Update gunicorn requirement from >=23.0.0 to >=26.1.0

[dependabot]

Updates the requirements on gunicorn to permit the latest version.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [ are treated as patterns, so ui/*/config.json watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and ** recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (#1643, #3662).

Security

• Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now require the first clean release; pytest and httpx were unpinned and now carry floors. The tornado example pinned tornado<6, which was both the source of several advisories and older than the >=6.5.0 the tornado worker needs, so the example could not run as pinned.

Bug Fixes

• SIGHUP did not reload the logger configuration: Arbiter.reload() re-read the configuration file but kept using the logger built at startup, calling only reopen_files() on its existing handlers. Changes to logconfig, logconfig_dict, logconfig_json and loglevel were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (#3353).

• Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises ChunkMissingTerminator (#3382, #3685).

• --spew crashed on dynamically generated code: the trace hook indexed the 2-tuple returned by inspect.getsourcelines() by line number rather than indexing the list of lines, so a frame with no __file__ raised AttributeError: 'int' object has no attribute 'rstrip' on line 1 and

... (truncated)

Commits

• 71b59a7 Merge pull request #3698 from benoitc/fix/docker-health-check-readerror
• 48287de test: catch every transport error in the docker health check
• 3110e8c Merge pull request #3696 from benoitc/docs/roadmap
• cc56c41 Merge pull request #3693 from benoitc/release/26.1.0
• 5cf1f16 docs: surface the roadmap on the site home page
• 7e35f72 docs: add FastCGI to the roadmap and point items at Ideas
• 18ddc58 docs: drop the framework and reverse-proxy non-goals from the roadmap
• 1ecae56 docs: add a roadmap and make the chat easy to find
• ca412e3 docs: sync the Latest changelog page with 26.1.0
• 640936f docs: note the dependency security work in 26.1.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pip-install-python]

Closing: raising this floor would erase the reason it exists.

gunicorn>=23.0.0 is not a staleness marker — it is the CVE fact. 21.x carried two request-smuggling CVEs (CVE-2024-6827, CVE-2024-1135), both fixed in 23.0, and requirements.txt says so directly above the pin. CI asserts the installed version inside the built image precisely because a transitive pin (markdown2dash asks for gunicorn<22) must never drag the production server back under it.

Moving the floor to >=26.1.0 would state that 23–25 are unsafe, which is false, and would silently discard the CVE rationale. The resolver already installs 26.1.0 under the existing floor — this deployment is running it. The PR changes what the floor means while changing nothing about what is installed.

---

Not a rebase-and-merge: the change itself is the problem, not its base. .github/dependabot.yml now carries an allow-list restricting pip version-updates to dash*/plotly*/markdown2dash — the network-drift alarm this file exists for — so this class of PR stops being opened. Mirrors the template's fix (dash-documentation-boilerplate ab22fd7). Security updates are unaffected: they arrive through GitHub's separate security-update channel regardless of the allow-list.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.