Changes with nginx 1.13.3:

*) Security: a specially crafted request might result in an integer
   overflow and incorrect processing of ranges in the range filter,
   potentially resulting in sensitive information leak (CVE-2017-7529).

Changes with nginx 1.13.2:

*) Change: nginx now returns 200 instead of 416 when a range starting
   with 0 is requested from an empty file.

*) Feature: the "add_trailer" directive.

*) Bugfix: nginx could not be built on Cygwin and NetBSD; the bug had
   appeared in 1.13.0.

*) Bugfix: nginx could not be built under MSYS2 / MinGW 64-bit.

*) Bugfix: a segmentation fault might occur in a worker process when
   using SSI with many includes and proxy_pass with variables.

*) Bugfix: in the ngx_http_v2_module.

Changes with nginx 1.13.1:

*) Feature: now a hostname can be used as the "set_real_ip_from"
   directive parameter.

*) Feature: vim syntax highlighting scripts improvements.

*) Feature: the "worker_cpu_affinity" directive now works on DragonFly
   BSD.

*) Bugfix: SSL renegotiation on backend connections did not work when
   using OpenSSL before 1.1.0.

*) Workaround: nginx could not be built with Oracle Developer Studio
   12.5.

*) Workaround: now cache manager ignores long locked cache entries when
   cleaning cache based on the "max_size" parameter.

*) Bugfix: client SSL connections were immediately closed if deferred
   accept and the "proxy_protocol" parameter of the "listen" directive
   were used.

*) Bugfix: in the "proxy_cache_background_update" directive.

*) Workaround: now the "tcp_nodelay" directive sets the TCP_NODELAY
   option before an SSL handshake.


(adam)