pypi / gunicorn
gunicorn
What changed in gunicorn 26, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
5 breaking1 security1 new APIs and options15 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initgunicorn 2622 changes
Breaking changes 5
HTTP/2 request bodies stream to the application instead of being fully buffered; at most the receive window remains in flight.
HTTP/2 workers close RST_STREAM floods with ENHANCE_YOUR_CALM.
Waiting for HTTP/2 send credit is bounded by timeout.
HTTP/2 requests now share the HTTP/1 policy for header validation, duplicate headers, and forwarded_allow_ips trust; wsgi.url_scheme comes from the transport.
WSGI responses over HTTP/2 stream instead of being buffered whole before sending.
Security 1
An unterminated chunk-size line or trailer section is bounded by existing request limits and scanned incrementally.
New APIs and options 1
Adds cleartext HTTP/2 modes for prior knowledge, HTTP/1.1 upgrade, both, or off. Supported by gthread, gevent, and asgi workers; only peers in forwarded_allow_ips are considered.
Fixes and other changes 15
The ASGI worker now sends Connection: close on HTTP/1.1 responses when it will not reuse the connection, preventing clients from treating a closed socket as persistent.
A reader paused under backpressure is resumed.
The ASGI worker no longer drops requests pipelined on kept-alive connections.
A bad request resets its own stream rather than the connection.
An empty final chunk now ends the HTTP/2 stream.
Graceful GOAWAY is honoured wherever it lands in the HTTP/2 workers.
An application error after headers have been sent resets the stream instead of corrupting the HPACK table.
Malformed chunked request bodies receive 400 Bad Request instead of raising.
Calling receive() after the body blocks until the peer disconnects instead of spinning the loop.
The uWSGI protocol works behind nginx uwsgi_pass again instead of returning 502 for every request.
A worker timeout no longer writes a 500 response onto a response body that has already started.
On the ASGI worker with the fast parser, requests carrying an Upgrade header no longer reach the application with an empty body.
Events read while blocked on a flow-control window are no longer discarded, preventing lost requests and body data.
HEAD, 204, and 304 responses no longer carry a body over HTTP/2.
sendfile() is refused on HTTP/2 responses rather than bypassing HTTP/2 framing.