From 859ecf7b64bbb0db90023f43793d7ff2dd7f7c0a Mon Sep 17 00:00:00 2001
From: King'ori Maina <j@kingori.co>
Date: Tue, 28 Jul 2026 12:58:21 +0200
Subject: [PATCH 1/2] Upgrade nginx to v1.31.3

Catch the image up to the current nginx mainline release on Debian
Trixie. The Bookworm variants of the official nginx image are no
longer rebuilt, so base OS security fixes had stopped landing; moving
to Trixie restores that stream. The push was prompted by
CVE-2025-69419 in libssl (patched in Trixie's OpenSSL
3.5.6-1~deb13u2), which this upgrade addresses along with other
accumulated base-image fixes.
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index ed5cef2..9848f5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:1.27.4-bookworm
+FROM nginx:1.31.3-trixie
 
 ENV NGINX_ENTRYPOINT_QUIET_LOGS=1
 

From 9b32bcbc2d5dbb3a57b3d4e33248e798c4068efd Mon Sep 17 00:00:00 2001
From: King'ori Maina <j@kingori.co>
Date: Tue, 28 Jul 2026 12:58:21 +0200
Subject: [PATCH 2/2] Update changelog

---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9f5d64..de426ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.31.3
+
+* Upgrade to Nginx 1.31.3.
+* Switch from Debian Bookworm to Trixie, picking up the patched OpenSSL
+  for CVE-2025-69419.
+
 ## 1.27.4
 
 * Upgrade to Nginx 1.27.4.