Bump gixy-ng from 0.2.50 to 0.2.53

[dependabot]

Bumps gixy-ng from 0.2.50 to 0.2.53.

Release notes

Sourced from gixy-ng's releases.

v0.2.53

Fixed add_header_redefinition false positives for add_header_inherit merge, including inherited context resolution and equivalent add_trailer_inherit behavior. Explicit on, off, and default inheritance continue to report dropped parent fields.

v0.2.52

Added

• ssl_ecdh_curve check (HIGH): Flags post-quantum group names (X25519MLKEM768, SecP256r1MLKEM768, the X25519Kyber768* drafts) used without the ? prefix. OpenSSL rejects the entire group list when one name is unknown and nginx treats that as NGX_LOG_EMERG, so the config that every post-quantum blog post recommends is a startup failure — not a downgrade — on Debian 12, Ubuntu 24.04 and RHEL 9.
• ssl_stapling_letsencrypt check (LOW): Flags ssl_stapling on for certificates under /etc/letsencrypt/. Let's Encrypt stopped publishing OCSP URLs in early 2025 and shut its responders down on 2025-08-06, so stapling there is dead configuration.

Changed

• RPM documentation: Documented the signed gixy-deep metapackage as the RPM equivalent of the gixy-ng[deep] Python extra across English, Russian, and Chinese installation and ReDoS guides.
• weak_ssl_tls: The ssl_prefer_server_ciphers on finding now names ssl_conf_command Options PrioritizeChaCha; as the escape hatch for setups that must keep server cipher preference, and offers it as a fix alongside switching to off.
• No more external DNS in Gixy's own advice: missing_resolver and ssl_stapling_without_resolver suggested resolver 8.8.8.8 / 1.1.1.1, which Gixy's own resolver_external check rates HIGH. All suggestions and the matching docs now recommend a local or provider-internal resolver.

Full changelog: https://github.com/dvershinin/gixy/blob/master/CHANGELOG.md

v0.2.51

Highlights

• Add optional gixy --deep ReDoS analysis backed by ReDoctor automata and bounded custom-VM fuzzing.
• Keep ReDoctor out of base, RPM, and Homebrew runtime dependencies; install it with pip install 'gixy-ng[deep]'.\n- Preserve Gixy NGINX extraction, reporting, and structural fallback behavior.\n- Disable runtime recall so NGINX-supplied regexes are not executed by the Python backtracking engine.\n- Update English, Russian, and Chinese documentation and CI security pins.

Changelog

Sourced from gixy-ng's changelog.

[0.2.53] - 2026-09-02

Fixed

• add_header_redefinition inheritance semantics: add_header_inherit merge; now suppresses the dropped-parent-header finding, including when inherited from an enclosing http, server, location, or if context. The default on, explicit on, off, and absent cases continue to report because they do not merge parent headers. The equivalent add_trailer_inherit behavior is also covered.

Changed

• Documentation translations: Added Russian and Chinese pages for the ssl_ecdh_curve and ssl_stapling_letsencrypt checks, which shipped English-only in 0.2.52.

[0.2.52] - 2026-08-29

Added

• ssl_ecdh_curve check (HIGH): Flags post-quantum group names (X25519MLKEM768, SecP256r1MLKEM768, the X25519Kyber768* drafts) used without the ? prefix. OpenSSL rejects the entire group list when one name is unknown and nginx treats that as NGX_LOG_EMERG, so the config that every post-quantum blog post recommends is a startup failure — not a downgrade — on Debian 12, Ubuntu 24.04 and RHEL 9.
• ssl_stapling_letsencrypt check (LOW): Flags ssl_stapling on for certificates under /etc/letsencrypt/. Let's Encrypt stopped publishing OCSP URLs in early 2025 and shut its responders down on 2025-08-06, so stapling there is dead configuration.

Changed

• RPM documentation: Documented the signed gixy-deep metapackage as the RPM equivalent of the gixy-ng[deep] Python extra across English, Russian, and Chinese installation and ReDoS guides.
• weak_ssl_tls: The ssl_prefer_server_ciphers on finding now names ssl_conf_command Options PrioritizeChaCha; as the escape hatch for setups that must keep server cipher preference, and offers it as a fix alongside switching to off.
• No more external DNS in Gixy's own advice: missing_resolver and ssl_stapling_without_resolver suggested resolver 8.8.8.8 / 1.1.1.1, which Gixy's own resolver_external check rates HIGH. All suggestions and the matching docs now recommend a local or provider-internal resolver.

[0.2.51] - 2026-08-19

Added

• Optional deep ReDoS analysis: gixy --deep delegates regex analysis to ReDoctor's hybrid automata and bounded custom-VM engine, reports exponential or polynomial complexity with generated attack templates, and retains Gixy's NGINX-specific extraction, reporting, and structural fallback behavior. Install with pip install 'gixy-ng[deep]' or the signed gixy-deep RPM.

Changed

• ReDoctor remains optional: Base, RPM, Homebrew, and other normal Gixy installations do not depend on ReDoctor. Requesting --deep without the extra exits with an actionable installation message. Runtime recall is disabled, so NGINX-supplied regexes are not executed by Python's backtracking engine.
• ReDoS documentation: Replaced the obsolete external recheck-service guidance with local ReDoctor usage and installation instructions in English, Russian, and Chinese.

Fixed

• Documentation builds: Updated the Read the Docs build image and pinned security-scanned CI dependencies so documentation, dependency analysis, and SonarCloud quality gates stay green.

Commits

• 49d9896 release: v0.2.53
• 82b82e4 fix(add_header_redefinition): honor merge inheritance
• 63562f3 docs: document Alpine Linux install (apk add gixy, edge/community)
• 1d87e5d docs: add ru/zh pages for ssl_ecdh_curve and ssl_stapling_letsencrypt
• 2e2be08 release: v0.2.52
• 094c305 feat: add ssl_ecdh_curve and ssl_stapling_letsencrypt checks
• f7f9087 docs: document gixy-deep RPM installation
• d76bdf8 release: v0.2.51
• 3538ab7 fix: make ReDoctor an optional deep dependency
• 5e0ed04 refactor: delegate deep ReDoS analysis to ReDoctor
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)