September updates: nginx 1.31.5, Go 1.27.1, and a month of BoringSSL not taken

The AdGuard Home fork was rebuilt with a DoQ 0-RTT opcode gate ported from dnsproxy v0.84.2, nginx went to 1.31.5 with the binary replaced under a live socket, and every Go service moved to 1.27.1. A month of BoringSSL was reviewed and left alone: 137 commits, no CVEs.

TL;DR

AdGuard Home fork rebuilt and redeployed at v0.107.79-edge, carrying a DoQ 0-RTT opcode gate ported from upstream dnsproxy v0.84.2. RFC 9250 section 4.5 allows only QUERY and NOTIFY in 0-RTT data; before this, nothing here read the opcode at all.
nginx 1.31.5 on 2 September. Not a security release - no Security entry in CHANGES. The binary was replaced without the service stopping: the unit has been active since 1 September, the master process since 2 September.
Go 1.27.1 across every Go service here. Maintenance, not an advisory - the release notes say "fixes to", not "security fixes to". August’s 1.26.6 was the one with advisories behind it.
BoringSSL reviewed at 0.20260903.0 and not taken. 137 commits across 315 files since the tag we build against, containing no CVEs; the only two commits mentioning an advisory are titled "BoringSSL Not Affected". A rebuild costs a restart and there was nothing to buy with it.
Unchanged and current: redis 8.10.1, unbound 1.26.0, dnscrypt-proxy 2.1.18.

One number here was wrong first: a shallow clone on this box counted 84 BoringSSL commits instead of 137, silently, because the tag it counts from sits inside its own graft boundary. The figures above come from the compare API and a tree diff, each checked a second way.

The previous update pass is four updates, two security labels, and a check that could only report clean. The full change record, with the open items, is in the edge spec.