`njs` updates are not propagated from `pkg-oss` branches during module builds

Bug Overview

In building nginx modules using modules/ directory, the build process explicitly fetches a tagged branch of nginx/pkg-oss. https://github.com/nginx/docker-nginx/blob/d19b67749e7f9087801ae9f7275eec343753eed8/modules/Dockerfile.alpine#L22

This pins to a specific Nginx release, but a recent critical CVE fix for njs (commit: https://github.com/nginx/pkg-oss/commit/9d879d57ef75661eaed35e787ef434b2f85771f6) landed on the master branch only, but it doesn't appear in the tagged branch.

any thought how to ensure the build of nginx modules are up-to-date to avoid the situtation in the future?

Expected Behavior

Supposedly the njs version should be get updated and follow the master branch even it is not back-ported to tagged branches.

Steps to Reproduce the Bug

just build the Dockerfile in modules/ directory

Environment Details

• Version/release of Docker and method of installation (e.g. Docker Desktop / Docker Server)
• Version of the Docker NGINX image or specific commit: [e.g. 1.4.3/commit hash]
• Target deployment platform: [e.g. OpenShift/Kubernetes/Docker Compose/local cluster/etc...]
• Target OS: [e.g. RHEL 9/Ubuntu 24.04/etc...]

Additional Context

No response

Inspect modules/Dockerfile.alpine around line 22 and build the modules Dockerfile to confirm the tagged pkg-oss checkout and njs version. Review the referenced pkg-oss commit and compare it with the tagged branch; done means the module build uses the intended current njs source while preserving the image's release behavior.