[dependabot]

Bumps gixy-ng from 0.2.55 to 0.2.59.

Release notes

Sourced from gixy-ng's releases.

v0.2.59

Improvements

• Expand support for NGINX module variables, including GeoIP2, Zstd, srcache, Echo and VTS.
• Recognize Lua, njs and Perl variable declarations while preserving security checks for values that may contain unsafe characters.
• Reduce false positives in regex complexity, map capture and rewritten proxy URI analysis while retaining warnings for unsafe configurations.
• Correct OpenSSL cipher-list handling, including exclusions, intersections and cipher ordering.
• Share the existing --nginx-version option between CVE and QUIC checks. Version information remains explicit; no automatic detection or new issue-specific option is required.
• Preserve quoted control characters during configuration parsing and restrict return HTTP-splitting checks to redirect headers.

Python 3.6 compatibility is retained.

v0.2.58

Added

• Audit-owned layered variable catalogs: bundled, vendor, administrator and explicitly selected directory models, with provenance and filesystem trust checks for automatic system policy.
• Conservative bundled brotli_ratio recognition, independent of target module installation, preserving HTTP-splitting and SSRF analysis.
• --load-default-vars / --no-default-vars, canonical config/environment controls, and isolated library/server defaults.

Fixed

• Keep quoted drop-in values literal and reject malformed entries without erasing valid lower models; select exact names and longest prefixes deterministically within each layer.
• Prevent custom model leakage across audits, pass startup policy to server audits, and use the audit catalog in missing_resolver.
• Correct vars-dirs config examples to comma-separated scalar syntax.

Changed

• CLI and documentation: Point to GetPageSpeed Amplify for continuous Gixy scans across every host; the rich console footer suggests NGINX Extras builds when the nginx_cves check finds a vulnerable NGINX version.

v0.2.57

Fixed

• Keep the CLI help/version footer and URL on separate lines, with a trailing blank line. The footer now links to NGINX Extras and includes Debian and Ubuntu alongside RHEL.
• Attribute every Checkstyle diagnostic to its source file and reuse a single file element when an included file is also supplied as an input.
• Correct CVE configuration checks for automatic TLS ticket-key rotation, alias/rewrite use of $request_filename, buffered HTTP/3 proxy requests, and inherited SSI/AIO settings. Honor configuration overrides and isolate unrelated server contexts.

Security advisory coverage

This release includes the five NGINX advisories fixed in NGINX 1.30.6 and 1.31.7: CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97629, and CVE-2026-97205. Pass --nginx-version to enable version-aware advice.

Documentation

• Refresh CVE coverage, detection prerequisites, and limitations.
• Update NGINX Extras promotional links and distribution descriptions in English, Russian, and Chinese documentation.

... (truncated)

Changelog

Sourced from gixy-ng's changelog.

[0.2.59] - 2026-10-25

Added

• Support for Zstd, srcache, Echo and VTS variables, with built-in definitions of their possible values, a coverage matrix listing reviewed source versions and a contribution checklist.
• Recognition of GeoIP2 variables declared in HTTP/stream main configuration, including case-insensitive names and declarations after their uses. The last GeoIP2 declaration wins; conflicting map/geo/njs/Perl declarations allow any characters and retain all declaration locations, even with filesystem policy loading disabled.
• Recognition of Lua file/block and njs variable declarations, treating their output as text that may contain any characters, without executing scripts.

Fixed

• Preserve quoted control characters when parsing NGINX configuration values.
• Prove mandatory disjoint boundaries in static ReDoS analysis, including negated classes, while retaining warnings for nullable, case-folded and DOTALL overlaps.
• Evaluate OpenSSL cipher list commands in order, including intersections, permanent and reversible exclusions, and reorder-only +; flag anonymous and NULL selections and retain conditional warnings for unresolved aliases.
• Bound map captures by their complete source expression, including literal text and nested maps, and keep capture scope distinct across map entries.
• Suppress proxy $uri/$document_uri HTTP-splitting warnings only when every local rewrite path reaching the proxy proves the URI safe.
• Share an explicitly supplied nginx version between CVE and QUIC checks; upstream 1.31.7 and later suppress the QUIC reload warning.
• Replace blanket trust of GeoIP, SSL and JWT prefixes with definitions for exact names or documented prefixes. Values that may contain any characters, including line breaks, remain subject to security checks.
• Preserve Lua block destination arguments and treat Lua/Perl return values as text that may contain any characters rather than assuming they are safe; skip invalid includes inside GeoIP2 before I/O.
• Limit return HTTP-splitting checks to redirect Location values, including URL shorthand; ordinary response body text retains resolution diagnostics.
• Require a resolver for configuration-defined dynamic map/regex hosts, including nested dependencies, while preserving catalog-only fallback behavior.

[0.2.58] - 2026-10-25

Added

• Layered variable definitions: built-in definitions, vendor files, administrator files and explicitly selected directories. Each audit keeps its own catalog, with definition locations and filesystem trust checks for automatic system policy.
• Conservative bundled brotli_ratio recognition, independent of target module installation, preserving HTTP-splitting and SSRF analysis.
• --load-default-vars / --no-default-vars, canonical config/environment controls, and isolated library/server defaults.

... (truncated)

Commits

• 9349ada release: v0.2.59
• 2720f00 docs: prepare variable guides for release
• e07c09e fix: preserve analyzer bounds and share explicit nginx version
• 762f783 docs: describe supported variables in plain language
• 9159034 test: make mutation fixture file writes explicit
• 57e4c42 feat: expand module variable coverage and preserve taint
• 0dc53ab release: v0.2.58
• 3686a8d feat: load layered variable definitions per audit
• 9143a99 test_py36.sh: use $HOME in comment
• 08e94be docs: add missing ru/zh Amplify CTAs and translations
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #774.