Update dependency gunicorn to v26.2.0 #186
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/gunicorn-26.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
==26.1.0→==26.2.0Release Notes
benoitc/gunicorn (gunicorn)
v26.2.0: gunicorn 26.2.0Compare Source
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartextacceptsprior-knowledge,upgrade,bothoroff(thedefault). Prior knowledge serves a connection that opens with the HTTP/2
preface;
upgradehonours an HTTP/1.1Upgrade: h2crequest. Both work on thegthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2
upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in
forwarded_allow_ipsare considered; everyone else is served HTTP/1.x exactlyas if the setting were off. Each mechanism is enabled separately, so turning one
on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Requestbuilt its headers straight from the stream, so nothing the HTTP/1path enforces applied over HTTP/2: the underscore and
header_mappolicy,duplicate
HostandContent-Type, control characters in values, and theforwarded_allow_ipstrust gate. An untrusted client could setSCRIPT_NAMEand forge
HTTP_*entries in the WSGI environ, and decidewsgi.url_schemethrough
:scheme. Both request classes now share one policy mixin, and thescheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now.
HEAD, 204 and 304 no longer carry a body. Events read while blocked on a
flow-control window were discarded, losing requests and body data outright.
sendfile()is refused on HTTP/2 responses rather than bypassing framing.Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an
Upgradeheader reached the application with an empty body, whatever the header's value
and with HTTP/2 switched off entirely. Fixed in
gunicorn_h1c0.6.9, which thefastextra now requires.Full changelog: https://gunicorn.org/news/
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.