[dependabot]

Bumps nginx from 1.31.6-alpine to 1.31.7-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hleroy]

SAFE TO MERGE

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian Security Checks ✅ · MERGEABLE / CLEAN
Release age: nginx 1.31.7 released upstream 2026-10-14; the official nginx:1.31.7-alpine image was built 2026-10-14T18:51:35Z and pushed 2026-10-15T16:51:32Z — 9 days old, past the 7-day cooldown:, so not a cooldown bypass. This is nonetheless a security release (5 CVEs), so the Step 2b checks were run and are recorded below.

Package	Old → New	Type	Finding
nginx (docker)	1.31.6-alpine@sha256:df221db…beac2 → 1.31.7-alpine@sha256:892bb21…2d33d	patch	Security release. Security: alias + rewrite buffer overflow (CVE-2026-15176); buffer overflow evaluating string expressions with variables, affecting document-root calculation and request logging (CVE-2026-93479); HTTP/3 unknown frame treated as request body, bypassing client_max_body_size (CVE-2026-95101); uninitialised TLS session-ticket rotation key allowing session forgery (CVE-2026-97629); AIO + SSI include virtual use-after-free (CVE-2026-97205). Features: GeoIP MMDB support, backend SSL cert verification by IP, QUIC reconfiguration under quic_bpf. Change: ngx_http_v2_module switches to RFC 9218 prioritisation, RFC 7540 priority signals ignored. Bugfixes: cached X-Accel-Redirect segfault, ngx_http_dav_module COPY/MOVE-under-alias segfault, quic flood detected with a small http3_stream_buffer_size, SSL shutdown-without-close_notify now logged as an error, spurious [crit] SSL_write() failed.

Step 2b (security release):

1. Advisory applicability — all five CVEs affect 1.31.6 and earlier; 1.31.7 is the first patched version (no version skipping). Grepped compose/production/nginx/ for every vulnerable path: rewrite 0 hits, ssi 0, aio 0, http2 0, http3 0, quic 0, ssl_ 0, geoip 0, dav 0. The container listens on plain listen 80 behind Traefik, which terminates TLS — so CVE-2026-15176 (needs rewrite), CVE-2026-95101 (HTTP/3), CVE-2026-97629 (TLS tickets) and CVE-2026-97205 (AIO+SSI) are all structurally unreachable here. CVE-2026-93479 is the generic one (string expressions with variables in document-root calculation and request logging) and this config does evaluate variables in try_files $uri, proxy_set_header and the access log — so the fix is a real improvement for this deployment, which is an argument for taking the bump rather than against it.
2. Artifact verified — anonymous registry token + HEAD /v2/library/nginx/manifests/1.31.7-alpine returns docker-content-digest: sha256:892bb2152464f0c5d8972593a5f5afaf8054552580b699d95f8ff4af08c2d33d, byte-identical to the digest in this diff, as an OCI image index. Pulled the amd64 child manifest's config blob: NGINX_VERSION=1.31.7, created: 2026-10-14T18:51:35Z. The tag moved 1.31.6-alpine → 1.31.7-alpine and the @sha256 pin is retained (not dropped).
3. Provenance — docker.io/nginx = the official library/nginx Docker Hub image, same source as the previous pin, normal multi-arch official build (amd64/arm v6/v7/… platforms present in the index).
4. Not pulled — the tag still resolves and is what the registry currently serves; no retraction or re-push.

Impact on this codebase: Only compose/production/nginx/Dockerfile changes (one FROM line). No nginx directive this config uses has changed semantics in 1.31.7. The two alias locations (/static/ and = /static/manifest.webmanifest) are safe without rewrite; the X-Accel-Redirect and ngx_http_dav_module bugfixes are inapplicable (grepped: no X-Accel-Redirect anywhere — radar/views.py:544 sets X-Accel-Buffering, which is a different header, and no WebDAV module is loaded). The RFC 9218 HTTP/2 prioritisation change needs an http2 listener, which this server block does not have.

Invariants:

• An nginx major is DO NOT MERGE — this is 1.31.6 → 1.31.7, a patch. Not a major.
• location = / + terminal location / { return 404; } — untouched by the diff, and 1.31.7 changes nothing in location matching or try_files fall-through, so the soft-404 trap stays closed.
• Base images pinned as tag@sha256:<index digest> — preserved; the digest was independently re-verified against the registry (point 2).
• SSE stays unbuffered (location = /api/lightning/stream, proxy_buffering off) — no proxy-buffering change in this release.
• Tile serving, the /tiles/… regex location and the Django fallback are unaffected.

Verdict rationale: A patch bump of the official nginx image whose digest matches what the registry serves for that exact tag, whose in-image NGINX_VERSION confirms 1.31.7, and which is past cooldown. It fixes five CVEs, four of which this deployment cannot reach and one of which it can — so merging strictly reduces exposure. Nothing in the release's features, changes or bugfixes touches a directive this config uses, and all checks are green.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code