[dependabot]

Bumps gixy-ng from 0.2.55 to 0.2.57.

Release notes

Sourced from gixy-ng's releases.

v0.2.57

Fixed

• Keep the CLI help/version footer and URL on separate lines, with a trailing blank line. The footer now links to NGINX Extras and includes Debian and Ubuntu alongside RHEL.
• Attribute every Checkstyle diagnostic to its source file and reuse a single file element when an included file is also supplied as an input.
• Correct CVE configuration checks for automatic TLS ticket-key rotation, alias/rewrite use of $request_filename, buffered HTTP/3 proxy requests, and inherited SSI/AIO settings. Honor configuration overrides and isolate unrelated server contexts.

Security advisory coverage

This release includes the five NGINX advisories fixed in NGINX 1.30.6 and 1.31.7: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, and CVE-2026-97205. Pass --nginx-version to enable version-aware advice.

Documentation

• Refresh CVE coverage, detection prerequisites, and limitations.
• Update NGINX Extras promotional links and distribution descriptions in English, Russian, and Chinese documentation.

Thanks to @​dajiaohuang for [PR #118](dvershinin/gixy#118) and [PR #119](dvershinin/gixy#119).

Changelog

Sourced from gixy-ng's changelog.

[0.2.57] - 2026-10-21

Fixed

• Checkstyle output: Group each source file once across multiple audited roots, including roots previously encountered as includes, while preserving every diagnostic and its source attribution.
• October NGINX CVE prerequisites: Correct automatic TLS ticket-key rotation, alias/rewrite filename consumers, buffered HTTP/3 proxies, and inherited SSI with AIO detection; keep independent servers and locations isolated.

Changed

• CLI and documentation: Link to NGINX Extras packages for RHEL, Debian and Ubuntu, and document September/October CVE coverage and detection limitations.

[0.2.56] - 2026-10-15

Added

• nginx_cves: the five CVEs fixed in the nginx 1.30.6 / 1.31.7 security releases (CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, CVE-2026-97205), with config-aware triggers for alias+rewrite, HTTP/3, TLS session ticket key rotation, and SSI with AIO.

Commits

• 713dfaa release: v0.2.57
• de7cbba fix: correct CVE prerequisites and CLI diagnostics
• e7261b6 Merge pull request #119 from dajiaohuang/fix/cli-footer-line-breaks-20261020
• b7ce6f7 Merge pull request #118 from dajiaohuang/repostew/gixy-checkstyle-source-attr...
• e3d63d4 Fix CLI footer line breaks for version and help output
• 24c8533 fix(checkstyle): select the source file for each diagnostic
• 9c19245 release: v0.2.56
• 0be4472 nginx_cves: add the five October 2026 release CVEs (1.30.6 / 1.31.7)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #771.