# What changed in gunicorn

> 22 changes in gunicorn 26 from its official release notes, upgrade guides and advisories: 5 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/pypi/gunicorn/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## gunicorn 26

### Breaking changes

- HTTP/2 request bodies stream to the application instead of being fully buffered; at most the receive window remains in flight. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- HTTP/2 workers close RST_STREAM floods with ENHANCE_YOUR_CALM. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- Waiting for HTTP/2 send credit is bounded by timeout. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- HTTP/2 requests now share the HTTP/1 policy for header validation, duplicate headers, and forwarded_allow_ips trust; wsgi.url_scheme comes from the transport. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)
- WSGI responses over HTTP/2 stream instead of being buffered whole before sending. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)

### Security

- An unterminated chunk-size line or trailer section is bounded by existing request limits and scanned incrementally. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)

### New APIs and options

- Adds cleartext HTTP/2 modes for prior knowledge, HTTP/1.1 upgrade, both, or off. Supported by gthread, gevent, and asgi workers; only peers in forwarded_allow_ips are considered. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)

### Fixes and other changes

- The ASGI worker now sends Connection: close on HTTP/1.1 responses when it will not reuse the connection, preventing clients from treating a closed socket as persistent. (26.2.2) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.2)
- A reader paused under backpressure is resumed. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- The ASGI worker no longer drops requests pipelined on kept-alive connections. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- A bad request resets its own stream rather than the connection. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- An empty final chunk now ends the HTTP/2 stream. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- Graceful GOAWAY is honoured wherever it lands in the HTTP/2 workers. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- An application error after headers have been sent resets the stream instead of corrupting the HPACK table. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- Malformed chunked request bodies receive 400 Bad Request instead of raising. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- Calling receive() after the body blocks until the peer disconnects instead of spinning the loop. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- The uWSGI protocol works behind nginx uwsgi_pass again instead of returning 502 for every request. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- A worker timeout no longer writes a 500 response onto a response body that has already started. (26.2.1) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.1)
- On the ASGI worker with the fast parser, requests carrying an Upgrade header no longer reach the application with an empty body. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)
- Events read while blocked on a flow-control window are no longer discarded, preventing lost requests and body data. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)
- HEAD, 204, and 304 responses no longer carry a body over HTTP/2. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)
- sendfile() is refused on HTTP/2 responses rather than bypassing HTTP/2 framing. (26.2.0) — [release notes](https://github.com/benoitc/gunicorn/releases/tag/26.2.0)