Version 1.31.8.1 - 26 October 2026

• Nginx core

  • upgraded from nginx 1.31.1 to 1.31.8.

• OpenSSL

  • upgraded from version 3.5.6 to 3.5.9.

• PCRE2

  • upgraded from version 10.47 to 10.49.

• upgraded lua-nginx-module to v0.10.32rc7

  • feature: compress certificates set from ssl_certificate_by_lua*. Thanks Y.Horie for the patch.
  • bugfix: allocate local address for each balancer bind. Thanks lijunlong for the patch.
  • bugfix: avoid truncating Lua context in filters. Thanks Hanada for the patch.
  • bugfix: balancer_by_lua* fix unbounded retries caused by a wrapped try count. Thanks Héctor for the patch.
  • bugfix: balancer keepalive connections were never reused with proxy_bind. Thanks Jiří Setnička for the patch.
  • bugfix: change return values to NGX_DECLINED in precontent_by_lua. Thanks Hanada for the patch.
  • bugfix: clean child coroutine ops when killing uthreads. Thanks Jun Ouyang for the patch.
  • bugfix: clear inherited chain before compressing certificates. Thanks lijunlong for the patch.
  • bugfix: double-free of client CA name list on verify_client error. Thanks lijunlong for the patch.
  • bugfix: heap-use-after-free in tcp_finalize after receiveuntil iterator GC. Thanks Y.Horie for the patch.
  • bugfix: mark Lua subrequests for HTTP/2 error wakeup. (#2508) Thanks kurt for the patch.
  • bugfix: ngx.flush() buffer could be recycled while still queued. (#2518) Thanks Jiří Setnička for the patch.
  • bugfix: raise luaL_error instead of returning NGX_ERROR in string helper. Thanks lijunlong for the patch.
  • bugfix: regex compile returned NGX_OK on pcre_fullinfo() failure. Thanks lijunlong for the patch.
  • bugfix: reject settrustedstore on already-handshaked cosocket. (#2505) Thanks perfgao for the patch.
  • bugfix: restore single-part invariant for subrequest input headers. Thanks lijunlong for the patch.
  • bugfix: run_worker_thread error paths leaked, double-freed, and over-counted. Thanks lijunlong for the patch.
  • bugfix: server_rewrite_by_lua* used the global VM when lua_code_cache off. Thanks xiaobiaozhao for the patch.
  • bugfix: set_uri/set_uri_args returned -1 from a Lua C function on OOM. Thanks lijunlong for the patch.
  • bugfix: sslhandshake lost verify error when handshake completed immediately. (#2506) Thanks kurt for the patch.
  • ci: test nginx 1.31.3 with packaged dependencies. Thanks lijunlong for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.
  • doc: Update documentation for ngx.req.set_uri. Thanks Brian Rak for the patch.
  • style: fixed code style. Thanks Hanada for the patch.

• upgraded stream-lua-nginx-module to v0.0.20rc3

  • bugfix: avoid use-after-free after receiveuntil iterator GC. Thanks lijunlong for the patch.
  • bugfix: clean child coroutine ops when killing uthreads. Thanks lijunlong for the patch.
  • bugfix: drain buffered output before error finalization. Thanks lijunlong for the patch.
  • bugfix: three latent bugs found in src code review. Thanks lijunlong for the patch.
  • ci: test nginx 1.31.3 with packaged dependencies. Thanks lijunlong for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.

• upgraded lua-resty-core to v0.1.35rc2

  • feature: added ngx.ssl.compress_certs(). Thanks Y.Horie for the patch.
  • bugfix: fixed several FFI correctness issues found in code review. Thanks lijunlong for the patch.
  • bugfix: remove sslhandshake result assert for pre-handshake errors. (#534) Thanks kurt for the patch.
  • bugfix: sslhandshake read error details on immediate FFI_ERROR. (#533) Thanks kurt for the patch.
  • bugfix: stream cosocket getsslctx() bound to wrong FFI symbol. Thanks perfgao for the patch.
  • ci: test nginx 1.31.3 with packaged dependencies. Thanks lijunlong for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.

• upgraded luajit2 to v2.1-20261023

  • Add FOLD rule for ALEN of TNEW/TDUP. Thanks Mike Pall for the patch.
  • Add line number directive. v3.0 backport. Thanks Mike Pall for the patch.
  • Allow empty statements (semicolons) anywhere. v3.0 backport. Thanks Mike Pall for the patch.
  • ARM64: Fix BC_JFORI on empty FP range. Thanks Mike Pall for the patch.
  • ARM64: Fix getmetatable() for cleared __metatable field. Thanks Mike Pall for the patch.
  • Avoid race condition with profiler thread during dispatch table update. Thanks Mike Pall for the patch.
  • Backport some v3.0 syntax extensions. Thanks Mike Pall for the patch.
  • bugfix: Update lj_tab.c, Fix test failures encountered on ppc64le. Thanks Isgandar Valizada for the patch.
  • Check for IR_NEWREF in IR_ALEN forwarding. Thanks Mike Pall for the patch.
  • Compile unpack(). Thanks Mike Pall for the patch.
  • Document bit operator bytecode compatibility. Thanks Mike Pall for the patch.
  • Don't fold -a / -b for unsigned operands. Thanks Mike Pall for the patch.
  • Don't record for loops with +-0 step. Thanks Mike Pall for the patch.
  • Don't use destroyed lock when profiler has been stopped. Thanks Mike Pall for the patch.
  • DynASM/ARM64: Prevent sanitizer warning in dasm_imm13(). Thanks Mike Pall for the patch.
  • DynASM/x86: Fix insertps instruction encoding. Thanks Mike Pall for the patch.
  • DynASM/x86: Fix movd/movq and vmovd/vmovq operand sizes. Thanks Mike Pall for the patch.
  • FFI: Adjust J->maxslot after ffi.offsetof. Thanks Mike Pall for the patch.
  • FFI/ARM64e: Sign FFI callback pointers. Thanks Mike Pall for the patch.
  • FFI: Don't drop signedness in FOLD rule for FLOAD of CNEWI. Thanks Mike Pall for the patch.
  • FFI: Fix recording of string buffer put() method. Thanks Mike Pall for the patch.
  • FFI: Fix widening semantics for 64 bit arithmetic. Thanks Mike Pall for the patch.
  • FFI/MacOS: Fix calling convention for enums. Thanks Mike Pall for the patch.
  • FFI/MacOS: Fix calling convention for on-stack varargs. Thanks Mike Pall for the patch.
  • FFI: Mark cts->L in atomic phase. Thanks Mike Pall for the patch.
  • FFI: Prevent sanitizer warning in carith_ptr(). Thanks Mike Pall for the patch.
  • FFI: Set cur_L in FFI callback. Thanks Mike Pall for the patch.
  • FFI: Various ABI and calling convention fixes. Thanks Mike Pall for the patch.
  • Fix BC_UNM of 0 on s390x. (#259) Thanks Ilya Leoshkevich for the patch.
  • Fix concurrent allocation issue on DragonFly (unsupported). Thanks Mike Pall for the patch.
  • Fix corner case of os.time(). Thanks Mike Pall for the patch.
  • Fix documentation about Lua 5.2 extensions/compatibility. Thanks Mike Pall for the patch.
  • Fix next() recording immediately after ITERN despecialization. Thanks Mike Pall for the patch.
  • Fix parsing of safe-navigation operator. Thanks Mike Pall for the patch.
  • Fix stack overflow relimit handling. Thanks Mike Pall for the patch.
  • Fix unpack() recording. Thanks Mike Pall for the patch.
  • Handle OOM error during trace stitching. Thanks Mike Pall for the patch.
  • iOS: Avoid macro name collision. Thanks Mike Pall for the patch.
  • iOS: Disable non-functional os.tmpname(). Thanks Mike Pall for the patch.
  • macOS: Avoid collision of mcode with xzone malloc reclaim ring. Thanks Mike Pall for the patch.
  • Make check in os.time() consistent. Thanks Mike Pall for the patch.
  • Modernize jit.* Lua modules. Thanks Mike Pall for the patch.
  • Optimize common 1-char case of string.sub/string.byte. Thanks Mike Pall for the patch.
  • Optionally return PC position in jit.util.tracesnap(). Thanks Mike Pall for the patch.
  • PPC64: correct number conversions for the 64-bit ABI. Thanks Evan Wies for the patch.
  • PPC64: use pointer-width accesses when resetting string buffer. Thanks Minsoo Choo for the patch.
  • PPC: Call libm helpers via private GOT instead of the PLT. (#271) Thanks Josef Schlehofer for the patch.
  • PPC: Fix string.* fast functions with P64 set (testing only). Thanks Mike Pall for the patch.
  • PPC soft-float: fix ipairs() returning corrupted values and pairs() yielding a spurious nil. (#270) Thanks Josef Schlehofer for the patch.
  • Prevent sanitizer warning in os.time(). Thanks Mike Pall for the patch.
  • Prevent sanitizer warnings for lj_tab_new*() and table.new(). Thanks Mike Pall for the patch.
  • s390x: Add bit operator support. (#275) Thanks Andreas Arnez for the patch.
  • s390x: Fix big-endian access to ERRF cframe slot. (#268) Thanks Ulrich Weigand for the patch.
  • s390x: Fix errcode return during exception unwinding. Thanks Ulrich Weigand for the patch.
  • Windows: Use 64 bit conversion for tonumber() with base. Thanks Mike Pall for the patch.
  • x64/ARM64/MIPS64: Fix constant bit shift code generation. Thanks Mike Pall for the patch.
  • x64: Fix callback result handling. Thanks Mike Pall for the patch.
  • x64: Fix math.floor()/ceil() argument check. Thanks Mike Pall for the patch.
  • x64/LJ_GC64: Avoid store-to-load forwarding stall after stack restore. Thanks Mike Pall for the patch.
  • x64/LJ_GC64: Enable XLOAD/STRREF fusion. Thanks Mike Pall for the patch.
  • x64/LJ_GC64: Fix XLOAD fusion. Thanks Mike Pall for the patch.
  • x86: Conditionally use SSE3 for 64 bit conversions. Thanks Mike Pall for the patch.
  • x86: Fix math.floor()/ceil() argument check. Thanks Mike Pall for the patch.
  • x86/x64: Change ipairs_aux to match JIT backend behavior. Thanks Mike Pall for the patch.

• upgraded opm to v0.0.12

  • bugfix(web): use WebP OpenResty logo. Thanks lijunlong for the patch.
  • change: only 1 worker process is enough. Thanks lijunlong for the patch.
  • fix: build: use marked.parse() for marked v4 compatibility. Thanks lijunlong for the patch.
  • fix: delete templates.lua on generation failure; bump VERSION to 0.0.10. Thanks lijunlong for the patch.
  • fix: pgmoon: parse affected row counts without NUL. Thanks lijunlong for the patch.
  • fix: web: resolve package pages under both user and org of the same login. Thanks lijunlong for the patch.
  • fix: web: resolve pkg fetch under both user and org of the same login. Thanks lijunlong for the patch.
  • update version to v0.0.11. Thanks lijunlong for the patch.

• upgraded set-misc-nginx-module to v0.34

  • bugfix: initialize base32 decode sentinel table. Thanks lijunlong for the patch.
  • doc: several typo fixes in README.markdown. Thanks willmafh for the patch.

• upgraded lua-resty-upstream-healthcheck to v0.10

  • bugfix: close probe socket on send timeout. Thanks lijunlong for the patch.

• upgraded encrypted-session-nginx-module to v0.10

  • bugfix: constant-time MAC compare and aligned timestamp read. Thanks lijunlong for the patch.

• upgraded lua-resty-dns to v0.24

  • bugfix: reject incomplete DNS resource records. Thanks lijunlong for the patch.
  • ci: migrate Travis CI to GitHub Actions. Thanks lijunlong for the patch.
  • ci: test against nginx 1.31.3. Thanks lijunlong for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.

• upgraded drizzle-nginx-module to v0.1.14

  • bugfix: avoid use-after-free of column in debug logging. Thanks lijunlong for the patch.

• upgraded lua-resty-redis to v0.34

  • bugfix: preserve module command arguments and transaction state. Thanks lijunlong for the patch.
  • bugfix: transaction state now follows confirmed replies; unambiguous pool names for db/username. Thanks shushen for the patch.
  • ci: migrate Travis CI to GitHub Actions. Thanks lijunlong for the patch.
  • ci: test nginx 1.31.3 with packaged dependencies. Thanks lijunlong for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.
  • feature: connect() options db/password/username/tcp_keepalive, hmget() with a table, and two bug fixes. Thanks shushen for the patch.

• upgraded lua-resty-memcached to v0.18

  • bugfix: return the actual error from _version_reply. Thanks lijunlong for the patch.

• upgraded ngx_postgres to v1.1

  • bugfix: recover postgres peer data when wrapped by another module. Thanks lijunlong for the patch.
  • dev: checked in util/build.sh. Thanks Yichun Zhang (agentzh) for the patch.
  • dev: util/build.sh: removed redundant config options for the http auth request module. (#6) Thanks Johnny Wang for the patch.
  • style: fixed minor coding style issues found by ngx-releng. Thanks Yichun Zhang (agentzh) for the patch.

• upgraded lua-resty-openssl to v1.9.0

  • chore(ci) add openssl 4.0 matrix and bump fips provider. Thanks Wangchong Zhou for the patch.
  • chore(ci) bump actions version. Thanks Wangchong Zhou for the patch.
  • chore(ci) bump OpenSSL and NGINX versions in CI workflow. (#234) Thanks Wangchong Zhou for the patch.
  • chore(ci) bump openssl versions. Thanks Wangchong Zhou for the patch.
  • chore(nginx) support openresty 1.29.2. Thanks leaf corcoran for the patch.
  • doc(readme) improve English. Thanks Wangchong Zhou for the patch.
  • feat(*) openssl 4.0. Thanks Wangchong Zhou for the patch.
  • feat(pkey) support post-quantum key operations. Thanks Wangchong Zhou for the patch.
  • fix(*) correct error message from bn:mod_sqr and pkey. (#233) Thanks perfgao for the patch.
  • fix(pkey) generalize raw key handling. Thanks Wangchong Zhou for the patch.
  • fix(pkey) identify provider-native key types. Thanks Wangchong Zhou for the patch.
  • fix(pkey) size raw key buffers dynamically. Thanks Wangchong Zhou for the patch.
  • release: 1.8.0. (#237) Thanks Wangchong Zhou for the patch.
  • release: 1.9.0. Thanks Wangchong Zhou for the patch.

• upgraded lua-resty-websocket to v0.16

  • bugfix: client: reject a handshake response whose status is not 101. Thanks Shreemaan Abhishek for the patch.
  • bugfix: handle folded headers and trim protocol whitespace. Thanks lijunlong for the patch.
  • bugfix: harden WebSocket parsing and timeout recovery. Thanks lijunlong for the patch.
  • bugfix: nil-guard receive error in recv_frame. Thanks lijunlong for the patch.
  • bugfix: validate handshakes and resume partial WebSocket frames. Thanks lijunlong for the patch.
  • ci: migrate Travis CI to GitHub Actions. Thanks lijunlong for the patch.
  • ci: test nginx 1.31.3 with packaged dependencies. Thanks lijunlong for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.
  • doc: fix typo in comments. Thanks harry-xm for the patch.

• upgraded lua-resty-mysql to v0.31

  • bugfix: correct password scramble indexing in caching_sha2 auth. Thanks lijunlong for the patch.

• upgraded lua-cjson to v2.1.0.20

  • bugfix: fix C99 for-loop declaration for GCC 4.8.5 C89 compatibility. Thanks lijunlong for the patch.
  • bugfix: own a copy of the encode_indent string. Thanks lijunlong for the patch.
  • bugfix: setting encode_escape_forward_slash on a cjson instance does not affect other instances. Thanks SnowOnion for the patch.
  • ci: update actions for Node.js 24. Thanks lijunlong for the patch.
  • feature: add option to sort encoded object keys. Thanks Artem Krinitsyn for the patch.

• upgraded headers-more-nginx-module to v0.40

  • bugfix: bound Content-Type charset parsing and reset per-header builtin flag. Thanks lijunlong for the patch.
  • doc: fix syntax by adding a semicolon in README. Thanks Baba Boota for the patch.
  • doc: update copyright. Thanks lijunlong for the patch.
  • doc: update latest compatible nginx version. Thanks lijunlong for the patch.

• upgraded lua-resty-signal to v0.05

  • bugfix: map SIGSYS on all platforms, not only macOS. Thanks lijunlong for the patch.

• upgraded ngx_devel_kit to v0.3.6

  • bugfix: detect nginx complex-value script support. Thanks lijunlong for the patch.
  • bugfix: support complex values with nginx 1.31.3. Thanks lijunlong for the patch.

• upgraded echo-nginx-module to v0.65

  • bugfix: guard NULL ctx on OOM in subrequest/location handlers. Thanks lijunlong for the patch.

• upgraded srcache-nginx-module to v0.34

  • fix: correct ctx allocation size and empty-args zeroing. Thanks lijunlong for the patch.

• upgraded memc-nginx-module to v0.21

  • bugfix: guard NULL ctx in $memc_flags_as_http_time handler. Thanks lijunlong for the patch.

• upgraded lua-resty-string to v0.19

  • bugfix: treat RAND_bytes returning -1 as failure. Thanks lijunlong for the patch.
  • feature: add md5.final_hex() method for direct hex digest output. Thanks lijunlong for the patch.

• upgraded resty-cli to v0.36

  • feature: resty: added the --no-clean option to keep the temporary nginx prefix directory on exit. Thanks lijunlong for the patch.
  • optimize(md2pod): bound setext heading regex to lines. Thanks lijunlong for the patch.
  • optimize(md2pod): guard expensive parser regexes. Thanks lijunlong for the patch.
  • optimize(nginx-xml2pod): dispatch parsing by tag name. Thanks lijunlong for the patch.