Bump gixy-ng from 0.2.50 to 0.2.52

[dependabot]

Bumps gixy-ng from 0.2.50 to 0.2.52.

Release notes

Sourced from gixy-ng's releases.

v0.2.52

Added

• ssl_ecdh_curve check (HIGH): Flags post-quantum group names (X25519MLKEM768, SecP256r1MLKEM768, the X25519Kyber768* drafts) used without the ? prefix. OpenSSL rejects the entire group list when one name is unknown and nginx treats that as NGX_LOG_EMERG, so the config that every post-quantum blog post recommends is a startup failure — not a downgrade — on Debian 12, Ubuntu 24.04 and RHEL 9.
• ssl_stapling_letsencrypt check (LOW): Flags ssl_stapling on for certificates under /etc/letsencrypt/. Let's Encrypt stopped publishing OCSP URLs in early 2025 and shut its responders down on 2025-08-06, so stapling there is dead configuration.

Changed

• RPM documentation: Documented the signed gixy-deep metapackage as the RPM equivalent of the gixy-ng[deep] Python extra across English, Russian, and Chinese installation and ReDoS guides.
• weak_ssl_tls: The ssl_prefer_server_ciphers on finding now names ssl_conf_command Options PrioritizeChaCha; as the escape hatch for setups that must keep server cipher preference, and offers it as a fix alongside switching to off.
• No more external DNS in Gixy's own advice: missing_resolver and ssl_stapling_without_resolver suggested resolver 8.8.8.8 / 1.1.1.1, which Gixy's own resolver_external check rates HIGH. All suggestions and the matching docs now recommend a local or provider-internal resolver.

Full changelog: https://github.com/dvershinin/gixy/blob/master/CHANGELOG.md

v0.2.51

Highlights

• Add optional gixy --deep ReDoS analysis backed by ReDoctor automata and bounded custom-VM fuzzing.
• Keep ReDoctor out of base, RPM, and Homebrew runtime dependencies; install it with pip install 'gixy-ng[deep]'.\n- Preserve Gixy NGINX extraction, reporting, and structural fallback behavior.\n- Disable runtime recall so NGINX-supplied regexes are not executed by the Python backtracking engine.\n- Update English, Russian, and Chinese documentation and CI security pins.

Changelog

Sourced from gixy-ng's changelog.

[0.2.52] - 2026-08-29

Added

• ssl_ecdh_curve check (HIGH): Flags post-quantum group names (X25519MLKEM768, SecP256r1MLKEM768, the X25519Kyber768* drafts) used without the ? prefix. OpenSSL rejects the entire group list when one name is unknown and nginx treats that as NGX_LOG_EMERG, so the config that every post-quantum blog post recommends is a startup failure — not a downgrade — on Debian 12, Ubuntu 24.04 and RHEL 9.
• ssl_stapling_letsencrypt check (LOW): Flags ssl_stapling on for certificates under /etc/letsencrypt/. Let's Encrypt stopped publishing OCSP URLs in early 2025 and shut its responders down on 2025-08-06, so stapling there is dead configuration.

Changed

• RPM documentation: Documented the signed gixy-deep metapackage as the RPM equivalent of the gixy-ng[deep] Python extra across English, Russian, and Chinese installation and ReDoS guides.
• weak_ssl_tls: The ssl_prefer_server_ciphers on finding now names ssl_conf_command Options PrioritizeChaCha; as the escape hatch for setups that must keep server cipher preference, and offers it as a fix alongside switching to off.
• No more external DNS in Gixy's own advice: missing_resolver and ssl_stapling_without_resolver suggested resolver 8.8.8.8 / 1.1.1.1, which Gixy's own resolver_external check rates HIGH. All suggestions and the matching docs now recommend a local or provider-internal resolver.

[0.2.51] - 2026-08-19

Added

• Optional deep ReDoS analysis: gixy --deep delegates regex analysis to ReDoctor's hybrid automata and bounded custom-VM engine, reports exponential or polynomial complexity with generated attack templates, and retains Gixy's NGINX-specific extraction, reporting, and structural fallback behavior. Install with pip install 'gixy-ng[deep]' or the signed gixy-deep RPM.

Changed

• ReDoctor remains optional: Base, RPM, Homebrew, and other normal Gixy installations do not depend on ReDoctor. Requesting --deep without the extra exits with an actionable installation message. Runtime recall is disabled, so NGINX-supplied regexes are not executed by Python's backtracking engine.
• ReDoS documentation: Replaced the obsolete external recheck-service guidance with local ReDoctor usage and installation instructions in English, Russian, and Chinese.

Fixed

• Documentation builds: Updated the Read the Docs build image and pinned security-scanned CI dependencies so documentation, dependency analysis, and SonarCloud quality gates stay green.

Commits

• 2e2be08 release: v0.2.52
• 094c305 feat: add ssl_ecdh_curve and ssl_stapling_letsencrypt checks
• f7f9087 docs: document gixy-deep RPM installation
• d76bdf8 release: v0.2.51
• 3538ab7 fix: make ReDoctor an optional deep dependency
• 5e0ed04 refactor: delegate deep ReDoS analysis to ReDoctor
• d6cdf2a ci: expose exact dependencies to Sonar
• dfcfd09 ci: pin security-scanned dependencies
• 7ed0240 fix: restore Sonar security rating
• 421b443 feat: add deep automata ReDoS analysis
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #742.