[dependabot]

Bumps the python-dependencies group with 2 updates: gunicorn and types-pyyaml.

Updates gunicorn from 26.2.0 to 27.0.0

Release notes

Sourced from gunicorn's releases.

gunicorn 27.0.0

Breaking Changes

• Reject with 400 a request whose Transfer-Encoding does not end with chunked, such as gzip or identity alone, with or without Content-Length (RFC 9112 §6.3). The WSGI workers used to read such a body until the connection closed and the ASGI worker treated it as empty. Clients that send Transfer-Encoding: identity must stop sending it.

Bug Fixes

• Reject whitespace between a header name and the colon (RFC 9112 §5.1).
• Trim only spaces and tabs around Transfer-Encoding values (RFC 9110 §5.6.3) (#3364).
• Reject a Content-Length that is not plain digits (RFC 9110 §8.6).
• Reject chunk data not followed by CRLF (RFC 9112 §7.1).
• Reject control characters in the request path (RFC 9112 §3.2) (#3371).
• Return 414 URI Too Long for a request line over limit_request_line (RFC 9112 §3) (#2487).
• ASGI: never write more body bytes than the app's Content-Length, and close the connection when the body is shorter (RFC 9112 §6.3).
• ASGI: close the connection when the app returns before finishing its response (RFC 9112 §6.3).
• ASGI: reject response header names and values that are not valid (RFC 9110 §5.1, §5.5).
• WSGI: reject a response status that is not three digits followed by a valid reason phrase (RFC 9112 §4).
• ASGI: read the body a HEAD request declares instead of serving it as the next request (RFC 9112 §6.3).
• ASGI: stop buffering a request line, header, chunk-size line or trailer that never ends; the usual request limits now apply before the line terminator arrives, and trailers count against limit_request_fields.
• ASGI: apply forwarded_allow_ips to HTTP/1 requests as WSGI and HTTP/2 already do: secure_scheme_headers set the scheme only from trusted proxies, and header names with underscores follow header_map.
• Ignore one empty line before the request line, as the fast parser already does (RFC 9112 §2.2).
• ASGI: stop gunicorn when the app reports a failed lifespan startup, instead of serving requests or rebooting the worker forever (ASGI lifespan spec) (#3778).
• ASGI: close idle kept-alive connections after keepalive seconds, as the other workers do (#3734).
• ASGI: give each request a shallow copy of the lifespan state, so a value one request stores in scope["state"] is not seen by the next one (ASGI lifespan spec).
• ASGI: deliver websocket.disconnect as soon as the client closes the connection, instead of after the close timeout (RFC 6455 §5.5.1).

... (truncated)

Commits

• 237de69 gunicorn 27.0.0
• 77b0c63 Merge pull request #3814 from benoitc/docs/latest-changes
• 8c02c88 agents: list the HTTP/1 framing rules and how CI runs pylint
• ea47de9 docs: describe the ASGI worker's request handling and performance
• ff5ea0a docs: sort the unreleased changelog into breaking changes, fixes and changes
• 747ea4f Merge pull request #3813 from benoitc/fix/http1-framing-parity
• c5a8b68 build: require gunicorn_h1c 0.6.14
• 6a52220 lint: put the two pylint disables where CI reports them
• 76bd679 lint: silence two pylint false positives seen under Python 3.12
• 2fcfc62 asgi, http: answer 501 to an unknown transfer coding on every path
• Additional commits viewable in compare view

Updates types-pyyaml from 6.0.12.20261103 to 6.0.12.20261111

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (03488c3) to head (0fb8acc).

Additional details and impacted files

@@            Coverage Diff            @@
##               dev      #122   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           18        18           
  Lines         1545      1545           
=========================================
  Hits          1545      1545           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.