[Snyk] Security upgrade nginx from 1.27.3 to 1.29.2

[wayneeseguin]

Snyk has created this PR to fix 5 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• docker/demo/Dockerfile

We recommend upgrading to nginx:1.29.2, as this image has only 56 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	CVE-2025-27363 SNYK-DEBIAN12-FREETYPE-9402511	829
	CVE-2025-0838 SNYK-DEBIAN12-ABSEIL-8740787	714
	Integer Overflow or Wraparound SNYK-DEBIAN12-LIBAVIF-10180086	714
	Expired Pointer Dereference SNYK-DEBIAN12-LIBXML2-10350658	714
	Out-of-bounds Read SNYK-DEBIAN12-LIBXML2-10350668	714

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[wayneeseguin]

Closing — superseded by #814, merged to develop as 1d8faee.

Both nginx images now run nginx:1.31-trixie (nginx 1.31.3, image rebuilt 2026-07-16), which is ahead of the nginx:1.29.2 proposed here.

This PR was not merged as-is for three reasons:

• nginx:1.29.2 is itself stale. Current mainline is 1.31.3 and current stable is 1.30.4.

• The bookworm line is a dead end. nginx publishes no bookworm variant past 1.29 — 1.30-bookworm and 1.31-bookworm do not exist. nginx:1.27-bookworm was last rebuilt 2025-06-11 and nginx:1.29-bookworm on 2025-09-30, so merging any bookworm-era tag would have left the base a year behind and re-opened the same alert on the next scan. Clearing it required moving to Debian trixie.

• It covers only half the exposure. This changes docker/demo/Dockerfile alone. docker/webdav/Dockerfile ran the same stale base and ships as quay.io/shieldproject/webdav; Move nginx images to 1.31 on Debian trixie #814 updates both.

#814 was verified by building both images and exercising them: demo returns 200 on GET /; webdav handles PUT (201), GET (200), MKCOL (201), DELETE (204), and autoindex. --with-http_dav_module, the nginx user (uid 101), and bash are all present on the new base.