[Snyk] Security upgrade nginx from 1.25 to 1.29.4

[itsouvalas]

Snyk has created this PR to fix 3 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• docker/demo/Dockerfile

We recommend upgrading to nginx:1.29.4, as this image has only 59 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	CVE-2025-27363 SNYK-DEBIAN12-FREETYPE-9402511	829
	Allocation of Resources Without Limits or Throttling SNYK-DEBIAN12-SYSTEMD-6277507	721
	Allocation of Resources Without Limits or Throttling SNYK-DEBIAN12-SYSTEMD-6277507	721
	CVE-2024-37371 SNYK-DEBIAN12-KRB5-7411315	714
	CVE-2024-37371 SNYK-DEBIAN12-KRB5-7411315	714

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[wayneeseguin]

Closing — superseded by #814, merged to develop as 1d8faee.

Both nginx images now run nginx:1.31-trixie (nginx 1.31.3, image rebuilt 2026-07-16), which is ahead of the nginx:1.29.4 proposed here.

This PR was not merged as-is for three reasons:

• nginx:1.29.4 is itself stale. Current mainline is 1.31.3 and current stable is 1.30.4.

• The bookworm line is a dead end. nginx publishes no bookworm variant past 1.29 — 1.30-bookworm and 1.31-bookworm do not exist. nginx:1.27-bookworm was last rebuilt 2025-06-11 and nginx:1.29-bookworm on 2025-09-30, so merging any bookworm-era tag would have left the base a year behind and re-opened the same alert on the next scan. Clearing it required moving to Debian trixie.

• It covers only half the exposure. This changes docker/demo/Dockerfile alone. docker/webdav/Dockerfile ran the same stale base and ships as quay.io/shieldproject/webdav; Move nginx images to 1.31 on Debian trixie #814 updates both.

#814 was verified by building both images and exercising them: demo returns 200 on GET /; webdav handles PUT (201), GET (200), MKCOL (201), DELETE (204), and autoindex. --with-http_dav_module, the nginx user (uid 101), and bash are all present on the new base.