fix(deps): update dependency gunicorn to v26.2.0 #35

2026-08-24T17:01:06Z

flo commented

2026-08-24 17:01:06 +00:00

This PR contains the following updates:

Package	Change	Age	Confidence
gunicorn (changelog)	`==26.1.0` → `==26.2.0`

Release Notes

benoitc/gunicorn (gunicorn)

`v26.2.0`: gunicorn 26.2.0

Compare Source

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the
default). Prior knowledge serves a connection that opens with the HTTP/2
preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the
gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2
upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in
forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly
as if the setting were off. Each mechanism is enabled separately, so turning one
on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1
path enforces applied over HTTP/2: the underscore and header_map policy,
duplicate Host and Content-Type, control characters in values, and the
forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME
and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme
through :scheme. Both request classes now share one policy mixin, and the
scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now.
HEAD, 204 and 304 no longer carry a body. Events read while blocked on a
flow-control window were discarded, losing requests and body data outright.
sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade
header reached the application with an empty body, whatever the header's value
and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the
fast extra now requires.

Full changelog: https://gunicorn.org/news/

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [gunicorn](https://github.com/benoitc/gunicorn) ([changelog](https://gunicorn.org/news/)) | `==26.1.0` → `==26.2.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/gunicorn/26.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/gunicorn/26.1.0/26.2.0?slim=true) | --- ### Release Notes <details> <summary>benoitc/gunicorn (gunicorn)</summary> ### [`v26.2.0`](https://github.com/benoitc/gunicorn/releases/tag/26.2.0): gunicorn 26.2.0 [Compare Source](https://github.com/benoitc/gunicorn/compare/26.1.0...26.2.0) Cleartext HTTP/2 lands, and an HTTP/2 security fix. #### Cleartext HTTP/2 (h2c) `http2_cleartext` accepts `prior-knowledge`, `upgrade`, `both` or `off` (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; `upgrade` honours an HTTP/1.1 `Upgrade: h2c` request. Both work on the gthread, gevent and asgi workers. This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in `forwarded_allow_ips` are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on. Do not expose a cleartext HTTP/2 port to the internet. #### Security `HTTP2Request` built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and `header_map` policy, duplicate `Host` and `Content-Type`, control characters in values, and the `forwarded_allow_ips` trust gate. An untrusted client could set `SCRIPT_NAME` and forge `HTTP_*` entries in the WSGI environ, and decide `wsgi.url_scheme` through `:scheme`. Both request classes now share one policy mixin, and the scheme comes from the transport. If you serve HTTP/2, this is the reason to upgrade. #### Other HTTP/2 fixes WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. `sendfile()` is refused on HTTP/2 responses rather than bypassing framing. #### Request bodies dropped on Upgrade requests On the ASGI worker with the fast parser, any request carrying an `Upgrade` header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in `gunicorn_h1c` 0.6.9, which the `fast` extra now requires. Full changelog: <https://gunicorn.org/news/> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

flo added 1 commit 2026-08-24 17:01:06 +00:00

fix(deps): update dependency gunicorn to v26.2.0 abc94c9f71

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/gunicorn-26.x:renovate/gunicorn-26.x

git checkout renovate/gunicorn-26.x

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: flo/gaehsnitz#35