[dependabot]

Bumps gunicorn from 26.2.0 to 27.0.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 27.0.0

Breaking Changes

• Reject with 400 a request whose Transfer-Encoding does not end with chunked, such as gzip or identity alone, with or without Content-Length (RFC 9112 §6.3). The WSGI workers used to read such a body until the connection closed and the ASGI worker treated it as empty. Clients that send Transfer-Encoding: identity must stop sending it.

Bug Fixes

• Reject whitespace between a header name and the colon (RFC 9112 §5.1).
• Trim only spaces and tabs around Transfer-Encoding values (RFC 9110 §5.6.3) (#3364).
• Reject a Content-Length that is not plain digits (RFC 9110 §8.6).
• Reject chunk data not followed by CRLF (RFC 9112 §7.1).
• Reject control characters in the request path (RFC 9112 §3.2) (#3371).
• Return 414 URI Too Long for a request line over limit_request_line (RFC 9112 §3) (#2487).
• ASGI: never write more body bytes than the app's Content-Length, and close the connection when the body is shorter (RFC 9112 §6.3).
• ASGI: close the connection when the app returns before finishing its response (RFC 9112 §6.3).
• ASGI: reject response header names and values that are not valid (RFC 9110 §5.1, §5.5).
• WSGI: reject a response status that is not three digits followed by a valid reason phrase (RFC 9112 §4).
• ASGI: read the body a HEAD request declares instead of serving it as the next request (RFC 9112 §6.3).
• ASGI: stop buffering a request line, header, chunk-size line or trailer that never ends; the usual request limits now apply before the line terminator arrives, and trailers count against limit_request_fields.
• ASGI: apply forwarded_allow_ips to HTTP/1 requests as WSGI and HTTP/2 already do: secure_scheme_headers set the scheme only from trusted proxies, and header names with underscores follow header_map.
• Ignore one empty line before the request line, as the fast parser already does (RFC 9112 §2.2).
• ASGI: stop gunicorn when the app reports a failed lifespan startup, instead of serving requests or rebooting the worker forever (ASGI lifespan spec) (#3778).
• ASGI: close idle kept-alive connections after keepalive seconds, as the other workers do (#3734).
• ASGI: give each request a shallow copy of the lifespan state, so a value one request stores in scope["state"] is not seen by the next one (ASGI lifespan spec).
• ASGI: deliver websocket.disconnect as soon as the client closes the connection, instead of after the close timeout (RFC 6455 §5.5.1).

... (truncated)

Commits

• 237de69 gunicorn 27.0.0
• 77b0c63 Merge pull request #3814 from benoitc/docs/latest-changes
• 8c02c88 agents: list the HTTP/1 framing rules and how CI runs pylint
• ea47de9 docs: describe the ASGI worker's request handling and performance
• ff5ea0a docs: sort the unreleased changelog into breaking changes, fixes and changes
• 747ea4f Merge pull request #3813 from benoitc/fix/http1-framing-parity
• c5a8b68 build: require gunicorn_h1c 0.6.14
• 6a52220 lint: put the two pylint disables where CI reports them
• 76bd679 lint: silence two pylint false positives seen under Python 3.12
• 2fcfc62 asgi, http: answer 501 to an unknown transfer coding on every path
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)