[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps macbre/nginx-http3 from 1.27.0 to 1.31.8.

Release notes

Sourced from macbre/nginx-http3's releases.

nginx 1.31.8 and njs 1.0.2

Changes with nginx 1.31.8                                        21 Oct 2026
*) Change in internal API: now the JSON parser reports strings with
   escape sequences as separate events, and the
   ngx_json_unescape_string() function decodes a string into a separate
   buffer.
*) Change: now the path specified in the "working_directory" directive

is relative to nginx prefix directory, but not to the current

directory.
*) Bugfix: worker processes exited on start or during reconfiguration if

an invalid directory was specified in the "working_directory"

directive.
*) Bugfix: worker processes might be terminated abnormally on a SIGBUS

signal when using HTTP/3 on platforms with strict alignment

requirements.

Thanks to Daewoo Choi.
*) Bugfix: "recv() failed (5: Input/output error)" alerts might appear

in logs when closing SSL connections if kernel TLS was used with

OpenSSL 3.2.0 or newer.
*) Bugfix: nginx could not be built on Solaris if the --with-control-api

option was used.

nginx 1.31.6 and njs 1.0.1

Changes with nginx 1.31.6                                        15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
   process under certain configurations when using HTTP/3 with OpenSSL
   3.5.0 and earlier (CVE-2026-90439).
   Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an

SSL connection is always ignored.
*) Bugfix: binary upgrade refused to work if the control API socket was

specified and the new nginx executable was built with the

ngx_http_perl_module.
*) Bugfix: an error while evaluating a predicate in a predicate location

was ignored and the predicate was treated as false.
*) Bugfix: an error during a nested location lookup might be ignored if


</tr></table>

... (truncated)

Commits

• 3a01cd5 Revert "Revert njs to v1.0.1 - build fails for linux/arm/v7" (#201)
• 24a2429 Revert njs to v1.0.1 - build fails for linux/arm/v7 (#200)
• 46b026c nginx 1.31.8 + njs 1.0.2 (#199)
• 728d389 Bump hadolint/hadolint-action from 3.3.0 to 3.5.0 (#197)
• 70a973d Update nginx and njs version details
• a17f651 nginx 1.31.6 and njs 1.0.1 (#198)
• 2fe109f Bump actions/stale from 10 to 11 (#195)
• f224196 nginx 1.31.3 (#194)
• 4ff1b7e Bump macbre/push-to-ghcr from 17 to 18 (#193)
• 38d16ae Bump actions/checkout from 6 to 7 (#192)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)