cloudfoundry / cloudfoundry/staticfile-buildpack
Unable to change the Nginx version
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 203
- Forks
- 322
- PR merge metrics
- No merged PRs in 30d
Description
see https://nginx.org/en/security_advisories.html
The buildpack enforces nginx version 1.27.x. However, this version contains a major vulnerability.
It should be possible to pin the nginx version when deploying our application.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the buildpack behavior that enforces nginx 1.27.x and trace how deployment configuration is handled. Review the linked nginx security advisories for the motivation, then define how a deployment can pin another version; done means an application can select its nginx version instead of being forced to 1.27.x.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- devops
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100