# changelog

author: Nginx Packaging <nginx-packaging@f5.com> - 32-1.el10.ngx
changelog:
  - based on nginx/1.25.5 mainline version.
  - Feature: SSL objects caching: CA cert, certs, keys, revocation lists.
  - Bugfix: SSL: fixed possible configuration overwrite loading "engine:"
    keys.
  - Feature: Virtual servers in the stream module.
  - Feature: The ngx_stream_pass_module.
  - Feature: The "deferred", "accept_filter", and "setfib" parameters of the
    "listen" directive in the stream module.
  - Feature: Cache line size detection for some architectures. Thanks to Piotr
    Sikora.
  - Feature: Support for Homebrew on Apple Silicon. Thanks to Piotr Sikora.
  - Bugfix: Windows cross-compilation bugfixes and improvements. Thanks to
    Piotr Sikora.
  - Bugfix: Unexpected connection closure while using 0-RTT in QUIC. Thanks to
    Vladimir Khomutov.
  - Bugfix: Security: when using HTTP/3 a segmentation fault might occur in a
    worker process while processing a specially crafted QUIC session
    (CVE-2024-24989, CVE-2024-24990).
  - Bugfix: Connections with pending AIO operations might be closed
    prematurely during graceful shutdown of old worker processes.
  - Bugfix: Socket leak alerts no longer logged when fast shutdown was
    requested after graceful shutdown of old worker processes.
  - Bugfix: A socket descriptor error, a socket leak, or a segmentation fault
    in a worker process (for SSL proxying) might occur if AIO was used in a
    subrequest.
  - Bugfix: A segmentation fault might occur in a worker process if SSL
    proxying was used along with the "image_filter" directive and errors with
    code 415 were redirected with the "error_page" directive.
  - Bugfix: Bugfixes and improvements in HTTP/3 and QUIC.
  - Security: Undisclosed HTTP/3 encoder instructions could result in heap
    overflow and cause worker processes to terminate or cause other impact
    (CVE-20240-32760).
  - Security: Undisclosed HTTP/3 requests could result in stack
    overflow/use-after-free and cause worker processes to terminate or cause
    other impact (CVE-2024-31079).
  - Security: Undisclosed HTTP/3 requests could result in null pointer
    dereference and cause worker processes to terminate or cause other impact
    (CVE-2024-35200).
  - Security: In an environment with MTU of 4kb or higher, an undisclosed QUIC
    message could cause worker processes to terminate or cause memory
    disclosure of previously freed memory (CVE-2024-34161).


author: Nginx Packaging <nginx-packaging@f5.com> - 33-1.el10.ngx
changelog:
  - based on nginx/1.27.2 mainline version.
  - Feature: New licensing introduced
  - Feature: SSL: key logging.


author: Nginx Packaging <nginx-packaging@f5.com> - 34-1.el10.ngx
changelog:
  - based on nginx/1.27.4 mainline version.
  - Feature: Native OIDC module.
  - Improvement: Forward proxy support for mgmt module.
  - PDF documentation no longer shipped with the package.


author: Nginx Packaging <nginx-packaging@f5.com> - 33+0.10.27-1.el10.ngx
changelog:
  - Base version updated to 1.27.2-1 (nginx-plus-r33)
  - LuaJIT2 updated to 2.1-20240815.
  - Lua module updated to 0.10.27.
  - Lua stream module updated to 0.0.15.
  - Lua resty core updated to 0.1.30.


author: Nginx Packaging <nginx-packaging@f5.com> - 34+0.10.28-1.el10.ngx
changelog:
  - Base version updated to 1.27.4-1 (nginx-plus-r34)
  - LuaJIT2 updated to 2.1-20250117.
  - Lua module updated to 0.10.28.
  - Lua stream module updated to 0.0.16.
  - Lua resty core updated to 0.1.31.
  - Lua Resty Lrucache updated to 0.15.


author: Nginx Packaging <nginx-packaging@f5.com> - 36+0.10.29-1.el10.ngx
changelog:
  - Base version updated to 1.29.3-1 (nginx-plus-r36)
  - Lua module updated to 0.10.29
  - LuaJIT 2.1 updated to 2.1-20250826
  - lua-resty-core updated to 0.1.32
  - stream-lua-nginx-module updated to 0.0.17


author: Nginx Packaging <nginx-packaging@f5.com> - 34+0.1.1-1.el10.ngx
changelog:
  - Base version updated to 1.27.4-1 (nginx-plus-r34)
  - otel module updated to 0.1.1 (72d8eed53a).
  - opentelemetry-cpp updated to 1.19.0.
  - opentelemetry-proto updated to 1.5.0.


author: Nginx Packaging <nginx-packaging@f5.com> - 35+0.1.2-1.el10.ngx
changelog:
  - Base version updated to 1.29.0-1 (nginx-plus-r35)
  - opentelemetry-proto updated to 1.7.0.
  - opentelemetry-cpp updated to 1.21.0.


author: Nginx Packaging <nginx-packaging@f5.com> - 36+0.1.2-1.el10.ngx
changelog:
  - opentelemetry-proto updated to 1.8.0.
  - opentelemetry-cpp updated to 1.23.0.
  - Base version updated to 1.29.3-1 (nginx-plus-r36)


author: Nginx Packaging <nginx-packaging@f5.com> - 37.0+0.1.2-1.el10.ngx
changelog:
  - Base version updated to 1.29.8-1 (nginx-plus-r37.0.0)
  - opentelemetry-proto updated to 1.10.0.
  - opentelemetry-cpp updated to 1.26.0.


author: Nginx Packaging <nginx-packaging@f5.com> - 32+6.0.20-1.el10.ngx
changelog:
  - Base version updated to 1.25.5-1 (nginx-plus-r32)
  - Passenger version updated to 6.0.20
    https://github.com/phusion/passenger/releases/tag/release-6.0.20


author: Nginx Packaging <nginx-packaging@f5.com> - 37.0+37.0.0.1-1.el10.ngx
changelog:
  - Base version updated to 1.29.8-1 (nginx-plus-r37.0.0)
  - Added support of response_time_hist metrics.


