core: bump gunicorn from 24.1.1 to 25.0.0 by dependabot[bot] · Pull Request #19916 · goauthentik/authentik

dependabot · 2026-02-02T04:12:34Z

Bumps gunicorn from 24.1.1 to 25.0.0.

Release notes

Gunicorn 25.0.0

New Features

Dirty Arbiters: Separate process pool for executing long-running, blocking operations (AI model loading, heavy computation) without blocking HTTP workers ([PR #3460](benoitc/gunicorn#3460))

Inspired by Erlang's dirty schedulers

Asyncio-based with Unix socket IPC

Stateful workers that persist loaded resources

New settings: --dirty-app, --dirty-workers, --dirty-timeout, --dirty-threads, --dirty-graceful-timeout

Lifecycle hooks: on_dirty_starting, dirty_post_fork, dirty_worker_init, dirty_worker_exit

Per-App Worker Allocation for Dirty Arbiters: Control how many dirty workers load each app for memory optimization with heavy models ([PR #3473](benoitc/gunicorn#3473))

Set workers class attribute on DirtyApp (e.g., workers = 2)

Or use config format module:class:N (e.g., myapp:HeavyModel:2)

Requests automatically routed to workers with the target app

New exception DirtyNoWorkersAvailableError for graceful error handling

Example: 8 workers × 10GB model = 80GB → with workers=2: 20GB (75% savings)

HTTP/2 Support (Beta): Native HTTP/2 (RFC 7540) support for improved performance with modern clients ([PR #3468](benoitc/gunicorn#3468))

Multiplexed streams over a single connection

Header compression (HPACK)

Flow control and stream prioritization

Works with gthread, gevent, and ASGI workers

New settings: --http-protocols, --http2-max-concurrent-streams, --http2-initial-window-size, --http2-max-frame-size, --http2-max-header-list-size

Requires SSL/TLS and h2 library: pip install gunicorn[http2]

New example: examples/http2_gevent/ with Docker and tests

HTTP 103 Early Hints: Support for RFC 8297 Early Hints to enable browsers to preload resources before the final response ([PR #3468](benoitc/gunicorn#3468))

WSGI: environ['wsgi.early_hints'](https://github.com/benoitc/gunicorn/blob/HEAD/headers) callback

ASGI: http.response.informational message type

Works with both HTTP/1.1 and HTTP/2

uWSGI Protocol for ASGI Worker: The ASGI worker now supports receiving requests via the uWSGI binary protocol from nginx ([PR #3467](benoitc/gunicorn#3467))

Bug Fixes

Fix HTTP/2 ALPN negotiation for gevent and eventlet workers when do_handshake_on_connect is False (the default). The TLS handshake is now explicitly performed before checking selected_alpn_protocol().

... (truncated)

Commits

617a85e docs: update 25.0.0 release date to 2026-02-01
ee933f2 fix(asgi): quick shutdown on SIGINT/SIGQUIT, graceful on SIGTERM
98ef198 docs: update security policy for maintained versions 24.1.1 and 25.0.0
911e333 chore: replace RST with markdown, remove docs-lint and readthedocs config
7ff671b chore: replace README.rst with README.md, remove modernization-plan.md
d5ab5dc Merge pull request #3473 from benoitc/feature/per-app-worker-allocation
d563a7e chore: bump version to 25.0.0
86264ef docs: add per-app worker allocation to 25.0.0 changelog
c4fe116 docs: add per-app worker allocation documentation
1af5997 docs: regenerate settings.md
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 24.1.1 to 25.0.0. - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@24.1.1...25.0.0) --- updated-dependencies: - dependency-name: gunicorn dependency-version: 25.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

netlify · 2026-02-02T04:14:49Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`ef9a2dd`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/69802435ce2764000815c81d
😎 Deploy Preview	https://deploy-preview-19916--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-02-02T04:22:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.21%. Comparing base (3812823) to head (ef9a2dd).
⚠️ Report is 11 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #19916      +/-   ##
==========================================
- Coverage   93.27%   93.21%   -0.07%     
==========================================
  Files         968      968              
  Lines       53331    53331              
==========================================
- Hits        49746    49713      -33     
- Misses       3585     3618      +33

Flag	Coverage Δ
conformance	`38.07% <ø> (+<0.01%)`	⬆️
e2e	`44.07% <ø> (-0.01%)`	⬇️
integration	`22.87% <ø> (-0.05%)`	⬇️
unit	`91.40% <ø> (-0.02%)`	⬇️
unit-migrate	`91.43% <ø> (-0.04%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

* main: (30 commits) web/admin: fix default binding order (#19943) ci: fix test_docker.sh (#19944) lib: Add ssh/sftp schemas in to DomainlessFormattedURLValidator (#19881) core: fix non-expiring service accounts and app passwords (#19913) lifecycle/ak: make sure /data has the correct permissions (#19935) lifecycle/aws: add /data volume (#19936) website/docs: Update location of media storage and outdated references (#19885) web: bump @types/node from 25.1.0 to 25.2.0 in /web (#19923) web: bump @playwright/test from 1.58.0 to 1.58.1 in /web (#19926) web: bump the rollup group across 1 directory with 4 updates (#19922) ci: always generate API clients (#19906) providers/scim: add configuration warning for migration (#19859) core, web: update translations (#19868) core: bump gunicorn from 24.1.1 to 25.0.0 (#19916) core: bump pyjwt from 2.10.1 to 2.11.0 (#19920) core: bump cachetools from 6.2.6 to 7.0.0 (#19919) web: bump @formatjs/intl-listformat from 8.2.0 to 8.2.1 in /web (#19924) web: bump the storybook group across 1 directory with 5 updates (#19921) core: bump axllent/mailpit from v1.28.4 to v1.29.0 in /tests/e2e (#19918) core: bump goauthentik/selenium from 144.0-ak-0.35.9 to 144.0-ak-0.40.0 in /tests/e2e (#19917) ...

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 2, 2026

dependabot bot requested a review from a team as a code owner February 2, 2026 04:12

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 2, 2026

BeryJu approved these changes Feb 2, 2026

View reviewed changes

BeryJu merged commit 7502816 into main Feb 2, 2026
102 checks passed

BeryJu deleted the dependabot/uv/gunicorn-25.0.0 branch February 2, 2026 12:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

core: bump gunicorn from 24.1.1 to 25.0.0#19916

core: bump gunicorn from 24.1.1 to 25.0.0#19916
BeryJu merged 1 commit intomainfrom
dependabot/uv/gunicorn-25.0.0

dependabot bot commented on behalf of github Feb 2, 2026

Uh oh!

netlify bot commented Feb 2, 2026

Uh oh!

codecov bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot bot commented on behalf of github Feb 2, 2026

Gunicorn 25.0.0

New Features

Bug Fixes

Uh oh!

netlify bot commented Feb 2, 2026

✅ Deploy Preview for authentik-docs ready!

Uh oh!

codecov bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codecov bot commented Feb 2, 2026 •

edited

Loading