Update nginx to 1.30.4 and stop it going stale again - #1859
Draft
gsanchietti wants to merge 3 commits into
Draft
Conversation
The packages feed pinned by OpenWrt v25.12.5 still ships nginx 1.26.3, which is missing four security releases (1.30.1 to 1.30.4). Upstream has only packaged 1.30.3 so far, so patch the feed Makefile directly instead of waiting for the pin to move. All ten existing feed patches still apply to the 1.30.4 sources, so only version and hash change. Assisted-by: Claude Code:claude-opus-5
The version now lives in a file Renovate can edit, so future nginx releases show up as pull requests instead of being noticed by accident. Versions are read from nginx upstream, not from the OpenWrt feed, which is what we are compensating for. Renovate cannot compute PKG_HASH, so its pull request fails the build until the hash is refreshed by hand. That failure is the notification. Assisted-by: Claude Code:claude-opus-5
nginx was frozen at 1.25.2 for 28 months as a fork, then frozen again after reverting to the OpenWrt feed. Neither mechanism was the problem: nobody was watching nginx releases, and a stale version never fails a build, so it stays invisible. Write down which packages we track ahead of OpenWrt, that they must follow the upstream stable branch, that Renovate must be able to see them, and that deleting a version patch to unbreak a build is a silent downgrade. Assisted-by: Claude Code:claude-opus-5
gsanchietti
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
We ship nginx 1.26.3, pinned by the OpenWrt packages feed, missing 12 CVEs. This builds nginx 1.30.4 instead, and wires up the automation that should stop this happening a third time.
Effective nginx version: 1.26.3 → 1.30.4.
The staleness is not new. The
openwrt-25.12feed branch is on 1.26.3 andopenwrt-24.10is on 1.26.1, which never even got the 1.26.3 security fix — OpenWrt release branches get no nginx security backports, so waiting for them is not a plan. We have already tried both alternatives and both froze: the oldpackages/nginxfork was added in Nov 2023 at nginx 1.25.2 and deleted in Mar 2026 still at 1.25.2, and reverting to the feed left us stuck again. Nobody was watching nginx releases, and a stale version never fails a build, so it stays invisible.So the fix is not another mechanism change:
github.com/nginx/nginx,release-*tags), bounded to the 1.30.x stable branch, so every future nginx release arrives as a PRdocs/build/index.md: which packages we track ahead of OpenWrt, why stable-branch-only, and that deleting the patch to unbreak a build after anOWRT_VERSIONbump is a silent downgradeRenovate cannot compute
PKG_HASH, so its PRs will fail the build until someone refreshes the hash. That failure is the notification, and the command to run is in the patch header.How to test
Check the build log: nginx 1.30.4 downloads, all ten feed patches apply, and
nginx-ssl,nginx-mod-luci,nginx-mod-ubus,nginx-mod-naxsiandnginx-mod-headers-morecompile.On a device flashed with the PR image:
nginx -vreports 1.30.4 andnginx -tis cleanapi-cli ns.dashboard system-infoworksThis jumps two nginx stable branches, so watch for behaviour changes: backend connections are now keepalive and HTTP/1.1 by default (1.29.7),
Hostand request-line validation follows RFC 3986 (1.29.4), and TLS 1.0/1.1 are off by default (1.27.3). Future 1.30.x bumps are security-only and should not drift.CVEs closed: CVE-2026-42926, -42945, -42946, -42934, -40460, -40701, -9256, -42055, -48142, -42533, -60005, -56434.