[Rick-VA]

Summary

• update NGINX from Debian Bookworm 1.22.1-9+deb12u9 to official mainline 1.31.8-1~bookworm
• address CVE-2026-97205, CVE-2026-93479, and CVE-2026-15176
• lock amd64 and arm64 packages with their upstream SHA-256 checksums

Validation

• bazel run @nginx-bookworm//:lock
• verified the downloaded amd64 and arm64 package checksums against the lockfile
• bazel build //nginx:index is blocked locally by a pre-existing macOS/Xcode absolute-header-path error while compiling @gawk+

[Copilot]

🟡 Changes recommended

The new package overwrites the image’s custom configuration, replacing PHP routing and selecting a missing runtime user that prevents startup.

1 open issue

• Prevent NGINX package defaults from overwriting custom configuration · New

What changed in this PR

Updates the NGINX image from Debian’s 1.22.1 package to official mainline 1.31.8 to address the reported security vulnerabilities.

Changes:

• Adds the official NGINX mainline repository and pins the package version.
• Updates package URLs and SHA-256 checksums for amd64 and arm64.

File	Description
nginx/​bookworm.yaml	Adds the mainline source and pins NGINX 1.31.8.
nginx/​bookworm.lock.json	Locks the updated packages and checksums for both architectures.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The new package’s default PID path is absent from the image, causing startup failure unless explicitly overridden.

1 open issue

• Set NGINX PID path to /run/nginx.pid · New

1 resolved since last review

• Prevent NGINX package defaults from overwriting custom configuration

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The package-provider switch changes runtime assumptions, and successful image builds and startup checks remain unverified for both supported architectures.

No open issues 🎉

1 resolved since last review

• Set NGINX PID path to /run/nginx.pid

_{Review effort: Balanced}