A bug-fix release, mostly hardening the HTTP/2 and ASGI workers.
HTTP/2
Request bodies now stream instead of being buffered in full before the
application is called, so a client that never ends a stream can no longer grow a
worker; a stream carries at most its receive window in flight. A review of the
HTTP/2 support fixed a batch of issues across the gthread, gevent and asgi
workers: a graceful GOAWAY is honoured wherever it lands, waiting for send
credit is bounded by timeout, an application error after the headers went out
resets the stream instead of corrupting the HPACK table, an empty final chunk
ends the stream, RST_STREAM floods are closed with ENHANCE_YOUR_CALM, and a
bad request resets its own stream rather than the connection. h2spec now runs
against every HTTP/2 worker in CI.
ASGI
The ASGI worker no longer drops a request pipelined on a kept-alive connection
(it was left in the parser buffer and discarded on the reset between requests,
hanging the connection). The uWSGI protocol works behind nginx uwsgi_pass
again; it previously returned 502 on every request. receive() after the body
blocks until the peer disconnects instead of spinning the loop, and a reader
paused under backpressure is resumed.
HTTP/1
A chunk-size line or trailer section that never terminates is now bounded by the
existing request limits and scanned incrementally, and a malformed chunked body
answers 400 Bad Request instead of raising. A worker timeout no longer dumps a
500 onto a response body that had already started.
Full changelog: https://github.com/benoitc/gunicorn/blob/master/docs/content/news.md