Updated nginx mainline to 1.25.5. #16614

oxpa · 2024-04-16T17:47:45Z

njs updated to 0.8.4
alpine updated to 3.19
nginx mainline updated to 1.25.5

njs cli tool now uses quickjs engine (as part of njs-0.8.4).

While at it: several minor bugfixes into entrypoint.sh for the stable release of nginx.

github-actions · 2024-04-16T17:49:22Z

Diff for 6176882:

diff --git a/_bashbrew-cat b/_bashbrew-cat
index cacff07..0d79e1c 100644
--- a/_bashbrew-cat
+++ b/_bashbrew-cat
@@ -3,22 +3,22 @@ GitRepo: https://github.com/nginxinc/docker-nginx.git
 
 Tags: 1.24.0, stable, 1.24, 1.24.0-bullseye, stable-bullseye, 1.24-bullseye
 Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
-GitCommit: 1a8d87b69760693a8e33cd8a9e0c2e5f0e8b0e3c
+GitCommit: 75d5e98b637f193781676bf5ea7c7704273b4355
 Directory: stable/debian
 
 Tags: 1.24.0-alpine, stable-alpine, 1.24-alpine, 1.24.0-alpine3.17, stable-alpine3.17, 1.24-alpine3.17
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, s390x
-GitCommit: 1a8d87b69760693a8e33cd8a9e0c2e5f0e8b0e3c
+GitCommit: 4b0d808b8f320df132c154a974ebe46e9e5f5ffe
 Directory: stable/alpine
 
 Tags: 1.24.0-alpine-perl, stable-alpine-perl, 1.24-alpine-perl, 1.24.0-alpine3.17-perl, stable-alpine3.17-perl, 1.24-alpine3.17-perl
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, s390x
-GitCommit: 1a8d87b69760693a8e33cd8a9e0c2e5f0e8b0e3c
+GitCommit: 4b0d808b8f320df132c154a974ebe46e9e5f5ffe
 Directory: stable/alpine-perl
 
 Tags: 1.24.0-alpine-slim, stable-alpine-slim, 1.24-alpine-slim, 1.24.0-alpine3.17-slim, stable-alpine3.17-slim, 1.24-alpine3.17-slim
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, s390x
-GitCommit: 1a8d87b69760693a8e33cd8a9e0c2e5f0e8b0e3c
+GitCommit: 75d5e98b637f193781676bf5ea7c7704273b4355
 Directory: stable/alpine-slim
 
 Tags: 1.24.0-perl, stable-perl, 1.24-perl, 1.24.0-bullseye-perl, stable-bullseye-perl, 1.24-bullseye-perl
@@ -26,37 +26,37 @@ Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
 GitCommit: 1a8d87b69760693a8e33cd8a9e0c2e5f0e8b0e3c
 Directory: stable/debian-perl
 
-Tags: 1.25.4, mainline, 1, 1.25, latest, 1.25.4-bookworm, mainline-bookworm, 1-bookworm, 1.25-bookworm, bookworm
+Tags: 1.25.5, mainline, 1, 1.25, latest, 1.25.5-bookworm, mainline-bookworm, 1-bookworm, 1.25-bookworm, bookworm
 Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
-GitCommit: 1f227619c1f1baa0bed8bed844ea614437ff14fb
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/debian
 
-Tags: 1.25.4-alpine, mainline-alpine, 1-alpine, 1.25-alpine, alpine, 1.25.4-alpine3.18, mainline-alpine3.18, 1-alpine3.18, 1.25-alpine3.18, alpine3.18
+Tags: 1.25.5-alpine, mainline-alpine, 1-alpine, 1.25-alpine, alpine, 1.25.5-alpine3.19, mainline-alpine3.19, 1-alpine3.19, 1.25-alpine3.19, alpine3.19
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, s390x
-GitCommit: 1f227619c1f1baa0bed8bed844ea614437ff14fb
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/alpine
 
-Tags: 1.25.4-alpine-otel, mainline-alpine-otel, 1-alpine-otel, 1.25-alpine-otel, alpine-otel, 1.25.4-alpine3.18-otel, mainline-alpine3.18-otel, 1-alpine3.18-otel, 1.25-alpine3.18-otel, alpine3.18-otel
+Tags: 1.25.5-alpine-otel, mainline-alpine-otel, 1-alpine-otel, 1.25-alpine-otel, alpine-otel, 1.25.5-alpine3.19-otel, mainline-alpine3.19-otel, 1-alpine3.19-otel, 1.25-alpine3.19-otel, alpine3.19-otel
 Architectures: amd64, arm64v8
-GitCommit: 9cb278860bdcea48abc0bc770a29ead3fc9a1fe6
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/alpine-otel
 
-Tags: 1.25.4-alpine-perl, mainline-alpine-perl, 1-alpine-perl, 1.25-alpine-perl, alpine-perl, 1.25.4-alpine3.18-perl, mainline-alpine3.18-perl, 1-alpine3.18-perl, 1.25-alpine3.18-perl, alpine3.18-perl
+Tags: 1.25.5-alpine-perl, mainline-alpine-perl, 1-alpine-perl, 1.25-alpine-perl, alpine-perl, 1.25.5-alpine3.19-perl, mainline-alpine3.19-perl, 1-alpine3.19-perl, 1.25-alpine3.19-perl, alpine3.19-perl
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, s390x
-GitCommit: 1f227619c1f1baa0bed8bed844ea614437ff14fb
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/alpine-perl
 
-Tags: 1.25.4-alpine-slim, mainline-alpine-slim, 1-alpine-slim, 1.25-alpine-slim, alpine-slim, 1.25.4-alpine3.18-slim, mainline-alpine3.18-slim, 1-alpine3.18-slim, 1.25-alpine3.18-slim, alpine3.18-slim
+Tags: 1.25.5-alpine-slim, mainline-alpine-slim, 1-alpine-slim, 1.25-alpine-slim, alpine-slim, 1.25.5-alpine3.19-slim, mainline-alpine3.19-slim, 1-alpine3.19-slim, 1.25-alpine3.19-slim, alpine3.19-slim
 Architectures: amd64, arm32v6, arm32v7, arm64v8, i386, ppc64le, s390x
-GitCommit: 1f227619c1f1baa0bed8bed844ea614437ff14fb
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/alpine-slim
 
-Tags: 1.25.4-otel, mainline-otel, 1-otel, 1.25-otel, otel, 1.25.4-bookworm-otel, mainline-bookworm-otel, 1-bookworm-otel, 1.25-bookworm-otel, bookworm-otel
+Tags: 1.25.5-otel, mainline-otel, 1-otel, 1.25-otel, otel, 1.25.5-bookworm-otel, mainline-bookworm-otel, 1-bookworm-otel, 1.25-bookworm-otel, bookworm-otel
 Architectures: amd64, arm64v8
-GitCommit: 9cb278860bdcea48abc0bc770a29ead3fc9a1fe6
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/debian-otel
 
-Tags: 1.25.4-perl, mainline-perl, 1-perl, 1.25-perl, perl, 1.25.4-bookworm-perl, mainline-bookworm-perl, 1-bookworm-perl, 1.25-bookworm-perl, bookworm-perl
+Tags: 1.25.5-perl, mainline-perl, 1-perl, 1.25-perl, perl, 1.25.5-bookworm-perl, mainline-bookworm-perl, 1-bookworm-perl, 1.25-bookworm-perl, bookworm-perl
 Architectures: amd64, arm32v5, arm32v7, arm64v8, i386, mips64le, ppc64le, s390x
-GitCommit: 1f227619c1f1baa0bed8bed844ea614437ff14fb
+GitCommit: 29d5001c15e7a2c7b34402c35254cc55199f8cc8
 Directory: mainline/debian-perl
diff --git a/_bashbrew-list b/_bashbrew-list
index 1355df0..88f2e31 100644
--- a/_bashbrew-list
+++ b/_bashbrew-list
@@ -1,9 +1,9 @@
 nginx:1
 nginx:1-alpine
-nginx:1-alpine3.18
-nginx:1-alpine3.18-otel
-nginx:1-alpine3.18-perl
-nginx:1-alpine3.18-slim
+nginx:1-alpine3.19
+nginx:1-alpine3.19-otel
+nginx:1-alpine3.19-perl
+nginx:1-alpine3.19-slim
 nginx:1-alpine-otel
 nginx:1-alpine-perl
 nginx:1-alpine-slim
@@ -34,10 +34,10 @@ nginx:1.24.0-bullseye-perl
 nginx:1.24.0-perl
 nginx:1.25
 nginx:1.25-alpine
-nginx:1.25-alpine3.18
-nginx:1.25-alpine3.18-otel
-nginx:1.25-alpine3.18-perl
-nginx:1.25-alpine3.18-slim
+nginx:1.25-alpine3.19
+nginx:1.25-alpine3.19-otel
+nginx:1.25-alpine3.19-perl
+nginx:1.25-alpine3.19-slim
 nginx:1.25-alpine-otel
 nginx:1.25-alpine-perl
 nginx:1.25-alpine-slim
@@ -46,25 +46,25 @@ nginx:1.25-bookworm-otel
 nginx:1.25-bookworm-perl
 nginx:1.25-otel
 nginx:1.25-perl
-nginx:1.25.4
-nginx:1.25.4-alpine
-nginx:1.25.4-alpine3.18
-nginx:1.25.4-alpine3.18-otel
-nginx:1.25.4-alpine3.18-perl
-nginx:1.25.4-alpine3.18-slim
-nginx:1.25.4-alpine-otel
-nginx:1.25.4-alpine-perl
-nginx:1.25.4-alpine-slim
-nginx:1.25.4-bookworm
-nginx:1.25.4-bookworm-otel
-nginx:1.25.4-bookworm-perl
-nginx:1.25.4-otel
-nginx:1.25.4-perl
+nginx:1.25.5
+nginx:1.25.5-alpine
+nginx:1.25.5-alpine3.19
+nginx:1.25.5-alpine3.19-otel
+nginx:1.25.5-alpine3.19-perl
+nginx:1.25.5-alpine3.19-slim
+nginx:1.25.5-alpine-otel
+nginx:1.25.5-alpine-perl
+nginx:1.25.5-alpine-slim
+nginx:1.25.5-bookworm
+nginx:1.25.5-bookworm-otel
+nginx:1.25.5-bookworm-perl
+nginx:1.25.5-otel
+nginx:1.25.5-perl
 nginx:alpine
-nginx:alpine3.18
-nginx:alpine3.18-otel
-nginx:alpine3.18-perl
-nginx:alpine3.18-slim
+nginx:alpine3.19
+nginx:alpine3.19-otel
+nginx:alpine3.19-perl
+nginx:alpine3.19-slim
 nginx:alpine-otel
 nginx:alpine-perl
 nginx:alpine-slim
@@ -74,10 +74,10 @@ nginx:bookworm-perl
 nginx:latest
 nginx:mainline
 nginx:mainline-alpine
-nginx:mainline-alpine3.18
-nginx:mainline-alpine3.18-otel
-nginx:mainline-alpine3.18-perl
-nginx:mainline-alpine3.18-slim
+nginx:mainline-alpine3.19
+nginx:mainline-alpine3.19-otel
+nginx:mainline-alpine3.19-perl
+nginx:mainline-alpine3.19-slim
 nginx:mainline-alpine-otel
 nginx:mainline-alpine-perl
 nginx:mainline-alpine-slim
diff --git a/nginx_1.24-alpine3.17-perl/Dockerfile b/nginx_1.24-alpine3.17-perl/Dockerfile
index 15cc834..a70cca1 100644
--- a/nginx_1.24-alpine3.17-perl/Dockerfile
+++ b/nginx_1.24-alpine3.17-perl/Dockerfile
@@ -54,29 +54,29 @@ RUN set -x \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
-                && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"dc47dbaeb1c0874b264d34ddfec40e7d2b814e7db48d144e12d5991c743ef5fcf780ecbab72324e562dd84bb9c0e4dd71d14850b20ceaf470c46f8fe7510275b *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
-                && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
+                && curl -f -O https://hg.nginx.org/pkg-oss/archive/e5d85b3424bb.tar.gz \
+                && PKGOSSCHECKSUM=\"4f33347bf05e7d7dd42a52b6e7af7ec21e3ed71df05a8ec16dd1228425f04e4318d88b1340370ccb6ad02cde590fc102094ddffbb1fc86d2085295a43f02f67b *e5d85b3424bb.tar.gz\" \
+                && if [ \"\$(openssl sha512 -r e5d85b3424bb.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
                     echo \"pkg-oss tarball checksum verification failed!\"; \
                     exit 1; \
                 fi \
-                && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
+                && tar xzvf e5d85b3424bb.tar.gz \
+                && cd pkg-oss-e5d85b3424bb \
                 && cd alpine \
                 && make module-perl \
                 && apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                 && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                 " \
             && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
-            && apk del .build-deps \
+            && apk del --no-network .build-deps \
             && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
             ;; \
     esac \
 # remove checksum deps
-    && apk del .checksum-deps \
+    && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
     && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi
diff --git a/nginx_1.24-alpine3.17-slim/10-listen-on-ipv6-by-default.sh b/nginx_1.24-alpine3.17-slim/10-listen-on-ipv6-by-default.sh
index b265586..b90bf0c 100755
--- a/nginx_1.24-alpine3.17-slim/10-listen-on-ipv6-by-default.sh
+++ b/nginx_1.24-alpine3.17-slim/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/nginx_alpine3.18-slim/15-local-resolvers.envsh b/nginx_1.24-alpine3.17-slim/15-local-resolvers.envsh
similarity index 100%
copy from nginx_alpine3.18-slim/15-local-resolvers.envsh
copy to nginx_1.24-alpine3.17-slim/15-local-resolvers.envsh
diff --git a/nginx_1.24-alpine3.17-slim/20-envsubst-on-templates.sh b/nginx_1.24-alpine3.17-slim/20-envsubst-on-templates.sh
index d0398b1..3804165 100755
--- a/nginx_1.24-alpine3.17-slim/20-envsubst-on-templates.sh
+++ b/nginx_1.24-alpine3.17-slim/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -10,10 +10,30 @@ entrypoint_log() {
     fi
 }
 
+add_stream_block() {
+  local conffile="/etc/nginx/nginx.conf"
+
+  if grep -q -E "\s*stream\s*\{" "$conffile"; then
+    entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates"
+  else
+    # check if the file can be modified, e.g. not on a r/o filesystem
+    touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; }
+    entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf"
+    cat << END >> "$conffile"
+# added by "$ME" on "$(date)"
+stream {
+  include $stream_output_dir/*.conf;
+}
+END
+  fi
+}
+
 auto_envsubst() {
   local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}"
   local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}"
   local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}"
+  local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}"
+  local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}"
   local filter="${NGINX_ENVSUBST_FILTER:-}"
 
   local template defined_envs relative_path output_path subdir
@@ -24,14 +44,33 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
     entrypoint_log "$ME: Running envsubst on $template to $output_path"
     envsubst "$defined_envs" < "$template" > "$output_path"
   done
+
+  # Print the first file with the stream suffix, this will be false if there are none
+  if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then
+    mkdir -p "$stream_output_dir"
+    if [ ! -w "$stream_output_dir" ]; then
+      entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable"
+      return 0
+    fi
+    add_stream_block
+    find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
+      subdir=$(dirname "$relative_path")
+      # create a subdirectory where the template file exists
+      mkdir -p "$stream_output_dir/$subdir"
+      entrypoint_log "$ME: Running envsubst on $template to $output_path"
+      envsubst "$defined_envs" < "$template" > "$output_path"
+    done
+  fi
 }
 
 auto_envsubst
diff --git a/nginx_1.24-alpine3.17-slim/30-tune-worker-processes.sh b/nginx_1.24-alpine3.17-slim/30-tune-worker-processes.sh
index 9aa42e9..defb994 100755
--- a/nginx_1.24-alpine3.17-slim/30-tune-worker-processes.sh
+++ b/nginx_1.24-alpine3.17-slim/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/nginx_1.24-alpine3.17-slim/Dockerfile b/nginx_1.24-alpine3.17-slim/Dockerfile
index 0f8c0b2..8d59f1b 100644
--- a/nginx_1.24-alpine3.17-slim/Dockerfile
+++ b/nginx_1.24-alpine3.17-slim/Dockerfile
@@ -3,7 +3,7 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM alpine:3.17
+FROM alpine:3.18
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
@@ -56,32 +56,32 @@ RUN set -x \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
-                && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"dc47dbaeb1c0874b264d34ddfec40e7d2b814e7db48d144e12d5991c743ef5fcf780ecbab72324e562dd84bb9c0e4dd71d14850b20ceaf470c46f8fe7510275b *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
-                && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
+                && curl -f -O https://hg.nginx.org/pkg-oss/archive/e5d85b3424bb.tar.gz \
+                && PKGOSSCHECKSUM=\"4f33347bf05e7d7dd42a52b6e7af7ec21e3ed71df05a8ec16dd1228425f04e4318d88b1340370ccb6ad02cde590fc102094ddffbb1fc86d2085295a43f02f67b *e5d85b3424bb.tar.gz\" \
+                && if [ \"\$(openssl sha512 -r e5d85b3424bb.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
                     echo \"pkg-oss tarball checksum verification failed!\"; \
                     exit 1; \
                 fi \
-                && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
+                && tar xzvf e5d85b3424bb.tar.gz \
+                && cd pkg-oss-e5d85b3424bb \
                 && cd alpine \
                 && make base \
                 && apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                 && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                 " \
             && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
-            && apk del .build-deps \
+            && apk del --no-network .build-deps \
             && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
             ;; \
     esac \
 # remove checksum deps
-    && apk del .checksum-deps \
+    && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
     && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in gettext so we can get `envsubst`, then throw
 # the rest away. To do this, we need to install `gettext`
 # then move `envsubst` out of the way so `gettext` can
@@ -97,7 +97,7 @@ RUN set -x \
             | sort -u \
     )" \
     && apk add --no-cache $runDeps \
-    && apk del .gettext \
+    && apk del --no-network .gettext \
     && mv /tmp/envsubst /usr/local/bin/ \
 # Bring in tzdata so users could set the timezones through the environment
 # variables
@@ -110,6 +110,7 @@ RUN set -x \
 
 COPY docker-entrypoint.sh /
 COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
+COPY 15-local-resolvers.envsh /docker-entrypoint.d
 COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
 COPY 30-tune-worker-processes.sh /docker-entrypoint.d
 ENTRYPOINT ["/docker-entrypoint.sh"]
diff --git a/nginx_1.24-alpine3.17-slim/docker-entrypoint.sh b/nginx_1.24-alpine3.17-slim/docker-entrypoint.sh
index e201fe6..8ea04f2 100755
--- a/nginx_1.24-alpine3.17-slim/docker-entrypoint.sh
+++ b/nginx_1.24-alpine3.17-slim/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
 
diff --git a/nginx_1.24-alpine3.17/Dockerfile b/nginx_1.24-alpine3.17/Dockerfile
index a5842e1..fbe85c5 100644
--- a/nginx_1.24-alpine3.17/Dockerfile
+++ b/nginx_1.24-alpine3.17/Dockerfile
@@ -5,7 +5,7 @@
 #
 FROM nginx:1.24.0-alpine-slim
 
-ENV NJS_VERSION   0.7.12
+ENV NJS_VERSION   0.8.0
 
 RUN set -x \
     && apkArch="$(cat /etc/apk/arch)" \
@@ -58,31 +58,31 @@ RUN set -x \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
-                && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"dc47dbaeb1c0874b264d34ddfec40e7d2b814e7db48d144e12d5991c743ef5fcf780ecbab72324e562dd84bb9c0e4dd71d14850b20ceaf470c46f8fe7510275b *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
-                && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
+                && curl -f -O https://hg.nginx.org/pkg-oss/archive/e5d85b3424bb.tar.gz \
+                && PKGOSSCHECKSUM=\"4f33347bf05e7d7dd42a52b6e7af7ec21e3ed71df05a8ec16dd1228425f04e4318d88b1340370ccb6ad02cde590fc102094ddffbb1fc86d2085295a43f02f67b *e5d85b3424bb.tar.gz\" \
+                && if [ \"\$(openssl sha512 -r e5d85b3424bb.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
                     echo \"pkg-oss tarball checksum verification failed!\"; \
                     exit 1; \
                 fi \
-                && tar xzvf ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && cd pkg-oss-${NGINX_VERSION}-${PKG_RELEASE} \
+                && tar xzvf e5d85b3424bb.tar.gz \
+                && cd pkg-oss-e5d85b3424bb \
                 && cd alpine \
                 && make module-geoip module-image-filter module-njs module-xslt \
                 && apk index -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \
                 && abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \
                 " \
             && cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \
-            && apk del .build-deps \
+            && apk del --no-network .build-deps \
             && apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages \
             ;; \
     esac \
 # remove checksum deps
-    && apk del .checksum-deps \
+    && apk del --no-network .checksum-deps \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
     && if [ -n "$tempDir" ]; then rm -rf "$tempDir"; fi \
-    && if [ -n "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
-    && if [ -n "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/abuild-key.rsa.pub" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \
+    && if [ -f "/etc/apk/keys/nginx_signing.rsa.pub" ]; then rm -f /etc/apk/keys/nginx_signing.rsa.pub; fi \
 # Bring in curl and ca-certificates to make registering on DNS SD easier
     && apk add --no-cache curl ca-certificates
diff --git a/nginx_1.24-bullseye/10-listen-on-ipv6-by-default.sh b/nginx_1.24-bullseye/10-listen-on-ipv6-by-default.sh
index b265586..b90bf0c 100755
--- a/nginx_1.24-bullseye/10-listen-on-ipv6-by-default.sh
+++ b/nginx_1.24-bullseye/10-listen-on-ipv6-by-default.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-ME=$(basename $0)
+ME=$(basename "$0")
 DEFAULT_CONF_FILE="etc/nginx/conf.d/default.conf"
 
 # check if we have ipv6 available
diff --git a/nginx_alpine3.18-slim/15-local-resolvers.envsh b/nginx_1.24-bullseye/15-local-resolvers.envsh
similarity index 100%
copy from nginx_alpine3.18-slim/15-local-resolvers.envsh
copy to nginx_1.24-bullseye/15-local-resolvers.envsh
diff --git a/nginx_1.24-bullseye/20-envsubst-on-templates.sh b/nginx_1.24-bullseye/20-envsubst-on-templates.sh
index d0398b1..3804165 100755
--- a/nginx_1.24-bullseye/20-envsubst-on-templates.sh
+++ b/nginx_1.24-bullseye/20-envsubst-on-templates.sh
@@ -2,7 +2,7 @@
 
 set -e
 
-ME=$(basename $0)
+ME=$(basename "$0")
 
 entrypoint_log() {
     if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
@@ -10,10 +10,30 @@ entrypoint_log() {
     fi
 }
 
+add_stream_block() {
+  local conffile="/etc/nginx/nginx.conf"
+
+  if grep -q -E "\s*stream\s*\{" "$conffile"; then
+    entrypoint_log "$ME: $conffile contains a stream block; include $stream_output_dir/*.conf to enable stream templates"
+  else
+    # check if the file can be modified, e.g. not on a r/o filesystem
+    touch "$conffile" 2>/dev/null || { entrypoint_log "$ME: info: can not modify $conffile (read-only file system?)"; exit 0; }
+    entrypoint_log "$ME: Appending stream block to $conffile to include $stream_output_dir/*.conf"
+    cat << END >> "$conffile"
+# added by "$ME" on "$(date)"
+stream {
+  include $stream_output_dir/*.conf;
+}
+END
+  fi
+}
+
 auto_envsubst() {
   local template_dir="${NGINX_ENVSUBST_TEMPLATE_DIR:-/etc/nginx/templates}"
   local suffix="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}"
   local output_dir="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx/conf.d}"
+  local stream_suffix="${NGINX_ENVSUBST_STREAM_TEMPLATE_SUFFIX:-.stream-template}"
+  local stream_output_dir="${NGINX_ENVSUBST_STREAM_OUTPUT_DIR:-/etc/nginx/stream-conf.d}"
   local filter="${NGINX_ENVSUBST_FILTER:-}"
 
   local template defined_envs relative_path output_path subdir
@@ -24,14 +44,33 @@ auto_envsubst() {
     return 0
   fi
   find "$template_dir" -follow -type f -name "*$suffix" -print | while read -r template; do
-    relative_path="${template#$template_dir/}"
-    output_path="$output_dir/${relative_path%$suffix}"
+    relative_path="${template#"$template_dir/"}"
+    output_path="$output_dir/${relative_path%"$suffix"}"
     subdir=$(dirname "$relative_path")
     # create a subdirectory where the template file exists
     mkdir -p "$output_dir/$subdir"
     entrypoint_log "$ME: Running envsubst on $template to $output_path"
     envsubst "$defined_envs" < "$template" > "$output_path"
   done
+
+  # Print the first file with the stream suffix, this will be false if there are none
+  if test -n "$(find "$template_dir" -name "*$stream_suffix" -print -quit)"; then
+    mkdir -p "$stream_output_dir"
+    if [ ! -w "$stream_output_dir" ]; then
+      entrypoint_log "$ME: ERROR: $template_dir exists, but $stream_output_dir is not writable"
+      return 0
+    fi
+    add_stream_block
+    find "$template_dir" -follow -type f -name "*$stream_suffix" -print | while read -r template; do
+      relative_path="${template#"$template_dir/"}"
+      output_path="$stream_output_dir/${relative_path%"$stream_suffix"}"
+      subdir=$(dirname "$relative_path")
+      # create a subdirectory where the template file exists
+      mkdir -p "$stream_output_dir/$subdir"
+      entrypoint_log "$ME: Running envsubst on $template to $output_path"
+      envsubst "$defined_envs" < "$template" > "$output_path"
+    done
+  fi
 }
 
 auto_envsubst
diff --git a/nginx_1.24-bullseye/30-tune-worker-processes.sh b/nginx_1.24-bullseye/30-tune-worker-processes.sh
index 9aa42e9..defb994 100755
--- a/nginx_1.24-bullseye/30-tune-worker-processes.sh
+++ b/nginx_1.24-bullseye/30-tune-worker-processes.sh
@@ -4,7 +4,7 @@
 set -eu
 
 LC_ALL=C
-ME=$( basename "$0" )
+ME=$(basename "$0")
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 [ "${NGINX_ENTRYPOINT_WORKER_PROCESSES_AUTOTUNE:-}" ] || exit 0
diff --git a/nginx_1.24-bullseye/Dockerfile b/nginx_1.24-bullseye/Dockerfile
index be3ec60..56ae368 100644
--- a/nginx_1.24-bullseye/Dockerfile
+++ b/nginx_1.24-bullseye/Dockerfile
@@ -8,13 +8,13 @@ FROM debian:bullseye-slim
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
 ENV NGINX_VERSION   1.24.0
-ENV NJS_VERSION     0.7.12
+ENV NJS_VERSION     0.8.0
 ENV PKG_RELEASE     1~bullseye
 
 RUN set -x \
 # create nginx user/group first, to be consistent throughout docker variants
-    && addgroup --system --gid 101 nginx \
-    && adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos "nginx user" --shell /bin/false --uid 101 nginx \
+    && groupadd --system --gid 101 nginx \
+    && useradd --system --gid nginx --no-create-home --home /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
     && apt-get update \
     && apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates \
     && \
@@ -107,6 +107,7 @@ RUN set -x \
 
 COPY docker-entrypoint.sh /
 COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d
+COPY 15-local-resolvers.envsh /docker-entrypoint.d
 COPY 20-envsubst-on-templates.sh /docker-entrypoint.d
 COPY 30-tune-worker-processes.sh /docker-entrypoint.d
 ENTRYPOINT ["/docker-entrypoint.sh"]
diff --git a/nginx_1.24-bullseye/docker-entrypoint.sh b/nginx_1.24-bullseye/docker-entrypoint.sh
index e201fe6..8ea04f2 100755
--- a/nginx_1.24-bullseye/docker-entrypoint.sh
+++ b/nginx_1.24-bullseye/docker-entrypoint.sh
@@ -9,7 +9,7 @@ entrypoint_log() {
     fi
 }
 
-if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
+if [ "$1" = "nginx" ] || [ "$1" = "nginx-debug" ]; then
     if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
         entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
 
diff --git a/nginx_alpine3.18-otel/Dockerfile b/nginx_alpine3.19-otel/Dockerfile
similarity index 94%
rename from nginx_alpine3.18-otel/Dockerfile
rename to nginx_alpine3.19-otel/Dockerfile
index 714113c..f7460dc 100644
--- a/nginx_alpine3.18-otel/Dockerfile
+++ b/nginx_alpine3.19-otel/Dockerfile
@@ -3,7 +3,7 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM nginx:1.25.4-alpine
+FROM nginx:1.25.5-alpine
 
 ENV OTEL_VERSION   0.1.0
 
@@ -60,7 +60,7 @@ RUN set -x \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
                 && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"79bf214256bf55700c776a87abfc3cf542323a267d879e89110aa44b551d12f6df7d56676a68f255ebbb54275185980d1fa37075f000d98e0ecac28db9e89fe3 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
+                && PKGOSSCHECKSUM=\"74000f32ab250be492a8ae4d408cd63a4c422f4f0af84689973a2844fceeb8a3e7e12b04d7c6dac0f993d7102d920a5f60e6f49be23ce4093f48a8eb1ae36ce5 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
                 && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
diff --git a/nginx_alpine3.18-perl/Dockerfile b/nginx_alpine3.19-perl/Dockerfile
similarity index 94%
rename from nginx_alpine3.18-perl/Dockerfile
rename to nginx_alpine3.19-perl/Dockerfile
index b500d17..5ded619 100644
--- a/nginx_alpine3.18-perl/Dockerfile
+++ b/nginx_alpine3.19-perl/Dockerfile
@@ -3,7 +3,7 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM nginx:1.25.4-alpine
+FROM nginx:1.25.5-alpine
 
 RUN set -x \
     && apkArch="$(cat /etc/apk/arch)" \
@@ -55,7 +55,7 @@ RUN set -x \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
                 && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"79bf214256bf55700c776a87abfc3cf542323a267d879e89110aa44b551d12f6df7d56676a68f255ebbb54275185980d1fa37075f000d98e0ecac28db9e89fe3 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
+                && PKGOSSCHECKSUM=\"74000f32ab250be492a8ae4d408cd63a4c422f4f0af84689973a2844fceeb8a3e7e12b04d7c6dac0f993d7102d920a5f60e6f49be23ce4093f48a8eb1ae36ce5 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
                 && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
diff --git a/nginx_alpine3.18-slim/10-listen-on-ipv6-by-default.sh b/nginx_alpine3.19-slim/10-listen-on-ipv6-by-default.sh
similarity index 100%
rename from nginx_alpine3.18-slim/10-listen-on-ipv6-by-default.sh
rename to nginx_alpine3.19-slim/10-listen-on-ipv6-by-default.sh
diff --git a/nginx_alpine3.18-slim/15-local-resolvers.envsh b/nginx_alpine3.19-slim/15-local-resolvers.envsh
similarity index 100%
rename from nginx_alpine3.18-slim/15-local-resolvers.envsh
rename to nginx_alpine3.19-slim/15-local-resolvers.envsh
diff --git a/nginx_alpine3.18-slim/20-envsubst-on-templates.sh b/nginx_alpine3.19-slim/20-envsubst-on-templates.sh
similarity index 100%
rename from nginx_alpine3.18-slim/20-envsubst-on-templates.sh
rename to nginx_alpine3.19-slim/20-envsubst-on-templates.sh
diff --git a/nginx_alpine3.18-slim/30-tune-worker-processes.sh b/nginx_alpine3.19-slim/30-tune-worker-processes.sh
similarity index 100%
rename from nginx_alpine3.18-slim/30-tune-worker-processes.sh
rename to nginx_alpine3.19-slim/30-tune-worker-processes.sh
diff --git a/nginx_alpine3.18-slim/Dockerfile b/nginx_alpine3.19-slim/Dockerfile
similarity index 95%
rename from nginx_alpine3.18-slim/Dockerfile
rename to nginx_alpine3.19-slim/Dockerfile
index 2cdb70e..d867eb4 100644
--- a/nginx_alpine3.18-slim/Dockerfile
+++ b/nginx_alpine3.19-slim/Dockerfile
@@ -3,11 +3,11 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM alpine:3.18
+FROM alpine:3.19
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
-ENV NGINX_VERSION 1.25.4
+ENV NGINX_VERSION 1.25.5
 ENV PKG_RELEASE   1
 
 RUN set -x \
@@ -57,7 +57,7 @@ RUN set -x \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
                 && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"79bf214256bf55700c776a87abfc3cf542323a267d879e89110aa44b551d12f6df7d56676a68f255ebbb54275185980d1fa37075f000d98e0ecac28db9e89fe3 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
+                && PKGOSSCHECKSUM=\"74000f32ab250be492a8ae4d408cd63a4c422f4f0af84689973a2844fceeb8a3e7e12b04d7c6dac0f993d7102d920a5f60e6f49be23ce4093f48a8eb1ae36ce5 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
                 && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
diff --git a/nginx_alpine3.18-slim/docker-entrypoint.sh b/nginx_alpine3.19-slim/docker-entrypoint.sh
similarity index 100%
rename from nginx_alpine3.18-slim/docker-entrypoint.sh
rename to nginx_alpine3.19-slim/docker-entrypoint.sh
diff --git a/nginx_alpine3.18/Dockerfile b/nginx_alpine3.19/Dockerfile
similarity index 94%
rename from nginx_alpine3.18/Dockerfile
rename to nginx_alpine3.19/Dockerfile
index b3ee8c0..fba7100 100644
--- a/nginx_alpine3.18/Dockerfile
+++ b/nginx_alpine3.19/Dockerfile
@@ -3,9 +3,9 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM nginx:1.25.4-alpine-slim
+FROM nginx:1.25.5-alpine-slim
 
-ENV NJS_VERSION   0.8.3
+ENV NJS_VERSION   0.8.4
 
 RUN set -x \
     && apkArch="$(cat /etc/apk/arch)" \
@@ -59,7 +59,7 @@ RUN set -x \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
                 && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"79bf214256bf55700c776a87abfc3cf542323a267d879e89110aa44b551d12f6df7d56676a68f255ebbb54275185980d1fa37075f000d98e0ecac28db9e89fe3 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
+                && PKGOSSCHECKSUM=\"74000f32ab250be492a8ae4d408cd63a4c422f4f0af84689973a2844fceeb8a3e7e12b04d7c6dac0f993d7102d920a5f60e6f49be23ce4093f48a8eb1ae36ce5 *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
                 && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
                     echo \"pkg-oss tarball checksum verification succeeded!\"; \
                 else \
diff --git a/nginx_bookworm-otel/Dockerfile b/nginx_bookworm-otel/Dockerfile
index 8fbf2a3..d093409 100644
--- a/nginx_bookworm-otel/Dockerfile
+++ b/nginx_bookworm-otel/Dockerfile
@@ -3,7 +3,7 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM nginx:1.25.4
+FROM nginx:1.25.5
 
 ENV OTEL_VERSION     0.1.0
 
diff --git a/nginx_bookworm-perl/Dockerfile b/nginx_bookworm-perl/Dockerfile
index 28d8d82..2372667 100644
--- a/nginx_bookworm-perl/Dockerfile
+++ b/nginx_bookworm-perl/Dockerfile
@@ -3,7 +3,7 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM nginx:1.25.4
+FROM nginx:1.25.5
 
 RUN set -x \
     && apt-get update \
diff --git a/nginx_bookworm/Dockerfile b/nginx_bookworm/Dockerfile
index 48b78ba..22ad798 100644
--- a/nginx_bookworm/Dockerfile
+++ b/nginx_bookworm/Dockerfile
@@ -7,8 +7,8 @@ FROM debian:bookworm-slim
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
-ENV NGINX_VERSION   1.25.4
-ENV NJS_VERSION     0.8.3
+ENV NGINX_VERSION   1.25.5
+ENV NJS_VERSION     0.8.4
 ENV PKG_RELEASE     1~bookworm
 
 RUN set -x \

Relevant Maintainers:

nginx: @nginxinc

yosifkit · 2024-04-16T22:39:57Z

I think this accidentally includes some nginx:stable image changes that aren't correct. Like this:

--- a/nginx_1.24-alpine3.17-slim/Dockerfile
+++ b/nginx_1.24-alpine3.17-slim/Dockerfile
@@ -3,7 +3,7 @@
 #
 # PLEASE DO NOT EDIT IT DIRECTLY.
 #
-FROM alpine:3.17
+FROM alpine:3.18

Or a little out of place or dubious, like this bit. I'm sure the referenced commit is fine, it's just unusual. I think I recall something similar a while back.

--- a/nginx_1.24-alpine3.17-perl/Dockerfile
+++ b/nginx_1.24-alpine3.17-perl/Dockerfile
@@ -54,29 +54,29 @@ RUN set -x \
             && su nobody -s /bin/sh -c " \
                 export HOME=${tempDir} \
                 && cd ${tempDir} \
-                && curl -f -O https://hg.nginx.org/pkg-oss/archive/${NGINX_VERSION}-${PKG_RELEASE}.tar.gz \
-                && PKGOSSCHECKSUM=\"dc47dbaeb1c0874b264d34ddfec40e7d2b814e7db48d144e12d5991c743ef5fcf780ecbab72324e562dd84bb9c0e4dd71d14850b20ceaf470c46f8fe7510275b *${NGINX_VERSION}-${PKG_RELEASE}.tar.gz\" \
-                && if [ \"\$(openssl sha512 -r ${NGINX_VERSION}-${PKG_RELEASE}.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \
+                && curl -f -O https://hg.nginx.org/pkg-oss/archive/e5d85b3424bb.tar.gz \
+                && PKGOSSCHECKSUM=\"4f33347bf05e7d7dd42a52b6e7af7ec21e3ed71df05a8ec16dd1228425f04e4318d88b1340370ccb6ad02cde590fc102094ddffbb1fc86d2085295a43f02f67b *e5d85b3424bb.tar.gz\" \
+                && if [ \"\$(openssl sha512 -r e5d85b3424bb.tar.gz)\" = \"\$PKGOSSCHECKSUM\" ]; then \

Update JRuby Java 21 images to jammy

oxpa · 2024-04-17T10:48:45Z

I messed up commits and will create proper pull request with only nginx mainline in it.

oxpa requested a review from a team as a code owner April 16, 2024 17:47

github-actions bot added the library/nginx label Apr 16, 2024

jnoordsij mentioned this pull request Apr 17, 2024

Update to Alpine 3.19 nginxinc/docker-nginx#851

Merged

5 tasks

tianon and others added 2 commits April 17, 2024 11:43

Merge pull request docker-library#16610 from LaurentGoderre/jruby-java21

eb2ed70

Update JRuby Java 21 images to jammy

Updated nginx mainline to 1.25.5.

0215f53

oxpa force-pushed the master branch from 6176882 to 0215f53 Compare April 17, 2024 10:47

github-actions bot added the library/jruby label Apr 17, 2024

oxpa closed this Apr 17, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updated nginx mainline to 1.25.5. #16614

Updated nginx mainline to 1.25.5. #16614

oxpa commented Apr 16, 2024

github-actions bot commented Apr 16, 2024

yosifkit commented Apr 16, 2024

oxpa commented Apr 17, 2024

Updated nginx mainline to 1.25.5. #16614

Updated nginx mainline to 1.25.5. #16614

Conversation

oxpa commented Apr 16, 2024

github-actions bot commented Apr 16, 2024

yosifkit commented Apr 16, 2024

oxpa commented Apr 17, 2024