                        14 Feb 2024

    *) Security: when using HTTP/3 a segmentation fault might occur in a
       worker process while processing a specially crafted QUIC session
       (CVE-2024-24989, CVE-2024-24990).

    *) Bugfix: connections with pending AIO operations might be closed
       prematurely during graceful shutdown of old worker processes.

    *) Bugfix: socket leak alerts no longer logged when fast shutdown was
       requested after graceful shutdown of old worker processes.

    *) Bugfix: a socket descriptor error, a socket leak, or a segmentation
       fault in a worker process (for SSL proxying) might occur if AIO was
       used in a subrequest.

    *) Bugfix: a segmentation fault might occur in a worker process if SSL
       proxying was used along with the "image_filter" directive and errors
       with code 415 were redirected with the "error_page" directive.

    *) Bugfixes and improvements in HTTP/3.

What's Changed

• nginx 1.25.4 + njs 0.8.3 + headers-more-nginx-module 0.37 by @macbre in #135

Full Changelog: v1.25.3...v1.25.4

nginx 1.25.3 + uid and gid ARG for nginx user + fix nginx.pid file permissions

Changes with nginx 1.25.3                                        24 Oct 2023

    *) Change: improved detection of misbehaving clients when using HTTP/2.

    *) Feature: startup speedup when using a large number of locations.
       Thanks to Yusuke Nojima.

    *) Bugfix: a segmentation fault might occur in a worker process when
       using HTTP/2 without SSL; the bug had appeared in 1.25.1.

    *) Bugfix: the "Status" backend response header line with an empty
       reason phrase was handled incorrectly.

    *) Bugfix: memory leak during reconfiguration when using the PCRE2
       library.
       Thanks to ZhenZhong Wu.

    *) Bugfixes and improvements in HTTP/3.

What's Changed

• Added uid and gid ARG for nginx user by @victor-sm in #123
• Fix for "nginx.pid failed (13: Permission denied)" error by @victor-sm in #125
• Update readme.md with example docker compose by @SkyZeroZx in #130
• Update Dockerfile: v1.25.3 by @macbre in #134

New Contributors

• @victor-sm made their first contribution in #123
• @SkyZeroZx made their first contribution in #130

Full Changelog: v1.25.2...v1.25.3

nginx 1.25.2 + njs 0.8.1

Changes with nginx 1.25.2                                        15 Aug 2023

    *) Feature: path MTU discovery when using HTTP/3.

    *) Feature: TLS_AES_128_CCM_SHA256 cipher suite support when using
       HTTP/3.

    *) Change: now nginx uses appname "nginx" when loading OpenSSL
       configuration.

    *) Change: now nginx does not try to load OpenSSL configuration if the
       --with-openssl option was used to built OpenSSL and the OPENSSL_CONF
       environment variable is not set.

    *) Bugfix: in the $body_bytes_sent variable when using HTTP/3.

    *) Bugfix: in HTTP/3.

What's Changed

• Bump macbre/push-to-ghcr from 12 to 13 by @dependabot in #119
• Bump docker/build-push-action from 4 to 5 by @dependabot in #121
• Bump actions/checkout from 3 to 4 by @dependabot in #120
• nginx 1.25.2 + njs 0.8.1 by @macbre in #122

Full Changelog: v1.25.1...v1.25.2

nginx 1.25.1

The main code branch of nginx now features the still experimental HTTP/3 support.

Changes with nginx 1.25.1                                        13 Jun 2023

    *) Feature: the "http2" directive, which enables HTTP/2 on a per-server
       basis; the "http2" parameter of the "listen" directive is now
       deprecated.

    *) Change: HTTP/2 server push support has been removed.

    *) Change: the deprecated "ssl" directive is not supported anymore.

    *) Bugfix: in HTTP/3 when using OpenSSL.


Changes with nginx 1.25.0                                        23 May 2023

    *) Feature: experimental HTTP/3 support.

What's Changed

• fix: Update BoringSSL commit by @yo-han in #112
• nginx to 1.25.1, other updates, and update docs and configs. by @justdan6 in #113

New Contributors

• @yo-han made their first contribution in #112
• @justdan6 made their first contribution in #113

Full Changelog: v1.23.4...v1.25.1

nginx 1.23.4

Changes with nginx 1.23.4                                        28 Mar 2023

    *) Change: now TLSv1.3 protocol is enabled by default.

    *) Change: now nginx issues a warning if protocol parameters of a
       listening socket are redefined.

    *) Change: now nginx closes connections with lingering if pipelining was
       used by the client.

    *) Feature: byte ranges support in the ngx_http_gzip_static_module.

    *) Bugfix: port ranges in the "listen" directive did not work; the bug
       had appeared in 1.23.3.
       Thanks to Valentin Bartenev.

    *) Bugfix: incorrect location might be chosen to process a request if a
       prefix location longer than 255 characters was used in the
       configuration.

    *) Bugfix: non-ASCII characters in file names on Windows were not
       supported by the ngx_http_autoindex_module, the ngx_http_dav_module,
       and the "include" directive.

    *) Change: the logging level of the "data length too long", "length too
       short", "bad legacy version", "no shared signature algorithms", "bad
       digest length", "missing sigalgs extension", "encrypted length too
       long", "bad length", "bad key update", "mixed handshake and non
       handshake data", "ccs received early", "data between ccs and
       finished", "packet length too long", "too many warn alerts", "record
       too small", and "got a fin before a ccs" SSL errors has been lowered
       from "crit" to "info".

    *) Bugfix: a socket leak might occur when using HTTP/2 and the
       "error_page" directive to redirect errors with code 400.

    *) Bugfix: messages about logging to syslog errors did not contain
       information that the errors happened while logging to syslog.
       Thanks to Safar Safarly.

    *) Workaround: "gzip filter failed to use preallocated memory" alerts
       appeared in logs when using zlib-ng.

    *) Bugfix: in the mail proxy server.

nginx 1.23.3

Changes with nginx 1.23.3                                        13 Dec 2022

    *) Bugfix: an error might occur when reading PROXY protocol version 2
       header with large number of TLVs.

    *) Bugfix: a segmentation fault might occur in a worker process if SSI
       was used to process subrequests created by other modules.
       Thanks to Ciel Zhao.

    *) Workaround: when a hostname used in the "listen" directive resolves
       to multiple addresses, nginx now ignores duplicates within these
       addresses.

    *) Bugfix: nginx might hog CPU during unbuffered proxying if SSL
       connections to backends were used.

Potential breaking changes

Please note that thanks to #97 this container now runs the nginx daemon as a non-root user. You may need to update the ports your nginx binds if your using anything below port 1024.

nginx 1.23.2

Changes with nginx 1.23.2                                        19 Oct 2022

    *) Security: processing of a specially crafted mp4 file by the
       ngx_http_mp4_module might cause a worker process crash, worker
       process memory disclosure, or might have potential other impact
       (CVE-2022-41741, CVE-2022-41742).

    *) Feature: the "$proxy_protocol_tlv_..." variables.

    *) Feature: TLS session tickets encryption keys are now automatically
       rotated when using shared memory in the "ssl_session_cache"
       directive.

    *) Change: the logging level of the "bad record type" SSL errors has
       been lowered from "crit" to "info".
       Thanks to Murilo Andrade.

    *) Change: now when using shared memory in the "ssl_session_cache"
       directive the "could not allocate new session" errors are logged at
       the "warn" level instead of "alert" and not more often than once per
       second.

    *) Bugfix: nginx/Windows could not be built with OpenSSL 3.0.x.

    *) Bugfix: in logging of the PROXY protocol errors.
       Thanks to Sergey Brester.

    *) Workaround: shared memory from the "ssl_session_cache" directive was
       spent on sessions using TLS session tickets when using TLSv1.3 with
       OpenSSL.

    *) Workaround: timeout specified with the "ssl_session_timeout"
       directive did not work when using TLSv1.3 with OpenSSL or BoringSSL.

nginx 1.23.1

This release got a bit delayed due to some issues with being able to properly test http/3 in the CI. Thanks @imraan-go for a helpful hint here!

Changes with nginx 1.23.1                                        19 Jul 2022

    *) Feature: memory usage optimization in configurations with SSL
       proxying.

    *) Feature: looking up of IPv4 addresses while resolving now can be
       disabled with the "ipv4=off" parameter of the "resolver" directive.

    *) Change: the logging level of the "bad key share", "bad extension",
       "bad cipher", and "bad ecpoint" SSL errors has been lowered from
       "crit" to "info".

    *) Bugfix: while returning byte ranges nginx did not remove the
       "Content-Range" header line if it was present in the original backend
       response.

    *) Bugfix: a proxied response might be truncated during reconfiguration
       on Linux; the bug had appeared in 1.17.5.

nginx 1.21.6

Changes with nginx 1.21.6                                        25 Jan 2022

    *) Bugfix: when using EPOLLEXCLUSIVE on Linux client connections were
       unevenly distributed among worker processes.

    *) Bugfix: nginx returned the "Connection: keep-alive" header line in
       responses during graceful shutdown of old worker processes.

    *) Bugfix: in the "ssl_session_ticket_key" when using TLSv1.3.

nginx 1.21.5

Please note that $quic variable has been removed in favour of $http3 (https://hg.nginx.org/nginx-quic/rev/651cc905b7c2).

Changes with nginx 1.21.5                                        28 Dec 2021

    *) Change: now nginx is built with the PCRE2 library by default.

    *) Change: now nginx always uses sendfile(SF_NODISKIO) on FreeBSD.

    *) Feature: support for sendfile(SF_NOCACHE) on FreeBSD.

    *) Feature: the $ssl_curve variable.

    *) Bugfix: connections might hang when using HTTP/2 without SSL with the
       "sendfile" and "aio" directives.