fix: upgrade nginx base image to fix CVE-2026-42945 (CVSS 9.2 RCE)

Switch from nginx:stable-alpine (1.26.x, vulnerable) to nginx:1.31-alpine
which includes the fix for CVE-2026-42945, a heap buffer overflow in
ngx_http_rewrite_module allowing unauthenticated RCE.

Affected: nginx 0.6.27 – 1.30.0
Fixed in: nginx 1.30.1, 1.31.0
Ref: https://nginx.org/en/security_advisories.html

Author: kxhubs

Dockerfile

@@ -10,7 +10,7 @@ COPY . .
 RUN pnpm build
 
 # production stage
-FROM nginx:stable-alpine AS production-stage
+FROM nginx:1.31-alpine AS production-stage
 COPY --from=build-stage /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80