Bump gunicorn from 24.1.1 to 25.0.1

[dependabot]

Bumps gunicorn from 24.1.1 to 25.0.1.

Release notes

Sourced from gunicorn's releases.

25.0.1

Bug Fixes

• Fix ASGI streaming responses (SSE) hanging: add chunked transfer encoding for HTTP/1.1 responses without Content-Length header. Without chunked encoding, clients wait for connection close to determine end-of-response.

Changes

• Update celery_alternative example to use FastAPI with native ASGI worker and uvloop for async task execution

Testing

• Add ASGI compliance test suite with Docker-based integration tests covering HTTP, WebSocket, streaming, lifespan, framework integration (Starlette, FastAPI), HTTP/2, and concurrency scenarios

Gunicorn 25.0.0

New Features

• Dirty Arbiters: Separate process pool for executing long-running, blocking operations (AI model loading, heavy computation) without blocking HTTP workers ([PR #3460](benoitc/gunicorn#3460))

  • Inspired by Erlang's dirty schedulers
  • Asyncio-based with Unix socket IPC
  • Stateful workers that persist loaded resources
  • New settings: --dirty-app, --dirty-workers, --dirty-timeout, --dirty-threads, --dirty-graceful-timeout
  • Lifecycle hooks: on_dirty_starting, dirty_post_fork, dirty_worker_init, dirty_worker_exit

• Per-App Worker Allocation for Dirty Arbiters: Control how many dirty workers load each app for memory optimization with heavy models ([PR #3473](benoitc/gunicorn#3473))

  • Set workers class attribute on DirtyApp (e.g., workers = 2)
  • Or use config format module:class:N (e.g., myapp:HeavyModel:2)
  • Requests automatically routed to workers with the target app
  • New exception DirtyNoWorkersAvailableError for graceful error handling
  • Example: 8 workers × 10GB model = 80GB → with workers=2: 20GB (75% savings)

• HTTP/2 Support (Beta): Native HTTP/2 (RFC 7540) support for improved performance with modern clients ([PR #3468](benoitc/gunicorn#3468))

  • Multiplexed streams over a single connection
  • Header compression (HPACK)
  • Flow control and stream prioritization
  • Works with gthread, gevent, and ASGI workers
  • New settings: --http-protocols, --http2-max-concurrent-streams, --http2-initial-window-size, --http2-max-frame-size, --http2-max-header-list-size
  • Requires SSL/TLS and h2 library: pip install gunicorn[http2]

... (truncated)

Commits

• 3bf529f docs: sync news.md with 2026-news.md
• 1f4f245 Merge pull request #3478 from benoitc/feature/asgi-compliance-testbed
• e1519c0 docs: add ASGI compliance test suite to changelog
• 0885005 fix(tests): correct assertions in ASGI compliance tests
• 658924c docs: update changelog for 25.0.1
• c5b6e82 chore: bump version to 25.0.1
• ce352dc fix(asgi): add chunked transfer encoding for streaming responses
• 29b8a3a Merge pull request #3476 from benoitc/dependabot/github_actions/actions/check...
• 791ab46 chore(deps): bump actions/checkout from 4 to 6
• 9235b72 Merge pull request #3475 from benoitc/dependabot/github_actions/actions/uploa...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.21%. Comparing base (bca4bcf) to head (37be89d).
⚠️ Report is 8 commits behind head on 3.14.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             3.14   #12019      +/-   ##
==========================================
- Coverage   98.22%   98.21%   -0.01%     
==========================================
  Files         128      128              
  Lines       44990    44990              
  Branches     2434     2434              
==========================================
- Hits        44192    44189       -3     
- Misses        615      618       +3     
  Partials      183      183              

Flag	Coverage Δ
CI-GHA	98.09% <ø> (-0.01%)	⬇️
OS-Linux	97.85% <ø> (-0.01%)	⬇️
OS-Windows	95.60% <ø> (ø)
OS-macOS	97.10% <ø> (-0.01%)	⬇️
Py-3.10.11	96.64% <ø> (ø)
Py-3.10.19	97.13% <ø> (ø)
Py-3.11.14	97.37% <ø> (ø)
Py-3.11.9	96.88% <ø> (ø)
Py-3.12.10	96.97% <ø> (ø)
Py-3.12.12	97.46% <ø> (ø)
Py-3.13.11	97.69% <ø> (-0.01%)	⬇️
Py-3.14.2	97.66% <ø> (ø)
Py-3.14.2t	96.77% <ø> (+<0.01%)	⬆️
Py-pypy3.11.13-7.3.20	96.91% <ø> (+<0.01%)	⬆️
VM-macos	97.10% <ø> (-0.01%)	⬇️
VM-ubuntu	97.85% <ø> (-0.01%)	⬇️
VM-windows	95.60% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 59 untouched benchmarks

---

_{Comparing dependabot/pip/3.14/gunicorn-25.0.1 (37be89d) with 3.14 (bca4bcf)¹}

Footnotes

1. No successful run was found on 3.14 (f48cb1f) during the generation of this report, so bca4bcf was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩