flo/gaehsnitz
1
0
Fork 0
Code Issues 1 Pull Requests 2 Projects Releases Wiki Activity

Update dependency gunicorn to v25 #14

Open
flo wants to merge 1 commits from renovate/gunicorn-25.x into main
pull from: renovate/gunicorn-25.x
merge into: flo:main
Conversation 0 Commits 1 Files Changed 1 +1 -1
flo commented 2026-02-01 17:01:03 +00:00
Owner
Copy Link

This PR contains the following updates:

Package Change Age Confidence
gunicorn (changelog) ==23.0.0 -> ==25.0.1 age confidence

Release Notes

benoitc/gunicorn (gunicorn)

v25.0.1

Compare Source

Bug Fixes

  • Fix ASGI streaming responses (SSE) hanging: add chunked transfer encoding for
    HTTP/1.1 responses without Content-Length header. Without chunked encoding,
    clients wait for connection close to determine end-of-response.

Changes

  • Update celery_alternative example to use FastAPI with native ASGI worker and
    uvloop for async task execution

Testing

  • Add ASGI compliance test suite with Docker-based integration tests covering HTTP,
    WebSocket, streaming, lifespan, framework integration (Starlette, FastAPI),
    HTTP/2, and concurrency scenarios

v25.0.0: Gunicorn 25.0.0

Compare Source

New Features

  • Dirty Arbiters: Separate process pool for executing long-running, blocking
    operations (AI model loading, heavy computation) without blocking HTTP workers
    (PR #​3460)

    • Inspired by Erlang's dirty schedulers
    • Asyncio-based with Unix socket IPC
    • Stateful workers that persist loaded resources
    • New settings: --dirty-app, --dirty-workers, --dirty-timeout,
      --dirty-threads, --dirty-graceful-timeout
    • Lifecycle hooks: on_dirty_starting, dirty_post_fork,
      dirty_worker_init, dirty_worker_exit

  • Per-App Worker Allocation for Dirty Arbiters: Control how many dirty workers
    load each app for memory optimization with heavy models
    (PR #​3473)

    • Set workers class attribute on DirtyApp (e.g., workers = 2)
    • Or use config format module:class:N (e.g., myapp:HeavyModel:2)
    • Requests automatically routed to workers with the target app
    • New exception DirtyNoWorkersAvailableError for graceful error handling
    • Example: 8 workers × 10GB model = 80GB → with workers=2: 20GB (75% savings)

  • HTTP/2 Support (Beta): Native HTTP/2 (RFC 7540) support for improved performance
    with modern clients (PR #​3468)

    • Multiplexed streams over a single connection
    • Header compression (HPACK)
    • Flow control and stream prioritization
    • Works with gthread, gevent, and ASGI workers
    • New settings: --http-protocols, --http2-max-concurrent-streams,
      --http2-initial-window-size, --http2-max-frame-size, --http2-max-header-list-size
    • Requires SSL/TLS and h2 library: pip install gunicorn[http2]
    • New example: examples/http2_gevent/ with Docker and tests

  • HTTP 103 Early Hints: Support for RFC 8297 Early Hints to enable browsers to
    preload resources before the final response
    (PR #​3468)

    • WSGI: environ['wsgi.early_hints'](headers) callback
    • ASGI: http.response.informational message type
    • Works with both HTTP/1.1 and HTTP/2

  • uWSGI Protocol for ASGI Worker: The ASGI worker now supports receiving requests
    via the uWSGI binary protocol from nginx
    (PR #​3467)

Bug Fixes

  • Fix HTTP/2 ALPN negotiation for gevent and eventlet workers when
    do_handshake_on_connect is False (the default). The TLS handshake is now
    explicitly performed before checking selected_alpn_protocol().

  • Fix setproctitle initialization with systemd socket activation
    (#​3465)

  • Fix Expect: 100-continue handling: ignore the header for HTTP/1.0 requests
    since 100-continue is only valid for HTTP/1.1+
    (PR #​3463)

  • Fix missing _expected_100_continue attribute in UWSGIRequest

  • Disable setproctitle on macOS to prevent segfaults during process title updates

  • Publish full exception traceback when the application fails to load
    (#​3462)

  • Fix ASGI: quick shutdown on SIGINT/SIGQUIT, graceful on SIGTERM

Deprecations

  • Eventlet Worker: The eventlet worker is deprecated and will be removed in
    Gunicorn 26.0. Eventlet itself is no longer actively maintained.
    Please migrate to gevent, gthread, or another supported worker type.

Changes

  • Remove obsolete Makefile targets
    (PR #​3471)
  • Replace RST with markdown documentation format

v24.1.1

Compare Source

Bug Fixes

  • Fix forwarded_allow_ips and proxy_allow_ips to remain as strings for backward
    compatibility with external tools like uvicorn. Network validation now uses strict
    mode to detect invalid CIDR notation (e.g., 192.168.1.1/24 where host bits are set)
    (#​3458,
    PR #​3459)

Full Changelog: https://github.com/benoitc/gunicorn/compare/24.1.0...24.1.1

v24.1.0: Gunicorn 24.1.0

Compare Source

New Features

  • Official Docker Image: Gunicorn now publishes official Docker images to GitHub Container Registry (PR #​3454)

    • Available at ghcr.io/benoitc/gunicorn
    • Based on Python 3.12 slim image
    • Uses recommended worker formula (2 × CPU + 1)
    • Configurable via environment variables

  • PROXY Protocol v2 Support: Extended PROXY protocol implementation to support the binary v2 format in addition to the existing text-based v1 format (PR #​3451)

    • New --proxy-protocol modes: off, v1, v2, auto
    • auto mode (default when enabled) detects v1 or v2 automatically
    • v2 binary format is more efficient and supports additional metadata
    • Works with HAProxy, AWS NLB/ALB, and other PROXY protocol v2 sources

  • CIDR Network Support: --forwarded-allow-ips and --proxy-allow-from now accept CIDR notation (e.g., 192.168.0.0/16) for specifying trusted networks (PR #​3449)

  • Socket Backlog Metric: New gunicorn.socket.backlog gauge metric reports the current socket backlog size on Linux systems (PR #​3450)

  • InotifyReloader Enhancement: The inotify-based reloader now watches newly imported modules, not just those loaded at startup (PR #​3447)

Bug Fixes

  • Fix signal handling regression where SIGCLD alias caused "Unhandled signal: cld" errors on Linux when workers fail during boot (#​3453)
  • Fix socket blocking mode on keepalive connections preventing SSL handshake failures with async workers (PR #​3452)
  • Use smaller buffer size in finish_body() for faster timeout detection on slow or abandoned connections (PR #​3453)
  • Handle SSLWantReadError in finish_body() to prevent worker hangs during SSL renegotiation (PR #​3448)
  • Log SIGTERM as info level instead of warning to reduce noise in orchestrated environments (PR #​3446)
  • Print exception details to stderr when worker fails to boot (PR #​3443)
  • Fix unreader.unread() to prepend data to buffer instead of appending (PR #​3442)
  • Prevent RecursionError when pickling Config objects (PR #​3441)
  • Use proper exception chaining with raise from in glogging.py (PR #​3440)

Installation

pip install gunicorn==24.1.0

Or use the official Docker image:

docker pull ghcr.io/benoitc/gunicorn:24.1.0

v24.0.0

Compare Source

New Features

  • ASGI Worker (Beta): Native asyncio-based ASGI support for running async Python frameworks like FastAPI, Starlette, and Quart without external dependencies

    • HTTP/1.1 with keepalive connections
    • WebSocket support
    • Lifespan protocol for startup/shutdown hooks
    • Optional uvloop for improved performance

  • uWSGI Binary Protocol: Support for receiving requests from nginx via uwsgi_pass directive

  • Documentation Migration: Migrated to MkDocs with Material theme

Security

  • eventlet: Require eventlet >= 0.40.3 (CVE-2021-21419, CVE-2025-58068)
  • gevent: Require gevent >= 24.10.1 (CVE-2023-41419, CVE-2024-3219)
  • tornado: Require tornado >= 6.5.0 (CVE-2025-47287)

Install

pip install gunicorn==24.0.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [gunicorn](https://github.com/benoitc/gunicorn) ([changelog](https://gunicorn.org/news/)) | `==23.0.0` -> `==25.0.1` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/gunicorn/25.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gunicorn/23.0.0/25.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>benoitc/gunicorn (gunicorn)</summary> ### [`v25.0.1`](https://github.com/benoitc/gunicorn/releases/tag/25.0.1) [Compare Source](https://github.com/benoitc/gunicorn/compare/25.0.0...25.0.1) #### Bug Fixes - Fix ASGI streaming responses (SSE) hanging: add chunked transfer encoding for HTTP/1.1 responses without Content-Length header. Without chunked encoding, clients wait for connection close to determine end-of-response. #### Changes - Update celery\_alternative example to use FastAPI with native ASGI worker and uvloop for async task execution #### Testing - Add ASGI compliance test suite with Docker-based integration tests covering HTTP, WebSocket, streaming, lifespan, framework integration (Starlette, FastAPI), HTTP/2, and concurrency scenarios ### [`v25.0.0`](https://github.com/benoitc/gunicorn/releases/tag/25.0.0): Gunicorn 25.0.0 [Compare Source](https://github.com/benoitc/gunicorn/compare/24.1.1...25.0.0) #### New Features - **Dirty Arbiters**: Separate process pool for executing long-running, blocking operations (AI model loading, heavy computation) without blocking HTTP workers ([PR #&#8203;3460](https://github.com/benoitc/gunicorn/pull/3460)) - Inspired by Erlang's dirty schedulers - Asyncio-based with Unix socket IPC - Stateful workers that persist loaded resources - New settings: `--dirty-app`, `--dirty-workers`, `--dirty-timeout`, `--dirty-threads`, `--dirty-graceful-timeout` - Lifecycle hooks: `on_dirty_starting`, `dirty_post_fork`, `dirty_worker_init`, `dirty_worker_exit` - **Per-App Worker Allocation for Dirty Arbiters**: Control how many dirty workers load each app for memory optimization with heavy models ([PR #&#8203;3473](https://github.com/benoitc/gunicorn/pull/3473)) - Set `workers` class attribute on DirtyApp (e.g., `workers = 2`) - Or use config format `module:class:N` (e.g., `myapp:HeavyModel:2`) - Requests automatically routed to workers with the target app - New exception `DirtyNoWorkersAvailableError` for graceful error handling - Example: 8 workers × 10GB model = 80GB → with `workers=2`: 20GB (75% savings) - **HTTP/2 Support (Beta)**: Native HTTP/2 (RFC 7540) support for improved performance with modern clients ([PR #&#8203;3468](https://github.com/benoitc/gunicorn/pull/3468)) - Multiplexed streams over a single connection - Header compression (HPACK) - Flow control and stream prioritization - Works with gthread, gevent, and ASGI workers - New settings: `--http-protocols`, `--http2-max-concurrent-streams`, `--http2-initial-window-size`, `--http2-max-frame-size`, `--http2-max-header-list-size` - Requires SSL/TLS and h2 library: `pip install gunicorn[http2]` - New example: `examples/http2_gevent/` with Docker and tests - **HTTP 103 Early Hints**: Support for RFC 8297 Early Hints to enable browsers to preload resources before the final response ([PR #&#8203;3468](https://github.com/benoitc/gunicorn/pull/3468)) - WSGI: `environ['wsgi.early_hints'](headers)` callback - ASGI: `http.response.informational` message type - Works with both HTTP/1.1 and HTTP/2 - **uWSGI Protocol for ASGI Worker**: The ASGI worker now supports receiving requests via the uWSGI binary protocol from nginx ([PR #&#8203;3467](https://github.com/benoitc/gunicorn/pull/3467)) #### Bug Fixes - Fix HTTP/2 ALPN negotiation for gevent and eventlet workers when `do_handshake_on_connect` is False (the default). The TLS handshake is now explicitly performed before checking `selected_alpn_protocol()`. - Fix setproctitle initialization with systemd socket activation ([#&#8203;3465](https://github.com/benoitc/gunicorn/issues/3465)) - Fix `Expect: 100-continue` handling: ignore the header for HTTP/1.0 requests since 100-continue is only valid for HTTP/1.1+ ([PR #&#8203;3463](https://github.com/benoitc/gunicorn/pull/3463)) - Fix missing `_expected_100_continue` attribute in UWSGIRequest - Disable setproctitle on macOS to prevent segfaults during process title updates - Publish full exception traceback when the application fails to load ([#&#8203;3462](https://github.com/benoitc/gunicorn/issues/3462)) - Fix ASGI: quick shutdown on SIGINT/SIGQUIT, graceful on SIGTERM #### Deprecations - **Eventlet Worker**: The `eventlet` worker is deprecated and will be removed in Gunicorn 26.0. Eventlet itself is no longer actively maintained. Please migrate to `gevent`, `gthread`, or another supported worker type. #### Changes - Remove obsolete Makefile targets ([PR #&#8203;3471](https://github.com/benoitc/gunicorn/pull/3471)) - Replace RST with markdown documentation format ### [`v24.1.1`](https://github.com/benoitc/gunicorn/releases/tag/24.1.1) [Compare Source](https://github.com/benoitc/gunicorn/compare/24.1.0...24.1.1) #### Bug Fixes - Fix `forwarded_allow_ips` and `proxy_allow_ips` to remain as strings for backward compatibility with external tools like uvicorn. Network validation now uses strict mode to detect invalid CIDR notation (e.g., `192.168.1.1/24` where host bits are set) ([#&#8203;3458](https://github.com/benoitc/gunicorn/issues/3458), [PR #&#8203;3459](https://github.com/benoitc/gunicorn/pull/3459)) *** **Full Changelog**: <https://github.com/benoitc/gunicorn/compare/24.1.0...24.1.1> ### [`v24.1.0`](https://github.com/benoitc/gunicorn/releases/tag/24.1.0): Gunicorn 24.1.0 [Compare Source](https://github.com/benoitc/gunicorn/compare/24.0.0...24.1.0) #### New Features - **Official Docker Image**: Gunicorn now publishes official Docker images to GitHub Container Registry ([PR #&#8203;3454](https://github.com/benoitc/gunicorn/pull/3454)) - Available at `ghcr.io/benoitc/gunicorn` - Based on Python 3.12 slim image - Uses recommended worker formula (2 × CPU + 1) - Configurable via environment variables - **PROXY Protocol v2 Support**: Extended PROXY protocol implementation to support the binary v2 format in addition to the existing text-based v1 format ([PR #&#8203;3451](https://github.com/benoitc/gunicorn/pull/3451)) - New `--proxy-protocol` modes: `off`, `v1`, `v2`, `auto` - `auto` mode (default when enabled) detects v1 or v2 automatically - v2 binary format is more efficient and supports additional metadata - Works with HAProxy, AWS NLB/ALB, and other PROXY protocol v2 sources - **CIDR Network Support**: `--forwarded-allow-ips` and `--proxy-allow-from` now accept CIDR notation (e.g., `192.168.0.0/16`) for specifying trusted networks ([PR #&#8203;3449](https://github.com/benoitc/gunicorn/pull/3449)) - **Socket Backlog Metric**: New `gunicorn.socket.backlog` gauge metric reports the current socket backlog size on Linux systems ([PR #&#8203;3450](https://github.com/benoitc/gunicorn/pull/3450)) - **InotifyReloader Enhancement**: The inotify-based reloader now watches newly imported modules, not just those loaded at startup ([PR #&#8203;3447](https://github.com/benoitc/gunicorn/pull/3447)) #### Bug Fixes - Fix signal handling regression where SIGCLD alias caused "Unhandled signal: cld" errors on Linux when workers fail during boot ([#&#8203;3453](https://github.com/benoitc/gunicorn/discussions/3453)) - Fix socket blocking mode on keepalive connections preventing SSL handshake failures with async workers ([PR #&#8203;3452](https://github.com/benoitc/gunicorn/pull/3452)) - Use smaller buffer size in `finish_body()` for faster timeout detection on slow or abandoned connections ([PR #&#8203;3453](https://github.com/benoitc/gunicorn/pull/3453)) - Handle `SSLWantReadError` in `finish_body()` to prevent worker hangs during SSL renegotiation ([PR #&#8203;3448](https://github.com/benoitc/gunicorn/pull/3448)) - Log SIGTERM as info level instead of warning to reduce noise in orchestrated environments ([PR #&#8203;3446](https://github.com/benoitc/gunicorn/pull/3446)) - Print exception details to stderr when worker fails to boot ([PR #&#8203;3443](https://github.com/benoitc/gunicorn/pull/3443)) - Fix `unreader.unread()` to prepend data to buffer instead of appending ([PR #&#8203;3442](https://github.com/benoitc/gunicorn/pull/3442)) - Prevent `RecursionError` when pickling Config objects ([PR #&#8203;3441](https://github.com/benoitc/gunicorn/pull/3441)) - Use proper exception chaining with `raise from` in glogging.py ([PR #&#8203;3440](https://github.com/benoitc/gunicorn/pull/3440)) #### Installation ```bash pip install gunicorn==24.1.0 ``` Or use the official Docker image: ```bash docker pull ghcr.io/benoitc/gunicorn:24.1.0 ``` ### [`v24.0.0`](https://github.com/benoitc/gunicorn/releases/tag/24.0.0) [Compare Source](https://github.com/benoitc/gunicorn/compare/23.0.0...24.0.0) #### New Features - **ASGI Worker (Beta)**: Native asyncio-based ASGI support for running async Python frameworks like FastAPI, Starlette, and Quart without external dependencies - HTTP/1.1 with keepalive connections - WebSocket support - Lifespan protocol for startup/shutdown hooks - Optional uvloop for improved performance - **uWSGI Binary Protocol**: Support for receiving requests from nginx via `uwsgi_pass` directive - **Documentation Migration**: Migrated to MkDocs with Material theme #### Security - **eventlet**: Require eventlet >= 0.40.3 (CVE-2021-21419, CVE-2025-58068) - **gevent**: Require gevent >= 24.10.1 (CVE-2023-41419, CVE-2024-3219) - **tornado**: Require tornado >= 6.5.0 (CVE-2025-47287) #### Install ``` pip install gunicorn==24.0.0 ``` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4xMy4wIiwidXBkYXRlZEluVmVyIjoiNDIuMTMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
flo added 1 commit 2026-02-01 17:01:04 +00:00
Update dependency gunicorn to v25 a0f2d6eb04
flo force-pushed renovate/gunicorn-25.x from a0f2d6eb04 to e9261e5dc2 2026-02-02 17:01:03 +00:00 Compare
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/gunicorn-25.x:renovate/gunicorn-25.x
git checkout renovate/gunicorn-25.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
flo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: flo/gaehsnitz#14
Delete Branch "renovate/gunicorn-25.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?