New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [
  are treated as patterns, so ui/*/config.json watches every view's config
  without listing them one by one. Patterns are re-expanded on every reload
  check rather than once at startup, so a file created later starts being
  watched without restarting gunicorn, and ** recurses. A pattern matching
  nothing warns instead of failing, since with live expansion it may match later
  (#1643,
  #3662).

Security

• Dependency floors raised past known advisories: every declared floor was
  checked against the advisory database. tornado, h2, setuptools and
  pymdown-extensions permitted vulnerable versions and now require the first
  clean release; pytest and httpx were unpinned and now carry floors. The
  tornado example pinned tornado<6, which was both the source of several
  advisories and older than the >=6.5.0 the tornado worker needs, so the
  example could not run as pinned.

Bug Fixes

• SIGHUP did not reload the logger configuration: Arbiter.reload()
  re-read the configuration file but kept using the logger built at startup,
  calling only reopen_files() on its existing handlers. Changes to
  logconfig, logconfig_dict, logconfig_json and loglevel were ignored
  until a full restart, which in containers meant replacing the pod. The
  existing logger now re-runs its setup on reload, so new handlers, formats
  and levels take effect while the process identity and its listeners are
  preserved, and re-running the setup no longer stacks duplicate syslog
  handlers. An invalid log configuration on reload is not fatal either: the
  error is reported on stderr, the previous working configuration is restored
  and the master keeps running with it
  (#3353).

• Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked
  body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer
  section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised
  while scanning for it, so a body cut short right after the last chunk line was
  treated as complete instead of rejected. It now raises
  ChunkMissingTerminator
  (#3382,
  #3685).

• --spew crashed on dynamically generated code: the trace hook indexed the
  2-tuple returned by inspect.getsourcelines() by line number rather than
  indexing the list of lines, so a frame with no __file__ raised
  AttributeError: 'int' object has no attribute 'rstrip' on line 1 and
  IndexError beyond it. The tuple is now unpacked and offset by the source's
  starting line (#3344,
  #3495).

• Duplicate Host and Content-Type headers accepted: RFC 9110 section 5.3
  allows only one of each, and a repeat cannot be merged into a list, so the
  message means different things to gunicorn and to anything downstream. Both
  are now rejected with InvalidHeader. The check lives in the policy hook
  shared by both parsers, so the pure-Python and fast parsers agree. Duplicate
  Content-Length was already rejected and is unchanged
  (#3366,
  #3548).

• Non-worker children reported as failed workers: reap_workers() reaps
  every child through waitpid(-1), including processes the kernel reparented
  onto gunicorn when it runs as PID 1 in a container, but it logged the exit
  status before checking whether the pid was ever a worker. An unrelated process
  produced Worker (pid:N) exited with code M and triggered alerts. More
  seriously, such a process exiting with code 3 or 4 raised HaltServer and shut
  the server down. Ownership is now established first: the dirty arbiter is
  reported as itself, unknown children are reaped silently at debug level, and
  only real workers can halt the server
  (#3220,
  #3566).

• Dirty arbiter exits were invisible on SIGCHLD: handle_chld() called
  reap_workers() first, whose waitpid(-1) claimed the dirty arbiter before
  reap_dirty_arbiter() could identify it, so the latter always hit ECHILD and
  its reporting never ran. The dirty arbiter is now reaped first, and
  reap_workers() recognises it if it exits mid-loop.

• Dirty arbiter returned stale responses after a worker timeout: when a
  request reached dirty_timeout the arbiter answered the client with a timeout
  error but kept the worker connection open. The worker's late response was then
  the first message waiting on that socket, so the next request routed to the
  same worker received the previous request's result, and every request after it
  stayed one response behind. The connection is now closed on timeout, so the
  late answer is discarded with it
  (#3626).

• ASGI connection count leaked on server-initiated close: nr_conns was
  only decremented in connection_lost(), behind a guard keyed on the same
  flag _close_transport() sets first. Every close the server started (a
  Connection: close response, a keepalive timeout, an error abort) leaked one
  count, so ASGIWorker._shutdown() ran the full graceful_timeout and warned
  about connections that were already gone. The guard now uses its own flag, so
  the decrement and the rest of the cleanup run exactly once whichever side
  closes first (#3661).

• Inotify reloader on cwd-relative extra files: reload_extra_files entries
  with no directory part (for example .env) produced an empty dirname, and
  watching it raised InotifyError with ENOENT. The current directory is now
  watched as . (#3377,
  #3667).

• StatsD zero-valued metrics: gauges, counters, histograms and timers
  reporting 0 were silently dropped because the value was tested for
  truthiness. Only None is skipped now
  (#3676).

• Spurious no-body warning from sendfile(): a HEAD, 204 or 304 response
  served through sendfile() warned about dropped body bytes even when the
  file was empty and nothing was dropped. It now warns only when there are
  bytes to drop, matching write()
  (#3684).

• Bare except in the gevent websocket example: narrowed to
  except Exception (#3683).

• ASGI receive() cancellation: Let asyncio.CancelledError propagate
  from BodyReceiver instead of swallowing it and returning
  http.disconnect. Frameworks that cancel their disconnect listener after
  the response completes (Django) no longer see the cancel masked, so
  request_finished fires and close_old_connections() runs. Fixes idle
  database connections leaking since 25.1.0
  (#3627,
  #3654).

• Control socket leak on SIGHUP reload: The control thread is now marked
  ready once its loop and server are live, and the stop paths wait on that
  readiness before scheduling shutdown. Reloads no longer leak one thread and
  its selector fd plus unix socket per worker, which eventually raised
  "too many open files"
  (#3648).

• WSGI body framing on HEAD/1xx/204/304: Mirror the ASGI strip-and-warn
  behavior on the WSGI path. Content-Length is stripped on 1xx/204 per
  RFC 9110 section 6.4.2, body bytes are dropped for no-body responses in
  both write() and sendfile(), and a single warning is logged per request
  (#3413).

Refactoring

• Pass log arguments to the logger instead of pre-formatting the worker
  termination message in Arbiter.reap_workers()
  (#3678).

Changes

• packaging is no longer a runtime dependency: it was only ever imported by
  the gevent worker, to compare gevent's version. It moved to the gevent and
  testing extras, so a plain pip install gunicorn pulls in nothing
  (#3643).

• Fast HTTP Parser: Require gunicorn_h1c >= 0.6.6, which rejects duplicate
  Host and Content-Type headers in the C parser itself. Gunicorn already
  refuses them on both the WSGI and ASGI paths, so this changes nothing that is
  reachable; it moves the rejection to where the bytes are read and lets the
  ASGI corpus exercise those cases against the fast parser directly.

Full changelog: https://gunicorn.org/2026-news/

Breaking Changes

• Eventlet worker removed: The eventlet worker class has been dropped. Migrate to gevent, gthread, or tornado.

New Features

• ASGI Framework Compatibility Suite: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).
• ASGI Test Suite Expansion: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.

Security

• HTTP/1.1 Request-Target Validation (RFC 9112 sections 3.2.3, 3.2.4):
  • Reject authority-form request-target outside CONNECT
  • Reject asterisk-form request-target outside OPTIONS
  • Reject relative-reference request-targets
• Header Field Hardening (RFC 9110):
  • Reject control characters in header field-value (section 5.5)
  • Reject forbidden trailer field-names (section 6.5.1)
  • Reject Content-Length list form (RFC 9112 section 6.3)
• Request Smuggling Hardening:
  • Tighten keepalive gate and scope finish_body byte cap
  • Keep _body_receiver alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body
  • Address parser/protocol findings from a six-point WSGI/ASGI audit
• PROXY Protocol (ASGI): Enforce proxy_allow_ips and tighten v1/v2 parsing in the ASGI callback parser.
• Connection Draining: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.

Bug Fixes

• Body Framing on HEAD/204/304:
  • Keep Content-Length on HEAD and 304 responses (#3621)
  • Drop body framing on HEAD/204/304 even when the framework set it
  • Warn once when an ASGI app emits a body for a no-body response
• HTTP/2 ASGI:
  • Fix _handle_stream_ended to set _body_complete in the async HTTP/2 handler so request bodies finalize correctly on stream end
  • Add InvalidChunkExtension mapping and fast-parser support in ASGI tests (#3565)
• HTTP/1.1 100-Continue: Stop adding Transfer-Encoding: chunked to 100-Continue interim responses.
• WebSocket Close Handshake (RFC 6455):
  • Comply with the close handshake state machine
  • Close the transport after the close handshake completes
  • Fix binary send when the text key is None
• Early Hints: Validate headers in the early_hints callback to match process_headers; pass only the header name to InvalidHeader (#3588).
• ASGI Framework Fixes:
  • Fix ASGI disconnect handling for Django-style apps
  • Fix Litestar request handling (use raw ASGI receive for body/headers)
  • Fix Litestar HTTP endpoints for compatibility tests
  • Fix Quart headers endpoint to normalize keys to lowercase
  • Fix Quart WebSocket close test app (missing accept())
  • Fix duplicate Transfer-Encoding header for BlackSheep streaming

Refactoring

• Split BodyReceiver._closed into separate transport and body-wait flags for clearer keepalive/EOF semantics.

Changes

• Fast HTTP Parser: Require gunicorn_h1c >= 0.6.5. Drop the last python_only test markers; the C extension is now used wherever available (CPython only; PyPy continues to use the Python parser).
• Test Dependencies: Add h2 and uvloop to the testing extra; remove eventlet.
• Docker Build: Bump GitHub Actions docker/setup-qemu-action, docker/setup-buildx-action, docker/login-action, docker/build-push-action, and docker/metadata-action to current major versions.

Full changelog: 25.3.0...26.0.0

Bug Fixes

• HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2
  ASGI requests, causing JSON parsing errors with "Extra data" messages
  (#3558)

• ASGI Chunked EOF Handling: Add finish() method to callback parser to handle
  chunked encoding edge case where connection closes before final CRLF after zero-chunk

• HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string
  instead of list syntax (#3561)

• Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112
  (#3556)

• Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented,
  instead of using default maximum. Works with both Python and fast C parser.
  (#3563)

Security

• ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
  • Reject duplicate Content-Length headers
  • Reject requests with both Content-Length and Transfer-Encoding
  • Reject chunked transfer encoding in HTTP/1.0
  • Reject stacked chunked encoding
  • Validate Transfer-Encoding values
  • Strict chunk size validation

Changes

• Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property
  and InvalidChunkExtension validation for bare CR rejection

• ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser

• Docker Images: Update to Python 3.14

New Features

• Fast HTTP Parser (gunicorn_h1c 0.4.1): Integrate new exception types and limit parameters from gunicorn_h1c 0.4.1 for both WSGI and ASGI workers
  • Requires gunicorn_h1c >= 0.4.1 for http_parser='fast'
  • Falls back to Python parser in auto mode if version not met
  • Proper HTTP status codes for limit errors (414, 431)

Bug Fixes

• uWSGI Async Workers: Fix InvalidUWSGIHeader: incomplete header error when using gevent or gthread workers with uwsgi protocol behind nginx. (#3552, PR #3554)

• FileWrapper Iterator Protocol: Add __iter__ and __next__ methods to FileWrapper for full PEP 3333 compliance. (#3396, PR #3550)

Performance

• ASGI HTTP Parser Optimizations: Improve ASGI worker HTTP parsing performance
  • Callback-based parsing with direct bytearray buffer operations
  • Use bytearray.find() directly instead of converting to bytes first
  • Use index-based iteration for header parsing instead of list.pop(0) (O(1) vs O(n))

New Features

• Control Interface (gunicornc): Add interactive control interface for managing
  running Gunicorn instances, similar to birdc for BIRD routing daemon
  (PR #3505)

  • Unix socket-based communication with JSON protocol
  • Interactive mode with readline support and command history
  • Commands: show all/workers/dirty/config/stats/listeners
  • Worker management: worker add/remove/kill, dirty add/remove
  • Server control: reload, reopen, shutdown
  • New settings: --control-socket, --control-socket-mode, --no-control-socket
  • New CLI tool: gunicornc for connecting to control socket
  • See Control Interface Guide for details

• Dirty Stash: Add global shared state between workers via dirty.stash
  (PR #3503)

  • In-memory key-value store accessible by all workers
  • Supports get, set, delete, clear, keys, and has operations
  • Useful for sharing state like feature flags, rate limits, or cached data

• Dirty Binary Protocol: Implement efficient binary protocol for dirty arbiter IPC
  using TLV (Type-Length-Value) encoding
  (PR #3500)

  • More efficient than JSON for binary data
  • Supports all Python types: str, bytes, int, float, bool, None, list, dict
  • Better performance for large payloads

• Dirty TTIN/TTOU Signals: Add dynamic worker scaling for dirty arbiters
  (PR #3504)

  • Send SIGTTIN to increase dirty workers
  • Send SIGTTOU to decrease dirty workers
  • Respects minimum worker constraints from app configurations

Changes

• ASGI Worker: Promoted from beta to stable
• Dirty Arbiters: Now marked as beta feature

Documentation

• Fix Markdown formatting in /configure documentation

What's Changed

Bug Fixes

• Fix RuntimeError when StopIteration raised in ASGI coroutine (#3484)
• Fix passing maxsplit in re.split() as positional argument (deprecated in Python 3.13)

Documentation

• Updated sponsorship section and homepage

Full Changelog: 25.0.2...25.0.3

What's Changed

Bug Fixes

• Fix ASGI concurrent request failures through nginx proxy
• Graceful disconnect handling for ASGI worker
• Lazy import dirty module for gevent compatibility

Other

• Increase CI timeout for signal tests on PyPy
• Remove trailing blank line in instrument/init.py

Full Changelog: 25.0.1...25.0.2

Bug Fixes

• Fix ASGI streaming responses (SSE) hanging: add chunked transfer encoding for
  HTTP/1.1 responses without Content-Length header. Without chunked encoding,
  clients wait for connection close to determine end-of-response.

Changes

• Update celery_alternative example to use FastAPI with native ASGI worker and
  uvloop for async task execution

Testing

• Add ASGI compliance test suite with Docker-based integration tests covering HTTP,
  WebSocket, streaming, lifespan, framework integration (Starlette, FastAPI),
  HTTP/2, and concurrency scenarios

New Features

• Dirty Arbiters: Separate process pool for executing long-running, blocking
  operations (AI model loading, heavy computation) without blocking HTTP workers
  (PR #3460)

  • Inspired by Erlang's dirty schedulers
  • Asyncio-based with Unix socket IPC
  • Stateful workers that persist loaded resources
  • New settings: --dirty-app, --dirty-workers, --dirty-timeout,
    --dirty-threads, --dirty-graceful-timeout
  • Lifecycle hooks: on_dirty_starting, dirty_post_fork,
    dirty_worker_init, dirty_worker_exit

• Per-App Worker Allocation for Dirty Arbiters: Control how many dirty workers
  load each app for memory optimization with heavy models
  (PR #3473)

  • Set workers class attribute on DirtyApp (e.g., workers = 2)
  • Or use config format module:class:N (e.g., myapp:HeavyModel:2)
  • Requests automatically routed to workers with the target app
  • New exception DirtyNoWorkersAvailableError for graceful error handling
  • Example: 8 workers × 10GB model = 80GB → with workers=2: 20GB (75% savings)

• HTTP/2 Support (Beta): Native HTTP/2 (RFC 7540) support for improved performance
  with modern clients (PR #3468)

  • Multiplexed streams over a single connection
  • Header compression (HPACK)
  • Flow control and stream prioritization
  • Works with gthread, gevent, and ASGI workers
  • New settings: --http-protocols, --http2-max-concurrent-streams,
    --http2-initial-window-size, --http2-max-frame-size, --http2-max-header-list-size
  • Requires SSL/TLS and h2 library: pip install gunicorn[http2]
  • New example: examples/http2_gevent/ with Docker and tests

• HTTP 103 Early Hints: Support for RFC 8297 Early Hints to enable browsers to
  preload resources before the final response
  (PR #3468)

  • WSGI: environ['wsgi.early_hints'](headers) callback
  • ASGI: http.response.informational message type
  • Works with both HTTP/1.1 and HTTP/2

• uWSGI Protocol for ASGI Worker: The ASGI worker now supports receiving requests
  via the uWSGI binary protocol from nginx
  (PR #3467)

Bug Fixes

• Fix HTTP/2 ALPN negotiation for gevent and eventlet workers when
  do_handshake_on_connect is False (the default). The TLS handshake is now
  explicitly performed before checking selected_alpn_protocol().

• Fix setproctitle initialization with systemd socket activation
  (#3465)

• Fix Expect: 100-continue handling: ignore the header for HTTP/1.0 requests
  since 100-continue is only valid for HTTP/1.1+
  (PR #3463)

• Fix missing _expected_100_continue attribute in UWSGIRequest

• Disable setproctitle on macOS to prevent segfaults during process title updates

• Publish full exception traceback when the application fails to load
  (#3462)

• Fix ASGI: quick shutdown on SIGINT/SIGQUIT, graceful on SIGTERM

Deprecations

• Eventlet Worker: The eventlet worker is deprecated and will be removed in
  Gunicorn 26.0. Eventlet itself is no longer actively maintained.
  Please migrate to gevent, gthread, or another supported worker type.

Changes

• Remove obsolete Makefile targets
  (PR #3471)
• Replace RST with markdown documentation format

Bug Fixes

• Fix forwarded_allow_ips and proxy_allow_ips to remain as strings for backward
  compatibility with external tools like uvicorn. Network validation now uses strict
  mode to detect invalid CIDR notation (e.g., 192.168.1.1/24 where host bits are set)
  (#3458,
  PR #3459)

Full Changelog: 24.1.0...24.1.1

New Features

• Official Docker Image: Gunicorn now publishes official Docker images to GitHub Container Registry (PR #3454)

  • Available at ghcr.io/benoitc/gunicorn
  • Based on Python 3.12 slim image
  • Uses recommended worker formula (2 × CPU + 1)
  • Configurable via environment variables

• PROXY Protocol v2 Support: Extended PROXY protocol implementation to support the binary v2 format in addition to the existing text-based v1 format (PR #3451)

  • New --proxy-protocol modes: off, v1, v2, auto
  • auto mode (default when enabled) detects v1 or v2 automatically
  • v2 binary format is more efficient and supports additional metadata
  • Works with HAProxy, AWS NLB/ALB, and other PROXY protocol v2 sources

• CIDR Network Support: --forwarded-allow-ips and --proxy-allow-from now accept CIDR notation (e.g., 192.168.0.0/16) for specifying trusted networks (PR #3449)

• Socket Backlog Metric: New gunicorn.socket.backlog gauge metric reports the current socket backlog size on Linux systems (PR #3450)

• InotifyReloader Enhancement: The inotify-based reloader now watches newly imported modules, not just those loaded at startup (PR #3447)

Bug Fixes

• Fix signal handling regression where SIGCLD alias caused "Unhandled signal: cld" errors on Linux when workers fail during boot (#3453)
• Fix socket blocking mode on keepalive connections preventing SSL handshake failures with async workers (PR #3452)
• Use smaller buffer size in finish_body() for faster timeout detection on slow or abandoned connections (PR #3453)
• Handle SSLWantReadError in finish_body() to prevent worker hangs during SSL renegotiation (PR #3448)
• Log SIGTERM as info level instead of warning to reduce noise in orchestrated environments (PR #3446)
• Print exception details to stderr when worker fails to boot (PR #3443)
• Fix unreader.unread() to prepend data to buffer instead of appending (PR #3442)
• Prevent RecursionError when pickling Config objects (PR #3441)
• Use proper exception chaining with raise from in glogging.py (PR #3440)

Installation

pip install gunicorn==24.1.0

Or use the official Docker image:

docker pull ghcr.io/benoitc/gunicorn:24.1.0

New Features

• ASGI Worker (Beta): Native asyncio-based ASGI support for running async Python frameworks like FastAPI, Starlette, and Quart without external dependencies

  • HTTP/1.1 with keepalive connections
  • WebSocket support
  • Lifespan protocol for startup/shutdown hooks
  • Optional uvloop for improved performance

• uWSGI Binary Protocol: Support for receiving requests from nginx via uwsgi_pass directive

• Documentation Migration: Migrated to MkDocs with Material theme

Security

• eventlet: Require eventlet >= 0.40.3 (CVE-2021-21419, CVE-2025-58068)
• gevent: Require gevent >= 24.10.1 (CVE-2023-41419, CVE-2024-3219)
• tornado: Require tornado >= 6.5.0 (CVE-2025-47287)

Install

pip install gunicorn==24.0.0

Gunicorn 23.0.0 has been released. This version improve HTTP 1.1. support and which improve safety

You're invited to upgrade asap your own installation.

23.0.0 - 2024-08-10

• minor docs fixes (3217, 3089, 3167)

• worker_class parameter accepts a class (3079)

• fix deadlock if request terminated during chunked parsing (2688)

• permit receiving Transfer-Encodings: compress, deflate, gzip (3261)

• permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still (3261)

• sdist generation now explicitly excludes sphinx build folder (3257)

• decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError (2336)

• raise correct Exception when encounting invalid chunked requests (3258)

• the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore (3192)

• include IPv6 loopback address [::1] in default for forwarded-allow-ips and proxy-allow-ips (3192)

** NOTE **

• The SCRIPT_NAME change mitigates a regression that appeared first in the 22.0.0 release

• Review your forwarded-allow-ips setting if you are still not seeing the SCRIPT_NAME transmitted

• Review your forwarder-headers setting if you are missing headers after upgrading from a version prior to 22.0.0

** Breaking changes **

• refuse requests where the uri field is empty (3255)

• refuse requests with invalid CR/LR/NUL in heade field values (3253)

• remove temporary --tolerate-dangerous-framing switch from 22.0 (3260)

• If any of the breaking changes affect you, be aware that now refused requests can post a security problem, especially so in setups involving request pipe-lining and/or proxies.

Fix CVE-2024-1135

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

- use `utime` to notify workers liveness
- migrate setup to pyproject.toml
- fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
- parsing additional requests is no longer attempted past unsupported request framing
- on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
- requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
- Trailer fields are no longer inspected for headers indicating secure scheme
- support Python 3.12

** Breaking changes **

- minimum version is Python 3.7
- the limitations on valid characters in the HTTP method have been bounded to Internet Standards
- requests specifying unsupported transfer coding (order) are refused by default (rare)
- HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
- HTTP methods containing the number sign (#) are no longer accepted by default (rare)
- HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
- HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
- HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
- HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
- requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
- empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)


** SECURITY **

- fix CVE-2024-1135

1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19
===================
fix thread worker: revert change considering connection as idle .

*** NOTE ***

This is fixing the bad file description error.

1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
2. Packages: https://pypi.org/project/gunicorn/

gunicorn 21.1.0 has been released. This version fix the issue introduced in the threaded worker.

21.1.0 - 2023-07-18

• fix thread worker: fix socket removal from the queuet checkout 21.x

Gunicorn 21 is out with miscellaneous changes. Enjoy!

We made this release major to start our new release cycle. More info will be provided on our discussion forum.

21.0.1 - 2023-07-17

fix documentation build

21.0.0 - 2023-07-17

support python 3.11 fix gevent and eventlet workers fix threads support (gththread): improve performance and unblock requests SSL: noaw use SSLContext object HTTP parser: miscellaneous fixes remove unecessary setuid calls fix testing improve logging miscellaneous fixes to core engine

Full Changelog: https://github.com/benoitc/gunicorn/compare/21.0.0...21.0.1

• document WEB_CONCURRENCY is set by, at least, Heroku
• capture peername from accept: Avoid calls to getpeername by capturing the peer name returned by accept
• log a warning when a worker was terminated due to a signal
• fix tornado usage with latest versions of Django
• add support for python -m gunicorn
• fix systemd socket activation example
• allows to set wsgi application in configg file using wsgi_app
• document --timeout = 0
• always close a connection when the number of requests exceeds the max requests
• Disable keepalive during graceful shutdown
• kill tasks in the gthread workers during upgrade
• fix latency in gevent worker when accepting new requests
• fix file watcher: handle errors when new worker reboot and ensure the list of files is kept
• document the default name and path of the configuration file
• document how variable impact configuration
• document the $PORT environment variable
• added milliseconds option to request_time in access_log
• added PIP requirements to be used for example
• remove version from the Server header
• fix sendfile: use socket.sendfile instead of os.sendfile
• reloader: use absolute path to prevent empty to prevent0 InotifyError when a file is added to the working directory
• Add --print-config option to print the resolved settings at startup.
• remove the --log-dict-config CLI flag because it never had a working format (the logconfig_dict setting in configuration files continues to work)

** Breaking changes **

• minimum version is Python 3.5
• remove version from the Server header

** Documentation **

** Others **

• miscellaneous changes in the code base to be a better citizen with Python 3
• remove dead code
• fix documentation generation

• fix binding a socket using the file descriptor
• remove support for the bdist_rpm build

• fixed load of a config file without a Python extension
• fixed socketfromfd.fromfd when defaults are not set

note: we now warn when we load a config file without Python Extension

20.0.2

• fix changelog

20.0.1

• fixed the way the config module is loaded. __file__ is now available
• fixed wsgi.input_terminated. It is always true.
• use the highest protocol version of openssl by default
• only support Python >= 3.5
• added __repr__ method to Config instance
• fixed support of AIX platform and musl libc in socketfromfd.fromfd function
• fixed support of applications loaded from a factory function
• fixed chunked encoding support to prevent any request smuggling <https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn>_
• Capture os.sendfile before patching in gevent and eventlet workers. fix RecursionError.
• removed locking in reloader when adding new files
• load the WSGI application before the loader to pick up all files

note this release add official support for applications loaded from a factory function as documented in Flask and other places.

• Fixed fdopen RuntimeWarning in Python 3.8
• Added check and exception for str type on value in Response process_headers method.
• Ensure WSGI header value is string before conducting regex search on it.
• Added pypy3 to list of tested environments
• Grouped StopIteration and KeyboardInterrupt exceptions with same body together in Arbiter.run()
• Added setproctitle module to extras_require in setup.py
• Avoid unnecessary chown of temporary files
• Logging: Handle auth type case insensitively
• Removed util.import_module
• Removed fallback for types.SimpleNamespace in tests utils
• Use SourceFileLoader instead instead of execfile_
• Use importlib instead of __import__ and eval`
• Fixed eventlet patching
• Added optional datadog <https://www.datadoghq.com>_ tags for statsd metrics
• Header values now are encoded using latin-1, not ascii.
• Rewritten parse_address util added test
• Removed redundant super() arguments
• Simplify futures import in gthread module
• Fixed worker_connections` setting to also affects the Gthread worker type
• Fixed setting max_requests
• Bump minimum Eventlet and Gevent versions to 0.24 and 1.4
• Use Python default SSL cipher list by default
• handle wsgi.input_terminated extension
• Simplify Paste Deployment documentation
• Fix root logging: root and logger are same level.
• Fixed typo in ssl_version documentation
• Documented systemd deployement unit examples
• Added systemd sd_notify support
• Fixed typo in gthread.py
• Added tornado <https://www.tornadoweb.org/>_ 5 and 6 support
• Declare our setuptools dependency
• Added support to --bind to open file descriptors
• Document how to serve WSGI app modules from Gunicorn
• Provide guidance on X-Forwarded-For access log in documentation
• Add support for named constants in the --ssl-version flag
• Clarify log format usage of header & environment in documentation
• Fixed systemd documentation to properly setup gunicorn unix socket
• Prevent removal unix socket for reuse_port
• Fix ResourceWarning when reading a Python config module
• Remove unnecessary call to dict keys method
• Support str and bytes for UNIX socket addresses
• fixed InotifyReloadeder: handle module.__file__ is None
• /dev/shm as a convenient alternative to making your own tmpfs mount in fchmod FAQ
• fix examples to work on python3
• Fix typo in --max-requests documentation
• Clear tornado ioloop before os.fork
• Miscellaneous fixes and improvement for linting using Pylint

• fix: address a regression that prevented syslog support from working (#1668, #1773)
• fix: correctly set REMOTE_ADDR on versions of Python 3 affected by Python Issue 30205 <https://bugs.python.org/issue30205>_ (#1755, #1796)
• fix: show zero response length correctly in access log (#1787)
• fix: prevent raising :exc:AttributeError when --reload is not passed in case of a :exc:SyntaxError raised from the WSGI application. (#1805, #1806)
• ❗️The internal module gunicorn.workers.async was renamed to gunicorn.workers.base_async since async is now a reserved word in Python 3.7. (#1527)

• fix: secure scheme headers when bound to a unix socket (#1766, #1767)

• Eventlet 0.21.0 support (#1584)
• Tornado 5 support (#1728, #1752)
• support watching additional files with --reload-extra-file (#1527)
• support configuring logging with a dictionary with --logging-config-dict (#1087, #1110, #1602)
• add support for the --config flag in the GUNICORN_CMD_ARGS environment variable (#1576, #1581)
• disable SO_REUSEPORT by default and add the --reuse-port setting (#1553, #1603, #1669)
• fix: installing inotify on MacOS no longer breaks the reloader (#1540, #1541)
• fix: do not throw TypeError when SO_REUSEPORT is not available (#1501, #1491)
• fix: properly decode HTTP paths containing certain non-ASCII characters (#1577, #1578)
• fix: remove whitespace when logging header values under gevent (#1607)
• fix: close unlinked temporary files (#1327, #1428)
• fix: parse --umask=0 correctly (#1622, #1632)
• fix: allow loading applications using relative file paths (#1349, #1481)
• fix: force blocking mode on the gevent sockets (#880, #1616)
• fix: preserve leading / in request path (#1512, #1511)
• fix: forbid contradictory secure scheme headers
• fix: handle malformed basic authentication headers in access log (#1683, #1684)
• fix: defer handling of USR1 signal to a new greenlet under gevent (#1645, #1651)
• fix: the threaded worker would sometimes close the wrong keep-alive connection under Python 2 (#1698, #1699)
• fix: re-open log files on USR1 signal using handler._open to support subclasses of FileHandler (#1739, #1742)
• deprecation: the gaiohttp worker is deprecated, see the worker-class documentation for more information (#1338, #1418, #1569)

== 19.7.1 ==

• fix: continue if SO_REUSEPORT seems to be available but fails (#1480)
• fix: support non-decimal values for the umask command line option (#1325)

== 19.7.0 ==

• The previously deprecated gunicorn_django command has been removed. Use the command-line interface instead.
• The previously deprecated django_settings setting has been removed. Use the raw-env setting instead.
• The default value of ssl-version has been changed from ssl.PROTOCOL_TLSv1 to ssl.PROTOCOL_SSLv23.
• fix: initialize the group access list when initgroups is set (#1297)
• add environment variables to gunicorn access log format (#1291)
• add --paste-global-conf option (#1304)
• fix: print access logs to STDOUT (#1184)
• remove upper limit on max header size config (#1313)
• fix: print original exception on AppImportError (#1334)
• use SO_REUSEPORT if available (#1344)
• fix leak of duplicate file descriptor for bound sockets.
• add --reload-engine option, support inotify and other backends (#1368, #1459)
• fix: reject request with invalid HTTP versions
• add child_exit callback (#1394)
• add support for eventlets _AlreadyHandled object (#1406)
• format boot tracebacks properly with reloader (#1408)
• refactor socket activation and fd inheritance for better support of SystemD (#1310)
• fix: o fds are given by default in gunicorn (#1423)
• add ability to pass settings to GUNICORN_CMD_ARGS environnement variable which helps in container world (#1385)
• fix: catch access denied to pid file (#1091)
• many additions and improvements to the documentation

Breaking Change

• Python 2.6.0 is the last supported version

== 19.6.0 ==

Core

• improvement of the binary upgrade behaviour using USR2: remove file lockin (#1270)
• add the --capture-output setting to capture stdout/stderr tot the log file (#1271)
• Allow disabling sendfile() via the SENDFILE` environment variable (#1252)
• fix reload under pycharm (#1129)

Workers

• fix: make sure to remove the signal from the worker pipe (#1269)
• fix: gthread worker, handle removed socket in the select loop (#1258)

== 19.5.0 ==

=== Core ===

• fix: Ensure response to HEAD request won't have message body
• fix: lock domain socket and remove on last arbiter exit (#1220)
• improvement: use EnvironmentError instead of socket.error (#939)
• add: new $FORWARDDED_ALLOW_IPS environment variable (#1205)
• fix: infinite recursion when destroying sockets (#1219)
• fix: close sockets on shutdown (#922)
• fix: clean up sys.exc_info calls to drop circular refs (#1228)
• fix: do post_worker_init after load_wsgi (#1248)

=== Workers ===

• fix access logging in gaiohttp worker (#1193)
• eventlet: handle QUIT in a new coroutine (#1217)
• gevent: remove obsolete exception clauses in run (#1218)
• tornado: fix extra "Server" response header (#1246)
• fix: unblock the wait loop under python 3.5 in sync worker (#1256)

=== Logging ===

• fix: log message for listener reloading (#1181)
• Let logging module handle traceback printing (#1201)
• improvement: Allow configuring logger_class with statsd_host (#1188)
• fix: traceback formatting (#1235)
• fix: print error logs on stderr and access logs on stdout (#1184)

=== Documentation ===

• Simplify installation instructions in gunicorn.org (#1072)
• Fix URL and default worker type in example_config (#1209)
• update django doc url to 1.8 lts (#1213)
• fix: miscellaneous wording corrections (#1216)
• Add PSF License Agreement of selectors.py to NOTICE (:issue: #1226)
• document LOGGING overriding (#1051)
• put a note that error logs are only errors from Gunicorn (#1124)
• add a note about the requirements of the threads workers under python 2.x (#1200)
• add access_log_format to config example (#1251)

=== Tests ===

• Use more pytest.raises() in test_http.py

== 19.4.5 ==

• fix: NameError fileno in gunicorn.http.wsgi (#1178)

== 19.4.4 ==

• fix: check if a fileobject can be used with sendfile(2) (#1174)
• doc: be more descriptive in errorlog option (#1173)

== 19.4.3 ==

• fix: don't check if a file is writable using os.stat with SELINUX (#1171)

== 19.4.2 ==

=== Core ===

• improvement: handle HaltServer in manage_workers (#1095)
• fix: Do not rely on sendfile sending requested count (#1155)
• fix: claridy --no-sendfile default (#1156)
• fix: LoggingCatch sendfile failure from no file descriptor (#1160)

=== Logging ===

• fix: Always send access log to syslog if syslog is on
• fix: check auth before trying to own a file (#1157)

=== Documentation ===

• fix: Fix Slowloris broken link. (#1142)
• Tweak markup in faq.rst

=== Testing ===

• fix: gaiohttp test (#1164)

== 19.4.1 ==

• fix tornado worker (#1154)

Gunicorn 19.2.1 is a patch release with fixes.

Changes:

Logging

• expose loglevel in the Logger class

AsyncIO worker (gaiohttp)

• fix #977 fix initial crash

Documentation

• document security mailing-list in the contributing page.

Full changelog is available here:

https://github.com/benoitc/gunicorn/compare/19.2...19.2.1

More

You can find the documentation here:

http://docs.gunicorn.org/en/19.2.1/

Latest version is also available on Pypi:

https://pypi.python.org/pypi/gunicorn/19.2.1

Gunicorn 19.1.1 is a minor release with some fixes.

Changes:

Core

• fix #835: display correct pid of already running instance
• fix : fix PyTest class in setup.py.

Logging

• fix #838 : statsd logger, send statsd timing metrics in milliseconds
• fix #839 : statsd logger, allows for empty log message while pushing metrics and restore worker number in DEBUG logs
• fix #850: add timezone info to logging
• fix #853: Respect logger_class setting unless statsd is on

AioHttp worker

• fix #830 make sure gaiohttp worker is shipped with gunicorn.

Full changelog is available here:

https://github.com/benoitc/gunicorn/compare/19.1...19.1.1

More

You can find the documentation here:

http://docs.gunicorn.org/en/19.1.1/

Latest version is also available on Pypi:

https://pypi.python.org/pypi/gunicorn/19.1.1

Gunicorn 18.0 is a major release with new features and fixes. With this release the commands gunicorn_django and gunicorn_paster are now deprecated. They will be removed in the next major release R19. You can now easily launch your django or paster applications by only using the gunicorn command line. See the documentation and the following changes for more more information.

Changes

• new: add -e/--env command line argument to pass an environment variables to gunicorn
• new: add --chdir command line argument to specified directory before apps loading.
• new: add wsgi.file_wrapper support in async workers
• new: add --paste command line argument to set the paster config file
• deprecated: the command gunicorn_django is now deprecated. You should now run your application with the WSGI interface installed with your project (see https://docs.djangoproject.com/en/1.4/howto/deployment/wsgi/gunicorn/) for more infos.
• deprecated: the command gunicorn_paste is deprecated. You now should use the new --paste argument to set the configuration file of your paster application.
• fix: Removes unmatched leading quote from the beginning of the default access log format string
• fix: null timeout
• fix: gevent worker
• fix: don't reload the paster app when using pserve
• fix: after closing for error do not keep alive the connection
• fix: responses 1xx, 204 and 304 should not force the connection to be closed

Full changelog is available here:

https://github.com/benoitc/gunicorn/compare/17.5...18.0

More

You can find the documentation here:

http://docs.gunicorn.org/en/18.0/

Latest version is also available on Pypi:

https://pypi.python.org/pypi/gunicorn/18.0

Gunicorn 17.5 is a service release with mostly a number of small corrections and user contributions. But there are some new functions worth mentioning as well:

• new: add signals documentation
• new: add post_worker_init hook for workers
• new: try to use gunicorn.conf.py in current folder as the default config file.
• fix graceful timeout with the Eventlet worker
• fix: don't raise an error when closing the socket if already closed
• fix: fix --settings parameter for django application and try to find the django settings when using the gunicorn command.
• fix: give the initial global_conf to paster application
• fix: fix 'Expect: 100-continue' support on Python 3

Full changelog is available here:

https://github.com/benoitc/gunicorn/compare/0.17.4...17.5

You can find the documentation here:

http://docs.gunicorn.org/en/17.5/

Latest version is also available on Pypi:

https://pypi.python.org/pypi/gunicorn/17.5

Notes:

New versioning:

With this release, the versioning of Gunicorn is changing. Gunicorn is stable since a long time and there is no point to release a "1.0" now. It should have been done since a long time. 0.17 really meant it was the 17th stable version. From the beginning we have only 2 kind of releases:

• major release: releases with major changes or huge features added
• services releases: fixes and minor features added

So from now we will apply the following versioning <major>.<service>. For example 17.5 is a service release.