CVS commit: pkgsrc/www/py-gunicorn

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Mar 30 11:14:58 UTC 2026

Modified Files:
        pkgsrc/www/py-gunicorn: Makefile PLIST distinfo

Log Message:
py-gunicorn: updated to 25.3.0

25.3.0 - 2026-03-26

Bug Fixes

- **HTTP/2 ASGI Body Duplication**: Fix request body being received twice in HTTP/2
  ASGI requests, causing JSON parsing errors with "Extra data" messages

- **ASGI Chunked EOF Handling**: Add `finish()` method to callback parser to handle
  chunked encoding edge case where connection closes before final CRLF after zero-chunk

- **HTTP/2 Documentation**: Fix `http_protocols` examples to use comma-separated string
  instead of list syntax

- **Chunked Encoding**: Reject chunk extensions containing bare CR bytes per RFC 9112

Security

- **ASGI Parser Header Validation**: Add security checks per RFC 9110/9112:
  - Reject duplicate Content-Length headers
  - Reject requests with both Content-Length and Transfer-Encoding
  - Reject chunked transfer encoding in HTTP/1.0
  - Reject stacked chunked encoding
  - Validate Transfer-Encoding values
  - Strict chunk size validation

Changes

- **Fast HTTP Parser**: Update to gunicorn_h1c >= 0.6.2 for `asgi_headers` property
  which provides headers with lowercase names directly from the C parser

- **ASGI PROXY Protocol**: Add PROXY protocol v1/v2 support to callback parser


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/www/py-gunicorn/Makefile
cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/py-gunicorn/PLIST
cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/py-gunicorn/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-gunicorn/Makefile
diff -u pkgsrc/www/py-gunicorn/Makefile:1.30 pkgsrc/www/py-gunicorn/Makefile:1.31
--- pkgsrc/www/py-gunicorn/Makefile:1.30        Mon Feb 16 12:48:35 2026
+++ pkgsrc/www/py-gunicorn/Makefile     Mon Mar 30 11:14:58 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2026/02/16 12:48:35 adam Exp $
+# $NetBSD: Makefile,v 1.31 2026/03/30 11:14:58 adam Exp $
 
-DISTNAME=      gunicorn-25.1.0
+DISTNAME=      gunicorn-25.3.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=g/gunicorn/}

Index: pkgsrc/www/py-gunicorn/PLIST
diff -u pkgsrc/www/py-gunicorn/PLIST:1.17 pkgsrc/www/py-gunicorn/PLIST:1.18
--- pkgsrc/www/py-gunicorn/PLIST:1.17   Mon Feb 16 12:48:35 2026
+++ pkgsrc/www/py-gunicorn/PLIST        Mon Mar 30 11:14:58 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.17 2026/02/16 12:48:35 adam Exp $
+@comment $NetBSD: PLIST,v 1.18 2026/03/30 11:14:58 adam Exp $
 bin/gunicorn-${PYVERSSUFFIX}
 bin/gunicornc-${PYVERSSUFFIX}
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
@@ -34,9 +34,9 @@ ${PYSITELIB}/gunicorn/asgi/__init__.pyo
 ${PYSITELIB}/gunicorn/asgi/lifespan.py
 ${PYSITELIB}/gunicorn/asgi/lifespan.pyc
 ${PYSITELIB}/gunicorn/asgi/lifespan.pyo
-${PYSITELIB}/gunicorn/asgi/message.py
-${PYSITELIB}/gunicorn/asgi/message.pyc
-${PYSITELIB}/gunicorn/asgi/message.pyo
+${PYSITELIB}/gunicorn/asgi/parser.py
+${PYSITELIB}/gunicorn/asgi/parser.pyc
+${PYSITELIB}/gunicorn/asgi/parser.pyo
 ${PYSITELIB}/gunicorn/asgi/protocol.py
 ${PYSITELIB}/gunicorn/asgi/protocol.pyc
 ${PYSITELIB}/gunicorn/asgi/protocol.pyo

Index: pkgsrc/www/py-gunicorn/distinfo
diff -u pkgsrc/www/py-gunicorn/distinfo:1.22 pkgsrc/www/py-gunicorn/distinfo:1.23
--- pkgsrc/www/py-gunicorn/distinfo:1.22        Mon Feb 16 12:48:35 2026
+++ pkgsrc/www/py-gunicorn/distinfo     Mon Mar 30 11:14:58 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.22 2026/02/16 12:48:35 adam Exp $
+$NetBSD: distinfo,v 1.23 2026/03/30 11:14:58 adam Exp $
 
-BLAKE2s (gunicorn-25.1.0.tar.gz) = 2184adca1d4597664702991b307c0dd4284b355b841f9996922c081b4a58f72a
-SHA512 (gunicorn-25.1.0.tar.gz) = c6c93678cd45fe161ae635fb3744ff3104d765df3483f000e931408cf1d37e6078600870d6e4fae39fbb231784fc0b378e9e4211fe94ca6f264411bb1d1bb362
-Size (gunicorn-25.1.0.tar.gz) = 594377 bytes
+BLAKE2s (gunicorn-25.3.0.tar.gz) = ef7ddc66847727d90cce42a55608171571bc05a5209bee339ea0f7deb8906abd
+SHA512 (gunicorn-25.3.0.tar.gz) = c445f1b5f67fb063734c35d6c78909a102289ef35cf92037806e73345228564ee3919383dbd1dd781bec39d30968350e54db701077e633b55269746accc8c277
+Size (gunicorn-25.3.0.tar.gz) = 634883 bytes