fix(deps): update website

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
Flask-Compress	==1.23 → ==1.24
google-cloud-logging (source)	==3.14.0 → ==3.15.0
google-cloud-ndb (source)	==2.4.0 → ==2.4.1
gunicorn (changelog)	==25.2.0 → ==25.3.0
mini-css-extract-plugin	2.10.1 → 2.10.2
requests (changelog)	==2.33.0 → ==2.33.1

---

Release Notes

colour-science/flask-compress (Flask-Compress)

v1.24

Compare Source

• add mypy annotations and mark it as checkable, #​76 by @​orborde
• enable trusted publishing, allowing GitHub Actions to publish releases to PyPI without long lived credentials, #​78 by @​alexprengere

googleapis/google-cloud-python (google-cloud-logging)

v3.15.0: google-cloud-logging: v3.15.0

Compare Source

v3.15.0 (2026-03-26)

benoitc/gunicorn (gunicorn)

v25.3.0: Gunicorn 25.3.0

Compare Source

Bug Fixes

• HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2
  ASGI requests, causing JSON parsing errors with "Extra data" messages
  (#​3558)

• ASGI Chunked EOF Handling: Add finish() method to callback parser to handle
  chunked encoding edge case where connection closes before final CRLF after zero-chunk

• HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string
  instead of list syntax (#​3561)

• Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112
  (#​3556)

• Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented,
  instead of using default maximum. Works with both Python and fast C parser.
  (#​3563)

Security

• ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
  • Reject duplicate Content-Length headers
  • Reject requests with both Content-Length and Transfer-Encoding
  • Reject chunked transfer encoding in HTTP/1.0
  • Reject stacked chunked encoding
  • Validate Transfer-Encoding values
  • Strict chunk size validation

Changes

• Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property
  and InvalidChunkExtension validation for bare CR rejection

• ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser

• Docker Images: Update to Python 3.14

webpack/mini-css-extract-plugin (mini-css-extract-plugin)

v2.10.2

Compare Source

psf/requests (requests)

v2.33.1

Compare Source

Bugfixes

• Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
  files in the tmp directory. (#​7305)
• Fixed Content-Type header parsing for malformed values. (#​7309)
• Improved error consistency for malformed header values. (#​7308)

---

Configuration

📅 Schedule: Branch creation - "before 6am on wednesday" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.