[mrrobot47]

Applies pending Debian updates when the nginx-proxy image is built.

jwilder/nginx-proxy:1.11.6 (2026-07-16) is still the latest release, and upstream doesn't rebuild the image between releases, so the Debian 13 base we build on is frozen at its July snapshot. Rebuilding our image with the same tag didn't help either: the Dockerfile only installed apache2-utils, so everything else stayed at the July versions. At build time today, apt-get upgrade updates 39 packages, many from trixie-security: openssl/libssl3t64 3.5.6 → 3.5.7, libexpat1 2.7.1 → 2.9.0, libpcre2-8-0, curl/libcurl4t64, libc6, liblzma5, libpng16, libtiff6 and tzdata among them.

The nginx binary comes from nginx.org, whose apt source isn't kept in the image, so it isn't touched: nginx stays at 1.31.3 until the next upstream nginx-proxy release.

Testing

• Built locally and on GitHub Actions: apt-get upgrade reports 39 upgraded, and apt list --upgradable in the built image is empty apart from nginx.
• nginx -v 1.31.3, nginx -t passes, Debian 13.7, OpenSSL 3.5.7, htpasswd, docker-gen 0.17.2 and forego present, /version.conf unchanged.
• nginx started without the Docker socket serves the default page (HTTP 200, X-Powered-By: EasyEngine v4).
• Full entrypoint on the CI runner (Docker socket mounted): docker-gen renders nginx.tmpl for a backend container with VIRTUAL_HOST=smoke.test, nginx -t passes, and a request with Host: smoke.test through the proxy reaches the backend.

[Copilot]

🟢 Approval recommended

The narrowly scoped change correctly sequences package operations, and the reported build and proxy smoke tests support approval.

No open issues 🎉

What changed in this PR

This PR updates Debian packages when building the nginx-proxy image, addressing packages left outdated between upstream image releases.

Changes:

• Adds apt-get upgrade -y after refreshing package indexes, before installing apache2-utils.
• Documents why build-time upgrades are needed and preserves package-list cleanup.

File	Description
nginx-proxy/​Dockerfile	Applies pending Debian upgrades during the image build.

_{Review effort: Balanced}