Bump gunicorn from 26.0.0 to 26.2.0 by dependabot[bot] · Pull Request #69 · pyobs/pyobs-web-admin

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabot · 2026-08-25T22:14:19Z

Bumps gunicorn from 26.0.0 to 26.2.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.
Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.
Full changelog: https://gunicorn.org/news/
gunicorn 26.1.0
New Features
Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.0.0 to 26.2.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 26.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-01T22:19:23Z

Superseded by #85.

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

dependabotBot added the dependencies Pull requests that update a dependency file label Aug 25, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch 2 times, most recently from 7c5bc38 to 7d49c9fCompare August 26, 2026 12:00

github-actionsBot enabled auto-merge August 26, 2026 12:00

dependabotBot changed the title ~~Bump gunicorn from 26.0.0 to 26.1.0~~Bump gunicorn from 26.0.0 to 26.2.0Aug 31, 2026

dependabotBotforce-pushed the dependabot/uv/develop/gunicorn-26.1.0 branch from 7d49c9f to 6160ae1Compare August 31, 2026 08:06

dependabotBot closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 22:19
Pull request was closed

dependabotBot deleted the dependabot/uv/develop/gunicorn-26.1.0 branch September 1, 2026 22:19

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gunicorn 26.2.0

Cleartext HTTP/2 (h2c)

Security

Other HTTP/2 fixes

Request bodies dropped on Upgrade requests

gunicorn 26.1.0

New Features

Uh oh!

dependabotBot commented on behalf of githubSep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gunicorn 26.2.0

Cleartext HTTP/2 (h2c)

Security

Other HTTP/2 fixes

Request bodies dropped on Upgrade requests

gunicorn 26.1.0

New Features

Uh oh!

dependabotBot commented on behalf of githubSep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gunicorn 26.2.0

Cleartext HTTP/2 (h2c)

Security

Other HTTP/2 fixes

Request bodies dropped on Upgrade requests

gunicorn 26.1.0

New Features

Uh oh!

dependabotBot commented on behalf of githubSep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gunicorn 26.2.0

Cleartext HTTP/2 (h2c)

Security

Other HTTP/2 fixes

Request bodies dropped on Upgrade requests

gunicorn 26.1.0

New Features

Uh oh!

dependabotBot commented on behalf of githubSep 1, 2026

Uh oh!

dependabotBot commented on behalf of githubAug 25, 2026•
edited
Loading

dependabotBot commented on behalf of githubAug 25, 2026•
edited
Loading

dependabotBot commented on behalf of githubAug 25, 2026•
edited
Loading

dependabotBot commented on behalf of githubAug 25, 2026•
edited
Loading

dependabotBot commented on behalf of githubAug 25, 2026•
edited
Loading

dependabotBot commented on behalf of githubAug 25, 2026•
edited
Loading