CVS commit: pkgsrc/www/py-gunicorn

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Sep  2 14:40:04 UTC 2026

Modified Files:
        pkgsrc/www/py-gunicorn: Makefile PLIST distinfo

Log Message:
py-gunicorn: updated to 26.2.0

26.2.0 - 2026-08-24

New Features

- **Cleartext HTTP/2 (h2c)**: `http2_cleartext` accepts `prior-knowledge`,
  `upgrade`, `both` or `off` (the default). With `prior-knowledge`, a connection
  opening with the HTTP/2 preface is served as HTTP/2, which is what a
  TLS-terminating proxy in front of gunicorn needs to avoid dropping to HTTP/1.1
  upstream. `upgrade` honours an HTTP/1.1 `Upgrade: h2c` request. Both work on
  the gthread, gevent and ASGI workers. Only peers in `forwarded_allow_ips` are
  considered; anything else from such a peer is refused with 400 rather than
  silently downgraded. Each mechanism is enabled separately, so turning one on
  does not turn the other on

Security

- **HTTP/2 bypassed the header policy**: `HTTP2Request` built its headers
  straight from the stream, so nothing the HTTP/1 path enforces applied over
  HTTP/2: the underscore and `header_map` policy, duplicate `Host` and
  `Content-Type`, control characters in values, and the `forwarded_allow_ips`
  trust gate. An untrusted client could set `SCRIPT_NAME` and forge `HTTP_*`
  entries in the WSGI environ, and decide `wsgi.url_scheme` through `:scheme`.
  The policy now lives on a mixin both request classes share, and the scheme is
  derived from the transport

Bug Fixes

- **WSGI HTTP/2 responses were buffered whole**: both WSGI workers collected the
  entire body in memory before sending anything. They write through an
  `HTTP2Response` now, so the body leaves as it is produced

- **No-body responses carried a body over HTTP/2**: HEAD, 204 and 304 sent
  application body bytes on all three workers, while the HTTP/1 path had always
  dropped them per RFC 9110. They no longer do

- **Events lost during flow-control waits**: while blocked waiting for a
  WINDOW_UPDATE, both HTTP/2 connections read from the socket and discarded
  every event that was not a stream reset or connection termination, losing
  requests and body data outright. They are queued for the main loop now

- **`sendfile()` on HTTP/2**: it was guarded by `cfg.is_ssl`, which covered
  HTTP/2 only for as long as HTTP/2 implied TLS. It is refused on HTTP/2
  responses directly, so cleartext cannot bypass HTTP/2 framing

- **Request bodies dropped on `Upgrade` requests**: on the ASGI worker with the
  fast parser, any request carrying an `Upgrade` header reached the application
  with an empty body, whatever the header's value and with HTTP/2 switched off.
  The parser treated the header as meaning the rest of the connection was no
  longer HTTP/1, so it never read the body it had just been told the length of.
  Fixed in `gunicorn_h1c` 0.6.9, which the requirement below now pins

Changes

- **Fast HTTP Parser**: require `gunicorn_h1c >= 0.6.9`, which adds
  `remaining()` for recovering bytes pipelined behind a completed message, and
  stops an `Upgrade` header from suppressing body parsing


To generate a diff of this commit:
cvs rdiff -u -r1.32 -r1.33 pkgsrc/www/py-gunicorn/Makefile
cvs rdiff -u -r1.19 -r1.20 pkgsrc/www/py-gunicorn/PLIST
cvs rdiff -u -r1.24 -r1.25 pkgsrc/www/py-gunicorn/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-gunicorn/Makefile
diff -u pkgsrc/www/py-gunicorn/Makefile:1.32 pkgsrc/www/py-gunicorn/Makefile:1.33
--- pkgsrc/www/py-gunicorn/Makefile:1.32        Tue May 19 11:50:00 2026
+++ pkgsrc/www/py-gunicorn/Makefile     Wed Sep  2 14:40:03 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.32 2026/05/19 11:50:00 adam Exp $
+# $NetBSD: Makefile,v 1.33 2026/09/02 14:40:03 adam Exp $
 
-DISTNAME=      gunicorn-26.0.0
+DISTNAME=      gunicorn-26.2.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=g/gunicorn/}
@@ -11,11 +11,11 @@ COMMENT=    Python WSGI HTTP server
 LICENSE=       mit
 
 TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=78:../../devel/py-setuptools
-DEPENDS+=      ${PYPKGPREFIX}-packaging-[0-9]*:../../devel/py-packaging
-TEST_DEPENDS+= ${PYPKGPREFIX}-cryptography-[0-9]*:../../security/py-cryptography
+TEST_DEPENDS+= ${PYPKGPREFIX}-cryptography>=0:../../security/py-cryptography
 TEST_DEPENDS+= ${PYPKGPREFIX}-gevent>=24.10.1:../../net/py-gevent
-TEST_DEPENDS+= ${PYPKGPREFIX}-test-asyncio-[0-9]*:../../devel/py-test-asyncio
-TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov-[0-9]*:../../devel/py-test-cov
+TEST_DEPENDS+= ${PYPKGPREFIX}-packaging>=0:../../devel/py-packaging
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-asyncio>=0:../../devel/py-test-asyncio
+TEST_DEPENDS+= ${PYPKGPREFIX}-test-cov>=0:../../devel/py-test-cov
 
 USE_LANGUAGES= # none
 

Index: pkgsrc/www/py-gunicorn/PLIST
diff -u pkgsrc/www/py-gunicorn/PLIST:1.19 pkgsrc/www/py-gunicorn/PLIST:1.20
--- pkgsrc/www/py-gunicorn/PLIST:1.19   Tue May 19 11:50:00 2026
+++ pkgsrc/www/py-gunicorn/PLIST        Wed Sep  2 14:40:03 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.19 2026/05/19 11:50:00 adam Exp $
+@comment $NetBSD: PLIST,v 1.20 2026/09/02 14:40:03 adam Exp $
 bin/gunicorn-${PYVERSSUFFIX}
 bin/gunicornc-${PYVERSSUFFIX}
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
@@ -139,9 +139,15 @@ ${PYSITELIB}/gunicorn/http2/connection.p
 ${PYSITELIB}/gunicorn/http2/errors.py
 ${PYSITELIB}/gunicorn/http2/errors.pyc
 ${PYSITELIB}/gunicorn/http2/errors.pyo
+${PYSITELIB}/gunicorn/http2/negotiation.py
+${PYSITELIB}/gunicorn/http2/negotiation.pyc
+${PYSITELIB}/gunicorn/http2/negotiation.pyo
 ${PYSITELIB}/gunicorn/http2/request.py
 ${PYSITELIB}/gunicorn/http2/request.pyc
 ${PYSITELIB}/gunicorn/http2/request.pyo
+${PYSITELIB}/gunicorn/http2/response.py
+${PYSITELIB}/gunicorn/http2/response.pyc
+${PYSITELIB}/gunicorn/http2/response.pyo
 ${PYSITELIB}/gunicorn/http2/stream.py
 ${PYSITELIB}/gunicorn/http2/stream.pyc
 ${PYSITELIB}/gunicorn/http2/stream.pyo

Index: pkgsrc/www/py-gunicorn/distinfo
diff -u pkgsrc/www/py-gunicorn/distinfo:1.24 pkgsrc/www/py-gunicorn/distinfo:1.25
--- pkgsrc/www/py-gunicorn/distinfo:1.24        Tue May 19 11:50:00 2026
+++ pkgsrc/www/py-gunicorn/distinfo     Wed Sep  2 14:40:03 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.24 2026/05/19 11:50:00 adam Exp $
+$NetBSD: distinfo,v 1.25 2026/09/02 14:40:03 adam Exp $
 
-BLAKE2s (gunicorn-26.0.0.tar.gz) = 177d86da5cf37e207a32f7ae444aaaf3d03df24ab031426150374550ec1f6228
-SHA512 (gunicorn-26.0.0.tar.gz) = 8f8ef933324226c17bf6fc09e79b682a4f0177ef79a2c485b7c93d6a06bc103f145786596c69142e399655c057a2d111a862953cf0d9144b3c21f35b6f6b34ce
-Size (gunicorn-26.0.0.tar.gz) = 727286 bytes
+BLAKE2s (gunicorn-26.2.0.tar.gz) = 918638584ab6933d0b77e8d91ffc7d677e83a71b2d64618c739c5326dc698ae3
+SHA512 (gunicorn-26.2.0.tar.gz) = 9c59b1207fa23e643c83f1b9a9194b7cfb44a28c1542c18c0ead323f13c60dc1fdfa89e7eee46c6ed470dc2387cef41dfe2b0e46eb473ecd61542a79d7a3e5f4
+Size (gunicorn-26.2.0.tar.gz) = 787921 bytes