[dependabot]

Bumps gixy-ng from 0.2.55 to 0.2.60.

Release notes

Sourced from gixy-ng's releases.

v0.2.60

New check: non_expanding_variable

NGINX takes $variables literally in many places, and nginx -t gives no warning. The new check reports them:

• geo and split_clients values (HIGH). geo $limit_key { default $binary_remote_addr; } stores the literal text, so every client shares one limit_req_zone bucket. The report follows map chains to the zone and shows the geo-to-map fix.
• auth_request URI (HIGH). The subrequest goes to the literal URI. If any location answers it with a 2xx status, every request is authorized.
• location and server_name matches, plus location/rewrite/if/server_name regexes (MEDIUM). In a regex, $name is an end anchor followed by text, so the pattern never matches.
• Unrendered ${UPPER_CASE} template placeholders (MEDIUM), for example a Docker template used without envsubst.
• error_log, *_temp_path and *_cache_path paths (LOW). NGINX creates these with $ in the name.

Docs: https://gixy.getpagespeed.com/checks/non-expanding-variable/

Fixes

• A syntax error, such as a missing closing brace, or a missing config file no longer reports "No issues found" with exit code 0. gixy now prints the configuration error and exits non-zero.

Also in this release

• Opt-in local NGINX version and flavor detection with nginx-version = auto.

Python 3.6 compatibility is retained.

v0.2.59

Improvements

• Expand support for NGINX module variables, including GeoIP2, Zstd, srcache, Echo and VTS.
• Recognize Lua, njs and Perl variable declarations while preserving security checks for values that may contain unsafe characters.
• Reduce false positives in regex complexity, map capture and rewritten proxy URI analysis while retaining warnings for unsafe configurations.
• Correct OpenSSL cipher-list handling, including exclusions, intersections and cipher ordering.
• Share the existing --nginx-version option between CVE and QUIC checks. Version information remains explicit; no automatic detection or new issue-specific option is required.
• Preserve quoted control characters during configuration parsing and restrict return HTTP-splitting checks to redirect headers.

Python 3.6 compatibility is retained.

v0.2.58

Added

• Audit-owned layered variable catalogs: bundled, vendor, administrator and explicitly selected directory models, with provenance and filesystem trust checks for automatic system policy.
• Conservative bundled brotli_ratio recognition, independent of target module installation, preserving HTTP-splitting and SSRF analysis.
• --load-default-vars / --no-default-vars, canonical config/environment controls, and isolated library/server defaults.

Fixed

• Keep quoted drop-in values literal and reject malformed entries without erasing valid lower models; select exact names and longest prefixes deterministically within each layer.
• Prevent custom model leakage across audits, pass startup policy to server

... (truncated)

Changelog

Sourced from gixy-ng's changelog.

[0.2.60] - 2026-10-30

Added

• non_expanding_variable check: Flags variables in geo and split_clients values (HIGH), which NGINX stores as literal text. When a geo variable keys limit_req_zone/limit_conn_zone, the report explains that every client shares one limit bucket and shows the geo-to-map fix. Also flags variables in error_log, *_temp_path and *_cache_path paths (LOW), which NGINX creates with $ in the name. It also reports variables in location and server_name matches and in location, rewrite, if and server_name regexes, where $name is a dead end-of-string anchor (MEDIUM). A variable in the auth_request URI is reported as HIGH, because the subrequest goes to the literal URI and a 2xx answer authorizes every request. Unrendered ${UPPER_CASE} template placeholders are reported as MEDIUM.
• Opt-in local NGINX version/flavor detection with nginx-version = auto, shared across version-aware checks and scanned files, plus explicit nginx-flavor overrides for offline targets. Detection is bounded, disabled by default and rejected in server mode.
• Bundled, validated flavor fix evidence; recognize the nginx-mod banner and its QUIC reload backport from advertised version 1.30.6 without suppressing unrelated checks or CVEs or changing the advertised upstream version.

Fixed

• A syntax error such as a missing closing brace, or a missing config file, no longer yields "No issues found" with exit code 0. Crossplane recorded these errors without raising them, so gixy audited an empty tree; it now reports Configuration error: unexpected end of file ... and exits non-zero.

[0.2.59] - 2026-10-25

Added

• Support for Zstd, srcache, Echo and VTS variables, with built-in definitions of their possible values, a coverage matrix listing reviewed source versions and a contribution checklist.
• Recognition of GeoIP2 variables declared in HTTP/stream main configuration, including case-insensitive names and declarations after their uses. The last GeoIP2 declaration wins; conflicting map/geo/njs/Perl declarations allow any characters and retain all declaration locations, even with filesystem policy loading disabled.
• Recognition of Lua file/block and njs variable declarations, treating their output as text that may contain any characters, without executing scripts.

Fixed

• Preserve quoted control characters when parsing NGINX configuration values.
• Prove mandatory disjoint boundaries in static ReDoS analysis, including negated classes, while retaining warnings for nullable, case-folded and DOTALL overlaps.
• Evaluate OpenSSL cipher list commands in order, including intersections, permanent and reversible exclusions, and reorder-only +; flag anonymous

... (truncated)

Commits

• f253465 release: v0.2.60
• e14ddcb feat(non_expanding_variable): flag dead variables in matches, regexes and aut...
• bf14945 feat: flag variables in directives that never expand them
• f88b96a fix: report config syntax errors instead of auditing an empty tree
• e46c1e3 feat: opt in to local nginx version and flavor detection
• 9349ada release: v0.2.59
• 2720f00 docs: prepare variable guides for release
• e07c09e fix: preserve analyzer bounds and share explicit nginx version
• 762f783 docs: describe supported variables in plain language
• 9159034 test: make mutation fixture file writes explicit
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)