Merge branch 'main' into tests/race

Author: sjberman

.github/workflows/ci.yml

@@ -149,7 +149,7 @@ jobs:
             .github/.cache/buster-for-binary
 
       - name: Create/Update Draft
-        uses: lucacome/draft-release@38def8b74645796e9743b53e0f187d4a8915ea3e # v1.2.3
+        uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
         with:
           minor-label: "enhancement"
           major-label: "change"
@@ -171,7 +171,7 @@ jobs:
       - name: Build binary
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
         with:
-          version: v2.10.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
+          version: v2.11.0 # renovate: datasource=github-tags depName=goreleaser/goreleaser
           args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/conformance.yml

@@ -79,7 +79,7 @@ jobs:
       - name: Build binary
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
         with:
-          version: v2.10.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
+          version: v2.11.0 # renovate: datasource=github-tags depName=goreleaser/goreleaser
           args: build --single-target --snapshot --clean
         env:
           TELEMETRY_ENDPOINT: "" # disables sending telemetry

.github/workflows/functional.yml

@@ -73,7 +73,7 @@ jobs:
       - name: Build binary
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
         with:
-          version: v2.10.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
+          version: v2.11.0 # renovate: datasource=github-tags depName=goreleaser/goreleaser
           args: build --single-target --snapshot --clean
         env:
           TELEMETRY_ENDPOINT: otel-collector-opentelemetry-collector.collector.svc.cluster.local:4317

.github/workflows/release-pr.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Get Release Notes
         id: notes
-        uses: lucacome/draft-release@38def8b74645796e9743b53e0f187d4a8915ea3e # v1.2.3
+        uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
         with:
           config-path: .github/release-notes.yml
           dry-run: true

README.md

@@ -68,7 +68,7 @@ The following table lists the software versions NGINX Gateway Fabric supports.
 
 | NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus | NGINX Agent |
 |----------------------|-------------|------------|-----------|------------|-------------|
-| Edge                 | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.3      |
+| Edge                 | 1.3.0       | 1.25+      | 1.29.0    | R34        | v3.1.0      |
 | 2.0.2                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.1      |
 | 2.0.1                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.1      |
 | 2.0.0                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.0      |

apis/v1alpha2/nginxproxy_types.go

@@ -76,6 +76,13 @@ type NginxProxySpec struct {
 	//
 	// +optional
 	Kubernetes *KubernetesSpec `json:"kubernetes,omitempty"`
+	// WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
+	// Default is 1024.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	WorkerConnections *int32 `json:"workerConnections,omitempty"`
 }
 
 // Telemetry specifies the OpenTelemetry configuration.

apis/v1alpha2/zz_generated.deepcopy.go

@@ -4,10 +4,10 @@ FROM scratch AS nginx-files
 # the following links can be replaced with local files if needed, i.e. ADD --chown=101:1001 <local_file> <container_file>
 ADD --link --chown=101:1001 https://cs.nginx.com/static/keys/nginx_signing.rsa.pub nginx_signing.rsa.pub
 
-FROM nginx:1.28.0-alpine-otel
+FROM nginx:1.29.0-alpine-otel
 
 # renovate: datasource=github-tags depName=nginx/agent
-ARG NGINX_AGENT_VERSION=v3.0.3
+ARG NGINX_AGENT_VERSION=v3.1.0
 ARG NJS_DIR
 ARG NGINX_CONF_DIR
 ARG BUILD_AGENT
@@ -18,8 +18,6 @@ RUN --mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk
 
 RUN apk add --no-cache bash \
     && mkdir -p /usr/lib/nginx/modules \
-    # Update packages for CVE-2025-32414 and CVE-2025-32415
-    && apk --no-cache upgrade libxml2 \
     # forward request and error logs to docker log collector
     && ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log

build/Dockerfile.nginx

@@ -8,7 +8,7 @@ FROM alpine:3.21
 
 ARG NGINX_PLUS_VERSION=R34
 # renovate: datasource=github-tags depName=nginx/agent
-ARG NGINX_AGENT_VERSION=v3.0.3
+ARG NGINX_AGENT_VERSION=v3.1.0
 ARG NJS_DIR
 ARG NGINX_CONF_DIR
 ARG BUILD_AGENT

build/Dockerfile.nginxplus

@@ -305,6 +305,13 @@
               },
               "required": [],
               "type": "object"
+            },
+            "workerConnections": {
+              "description": "The number of worker connections for NGINX. Default is 1024.",
+              "maximum": 65535,
+              "minimum": 1,
+              "required": [],
+              "type": "integer"
             }
           },
           "required": [],