deps(deps): update dependency nginx/nginx to v1.31.0

[renovate]

This PR contains the following updates:

Package	Update	Change
nginx/nginx	minor	1.30.0 → 1.31.0

---

Release Notes

nginx/nginx (nginx/nginx)

v1.31.0

Compare Source

nginx-1.31.0 mainline version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-42934), address spoofing vulnerability in HTTP/3 (CVE-2026-40460), and use-after-free vulnerability in OCSP requests to resolver (CVE-2026-40701). Additionally, the release features support for HTTP forward proxy.

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• GH: add a workflow to check for the 'version bump' commit by @​ac000 in #​1240
• Connection specific headers by @​arut in #​1257
• Updated OpenSSL used for win32 builds. by @​pluknet in #​1269
• SSL: logging level fixes. by @​bavshin-f5 in #​1258
• Changes in ngx_quic_cbs_recv_rcd() by @​pluknet in #​1279
• SSL: log SSL_R_RECORD_LAYER_FAILURE at info level by @​Smeet23 in #​1267
• Restrict duplicate TE headers in HTTP/2 and HTTP/3. by @​arut in #​1275
• HTTP/3: optimize encoder stream memory usage by @​arut in #​1274
• Stream: support ALPN for proxy_ssl upstream. by @​VadimZhestikov in #​1109
• Prevent Undefined Behaviour in memcpy(3) via ngx_init_cycle() by @​ac000 in #​1082
• GH: Add various bits of GitHub automation by @​ac000 in #​1172
• Configure: added synonym for the upstream sticky module option by @​hyuan-netizen in #​1292
• Stream: evaluate proxy_ssl_alpn once by @​pluknet in #​1304
• Request body: fixed empty body buffering special case. by @​pluknet in #​977
• Configure: fix gcc version detection in some corner cases by @​ac000 in #​1305
• Upstream: least_time load balancing for HTTP and stream. by @​saikrishnakumarreddy in #​1306
• Dav: improved path validation for COPY and MOVE operations by @​saikrishnakumarreddy in #​1307
• Proxy: fix keepalive for HTTP/2 when no body is specified by @​arut in #​1314
• GH: update the stale PR/issue workflow by @​ac000 in #​1315
• HTTP CONNECT proxy. by @​arut in #​707
• Reject HTTP CONNECT method with no port after colon by @​pluknet in #​1335
• GH: set new issues creation date by @​ac000 in #​1272
• nginx-1.31.0-RELEASE by @​pluknet in #​1350

New Contributors

• @​Smeet23 made their first contribution in #​1267
• @​hyuan-netizen made their first contribution in #​1292
• @​saikrishnakumarreddy made their first contribution in #​1306

Full Changelog: nginx/nginx@release-1.29.8...release-1.31.0

v1.30.1

Compare Source

nginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-42934), address spoofing vulnerability in HTTP/3 (CVE-2026-40460), and use-after-free vulnerability in OCSP requests to resolver (CVE-2026-40701).

See official CHANGES-1.30 on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• nginx-1.30.1-RELEASE by @​pluknet in #​1351

Full Changelog: nginx/nginx@release-1.30.0...release-1.30.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.