Upgrading gunicorn 25 to 26

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1.

packaging is no longer a runtime dependency: it was only ever imported by the gevent worker, to compare gevent's version.

Eventlet worker removed: The eventlet worker class has been dropped.

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely.

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control…

If you serve HTTP/2, this is the reason to upgrade.

Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now…

HTTP/1.1 Request-Target Validation (RFC 9112 sections 3.2.3, 3.2.4).

Header Field Hardening (RFC 9110).

Request Smuggling Hardening.

PROXY Protocol (ASGI): Enforce proxy_allow_ips and tighten v1/v2 parsing in the ASGI callback parser.

Connection Draining: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.