From ad5686a23ad28b8e563d138c61fa11305578ecae Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 9 Jun 2026 20:40:23 -0400
Subject: [PATCH] Bump gunicorn from 25.3.0 to 26.0.0 (#990)

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 25.3.0 to
26.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/benoitc/gunicorn/releases">gunicorn's
releases</a>.</em></p>
<blockquote>
<h2>26.0.0</h2>
<h2>Breaking Changes</h2>
<ul>
<li><strong>Eventlet worker removed</strong>: The <code>eventlet</code>
worker class has been dropped. Migrate to <code>gevent</code>,
<code>gthread</code>, or <code>tornado</code>.</li>
</ul>
<h2>New Features</h2>
<ul>
<li><strong>ASGI Framework Compatibility Suite</strong>: New end-to-end
compatibility test harness covering Starlette, FastAPI, Litestar, Quart,
Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).</li>
<li><strong>ASGI Test Suite Expansion</strong>: 134 additional ASGI unit
tests covering protocol semantics, lifespan, websockets, and chunked
framing.</li>
</ul>
<h2>Security</h2>
<ul>
<li><strong>HTTP/1.1 Request-Target Validation</strong> (RFC 9112
sections 3.2.3, 3.2.4):
<ul>
<li>Reject <code>authority-form</code> request-target outside
<code>CONNECT</code></li>
<li>Reject <code>asterisk-form</code> request-target outside
<code>OPTIONS</code></li>
<li>Reject <code>relative-reference</code> request-targets</li>
</ul>
</li>
<li><strong>Header Field Hardening</strong> (RFC 9110):
<ul>
<li>Reject control characters in header field-value (section 5.5)</li>
<li>Reject forbidden trailer field-names (section 6.5.1)</li>
<li>Reject <code>Content-Length</code> list form (RFC 9112 section
6.3)</li>
</ul>
</li>
<li><strong>Request Smuggling Hardening</strong>:
<ul>
<li>Tighten keepalive gate and scope <code>finish_body</code> byte
cap</li>
<li>Keep <code>_body_receiver</code> alive across the keepalive
smuggling gate so pipelined requests cannot re-enter a closed body</li>
<li>Address parser/protocol findings from a six-point WSGI/ASGI
audit</li>
</ul>
</li>
<li><strong>PROXY Protocol (ASGI)</strong>: Enforce
<code>proxy_allow_ips</code> and tighten v1/v2 parsing in the ASGI
callback parser.</li>
<li><strong>Connection Draining</strong>: Drain the connection on close
per RFC 9112 section 9.6 to prevent reset-on-close truncation.</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li><strong>Body Framing on HEAD/204/304</strong>:
<ul>
<li>Keep <code>Content-Length</code> on HEAD and 304 responses (<a
href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>)</li>
<li>Drop body framing on HEAD/204/304 even when the framework set
it</li>
<li>Warn once when an ASGI app emits a body for a no-body response</li>
</ul>
</li>
<li><strong>HTTP/2 ASGI</strong>:
<ul>
<li>Fix <code>_handle_stream_ended</code> to set
<code>_body_complete</code> in the async HTTP/2 handler so request
bodies finalize correctly on stream end</li>
<li>Add <code>InvalidChunkExtension</code> mapping and fast-parser
support in ASGI tests (<a
href="https://redirect.github.com/benoitc/gunicorn/issues/3565">#3565</a>)</li>
</ul>
</li>
<li><strong>HTTP/1.1 100-Continue</strong>: Stop adding
<code>Transfer-Encoding: chunked</code> to 100-Continue interim
responses.</li>
<li><strong>WebSocket Close Handshake</strong> (RFC 6455):
<ul>
<li>Comply with the close handshake state machine</li>
<li>Close the transport after the close handshake completes</li>
<li>Fix binary send when the <code>text</code> key is
<code>None</code></li>
</ul>
</li>
<li><strong>Early Hints</strong>: Validate headers in the
<code>early_hints</code> callback to match <code>process_headers</code>;
pass only the header name to <code>InvalidHeader</code> (<a
href="https://redirect.github.com/benoitc/gunicorn/issues/3588">#3588</a>).</li>
<li><strong>ASGI Framework Fixes</strong>:
<ul>
<li>Fix ASGI disconnect handling for Django-style apps</li>
<li>Fix Litestar request handling (use raw ASGI receive for
body/headers)</li>
<li>Fix Litestar HTTP endpoints for compatibility tests</li>
<li>Fix Quart headers endpoint to normalize keys to lowercase</li>
<li>Fix Quart WebSocket close test app (missing
<code>accept()</code>)</li>
<li>Fix duplicate <code>Transfer-Encoding</code> header for BlackSheep
streaming</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/benoitc/gunicorn/commit/5d819cf36040f6cc6175fcc804d703fb899509dd"><code>5d819cf</code></a>
release: 26.0.0</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/b45c70df105f7d5dcbc5abfb732804d6464edc21"><code>b45c70d</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3611">#3611</a>
from zc-mattcen/docs-typo</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/99c8d48acf453deb5c49fe12e195dbc00d888d1e"><code>99c8d48</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3623">#3623</a>
from benoitc/chore/drop-eventlet-add-h2-uvloop-test-...</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/5a655af50f20e005dd9e32e6078dc82fa45f3d4b"><code>5a655af</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3622">#3622</a>
from benoitc/test/docker-port-and-ipv4-fixes</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/201df19a8011c0a1d6a0e75ebe22e89d48eb935e"><code>201df19</code></a>
chore: remove eventlet worker; add h2 and uvloop to test deps</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/f4ac8e1f1bf1d365e77f41915da55bec31873f84"><code>f4ac8e1</code></a>
test: pass action name to dirty client and stabilize after TTOU
spam</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/54d38afddf1f0db0c15b5f4ff63f3c7bfad96961"><code>54d38af</code></a>
test: unblock docker fixtures on macOS hosts</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/68843c8893dd938456f0a2da62085ab5776f8871"><code>68843c8</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>
from benoitc/fix/asgi-preserve-content-length-on-hea...</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/31f2618f733cc0c78690df63f4e344aaf3f56b20"><code>31f2618</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3620">#3620</a>
from benoitc/fix/asgi-proxy-protocol-trust-and-parsing</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/41ec7527dbd8a9e52728477700707ad40e41d9dc"><code>41ec752</code></a>
fix: keep Content-Length on HEAD and 304 responses</li>
<li>Additional commits viewable in <a
href="https://github.com/benoitc/gunicorn/compare/25.3.0...26.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gunicorn&package-manager=uv&previous-version=25.3.0&new-version=26.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/uv.lock b/uv.lock
index f57b4824..8e5a2e67 100644
--- a/uv.lock
+++ b/uv.lock
@@ -477,14 +477,14 @@ wheels = [
 
 [[package]]
 name = "gunicorn"
-version = "25.3.0"
+version = "26.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "packaging" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c4/f4/e78fa054248fab913e2eab0332c6c2cb07421fca1ce56d8fe43b6aef57a4/gunicorn-25.3.0.tar.gz", hash = "sha256:f74e1b2f9f76f6cd1ca01198968bd2dd65830edc24b6e8e4d78de8320e2fe889", size = 634883, upload-time = "2026-03-27T00:00:26.092Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6d/b7/a4a3f632f823e432ce6bc65f62961b7980c898c77f075a2f7118cb3846fe/gunicorn-26.0.0.tar.gz", hash = "sha256:ca9346f85e3a4aeeb64d491045c16b9a35647abd37ea15efe53080eb8b090baf", size = 727286, upload-time = "2026-05-05T06:38:25.529Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/43/c8/8aaf447698c4d59aa853fd318eed300b5c9e44459f242ab8ead6c9c09792/gunicorn-25.3.0-py3-none-any.whl", hash = "sha256:cacea387dab08cd6776501621c295a904fe8e3b7aae9a1a3cbb26f4e7ed54660", size = 208403, upload-time = "2026-03-27T00:00:27.386Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/40/9c2384fc2be4ad25dd4a49decd5ad9ea5a3639814c11bd40ab77cb9f0a14/gunicorn-26.0.0-py3-none-any.whl", hash = "sha256:40233d26a5f0d1872916188c276e21641155111c2853f0c2cd55260aec0d24fc", size = 212009, upload-time = "2026-05-05T06:38:23.007Z" },
 ]
 
 [[package]]