Bump gunicorn from 24.1.1 to 25.0.0 (#12014)

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 24.1.1 to
25.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/benoitc/gunicorn/releases">gunicorn's
releases</a>.</em></p>
<blockquote>
<h2>Gunicorn 25.0.0</h2>
<h2>New Features</h2>
<ul>
<li>
<p><strong>Dirty Arbiters</strong>: Separate process pool for executing
long-running, blocking
operations (AI model loading, heavy computation) without blocking HTTP
workers
([PR <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3460">#3460</a>](<a
href="https://redirect.github.com/benoitc/gunicorn/pull/3460">benoitc/gunicorn#3460</a>))</p>
<ul>
<li>Inspired by Erlang's dirty schedulers</li>
<li>Asyncio-based with Unix socket IPC</li>
<li>Stateful workers that persist loaded resources</li>
<li>New settings: <code>--dirty-app</code>,
<code>--dirty-workers</code>, <code>--dirty-timeout</code>,
<code>--dirty-threads</code>, <code>--dirty-graceful-timeout</code></li>
<li>Lifecycle hooks: <code>on_dirty_starting</code>,
<code>dirty_post_fork</code>,
<code>dirty_worker_init</code>, <code>dirty_worker_exit</code></li>
</ul>
</li>
<li>
<p><strong>Per-App Worker Allocation for Dirty Arbiters</strong>:
Control how many dirty workers
load each app for memory optimization with heavy models
([PR <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3473">#3473</a>](<a
href="https://redirect.github.com/benoitc/gunicorn/pull/3473">benoitc/gunicorn#3473</a>))</p>
<ul>
<li>Set <code>workers</code> class attribute on DirtyApp (e.g.,
<code>workers = 2</code>)</li>
<li>Or use config format <code>module:class:N</code> (e.g.,
<code>myapp:HeavyModel:2</code>)</li>
<li>Requests automatically routed to workers with the target app</li>
<li>New exception <code>DirtyNoWorkersAvailableError</code> for graceful
error handling</li>
<li>Example: 8 workers × 10GB model = 80GB → with
<code>workers=2</code>: 20GB (75% savings)</li>
</ul>
</li>
<li>
<p><strong>HTTP/2 Support (Beta)</strong>: Native HTTP/2 (RFC 7540)
support for improved performance
with modern clients ([PR <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3468">#3468</a>](<a
href="https://redirect.github.com/benoitc/gunicorn/pull/3468">benoitc/gunicorn#3468</a>))</p>
<ul>
<li>Multiplexed streams over a single connection</li>
<li>Header compression (HPACK)</li>
<li>Flow control and stream prioritization</li>
<li>Works with gthread, gevent, and ASGI workers</li>
<li>New settings: <code>--http-protocols</code>,
<code>--http2-max-concurrent-streams</code>,
<code>--http2-initial-window-size</code>,
<code>--http2-max-frame-size</code>,
<code>--http2-max-header-list-size</code></li>
<li>Requires SSL/TLS and h2 library: <code>pip install
gunicorn[http2]</code></li>
<li>New example: <code>examples/http2_gevent/</code> with Docker and
tests</li>
</ul>
</li>
<li>
<p><strong>HTTP 103 Early Hints</strong>: Support for RFC 8297 Early
Hints to enable browsers to
preload resources before the final response
([PR <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3468">#3468</a>](<a
href="https://redirect.github.com/benoitc/gunicorn/pull/3468">benoitc/gunicorn#3468</a>))</p>
<ul>
<li>WSGI:
<code>environ['wsgi.early_hints'](https://github.com/benoitc/gunicorn/blob/HEAD/headers)</code>
callback</li>
<li>ASGI: <code>http.response.informational</code> message type</li>
<li>Works with both HTTP/1.1 and HTTP/2</li>
</ul>
</li>
<li>
<p><strong>uWSGI Protocol for ASGI Worker</strong>: The ASGI worker now
supports receiving requests
via the uWSGI binary protocol from nginx
([PR <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3467">#3467</a>](<a
href="https://redirect.github.com/benoitc/gunicorn/pull/3467">benoitc/gunicorn#3467</a>))</p>
</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Fix HTTP/2 ALPN negotiation for gevent and eventlet workers when
<code>do_handshake_on_connect</code> is False (the default). The TLS
handshake is now
explicitly performed before checking
<code>selected_alpn_protocol()</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/benoitc/gunicorn/commit/617a85ea91a439735b47d991dfbbe706dc2beb0b"><code>617a85e</code></a>
docs: update 25.0.0 release date to 2026-02-01</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/ee933f2e3092557dfe36074aa98f84bd6081622e"><code>ee933f2</code></a>
fix(asgi): quick shutdown on SIGINT/SIGQUIT, graceful on SIGTERM</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/98ef198baa98a359131aa301a44519754c161575"><code>98ef198</code></a>
docs: update security policy for maintained versions 24.1.1 and
25.0.0</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/911e333b4e18ce0cf4c9a4739f96f056153202c6"><code>911e333</code></a>
chore: replace RST with markdown, remove docs-lint and readthedocs
config</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/7ff671bca3b1995b00e0f9703444abf57fb45842"><code>7ff671b</code></a>
chore: replace README.rst with README.md, remove
modernization-plan.md</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/d5ab5dc6c1c117b71a21c354f18e760c320157c1"><code>d5ab5dc</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3473">#3473</a>
from benoitc/feature/per-app-worker-allocation</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/d563a7e436267396b063a04ad76f4a326e6bba4e"><code>d563a7e</code></a>
chore: bump version to 25.0.0</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/86264ef90001f7d92a4dae1b19c832ab87156230"><code>86264ef</code></a>
docs: add per-app worker allocation to 25.0.0 changelog</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/c4fe116d71f55b35bf0865fd9cd806e2f235c746"><code>c4fe116</code></a>
docs: add per-app worker allocation documentation</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/1af599769f398dbeadbd5f83dabeab79a5d2a37d"><code>1af5997</code></a>
docs: regenerate settings.md</li>
<li>Additional commits viewable in <a
href="https://github.com/benoitc/gunicorn/compare/24.1.1...25.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gunicorn&package-manager=pip&previous-version=24.1.1&new-version=25.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

requirements/base-ft.txt

@@ -22,7 +22,7 @@ frozenlist==1.8.0
     # via
     #   -r requirements/runtime-deps.in
     #   aiosignal
-gunicorn==24.1.1
+gunicorn==25.0.1
     # via -r requirements/base-ft.in
 idna==3.7
     # via yarl

requirements/base.txt

@@ -22,7 +22,7 @@ frozenlist==1.8.0
     # via
     #   -r requirements/runtime-deps.in
     #   aiosignal
-gunicorn==24.1.1
+gunicorn==25.0.1
     # via -r requirements/base.in
 idna==3.7
     # via yarl

requirements/constraints.txt

@@ -6,34 +6,34 @@
 #
 aiodns==4.0.0
     # via
-    #   -r lint.in
-    #   -r runtime-deps.in
+    #   -r requirements/lint.in
+    #   -r requirements/runtime-deps.in
 aiohappyeyeballs==2.6.1
-    # via -r runtime-deps.in
+    # via -r requirements/runtime-deps.in
 aiohttp-theme==0.1.7
-    # via -r doc.in
+    # via -r requirements/doc.in
 aiosignal==1.4.0
-    # via -r runtime-deps.in
+    # via -r requirements/runtime-deps.in
 alabaster==1.0.0
     # via sphinx
 annotated-types==0.7.0
     # via pydantic
 async-timeout==5.0.1 ; python_version < "3.11"
     # via
-    #   -r runtime-deps.in
+    #   -r requirements/runtime-deps.in
     #   valkey
 babel==2.18.0
     # via sphinx
 backports-zstd==1.3.0 ; implementation_name == "cpython"
     # via
-    #   -r lint.in
-    #   -r runtime-deps.in
+    #   -r requirements/lint.in
+    #   -r requirements/runtime-deps.in
 blockbuster==1.5.26
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 brotli==1.2.0 ; platform_python_implementation == "CPython"
-    # via -r runtime-deps.in
+    # via -r requirements/runtime-deps.in
 build==1.4.0
     # via pip-tools
 certifi==2026.1.4
@@ -55,12 +55,12 @@ click==8.3.1
     #   wait-for-it
 coverage==7.13.2
     # via
-    #   -r test-common.in
+    #   -r requirements/test-common.in
     #   pytest-cov
 cryptography==46.0.3
     # via trustme
 cython==3.2.4
-    # via -r cython.in
+    # via -r requirements/cython.in
 distlib==0.4.0
     # via virtualenv
 docutils==0.21.2
@@ -75,14 +75,14 @@ forbiddenfruit==0.1.4
     # via blockbuster
 freezegun==1.5.5
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 frozenlist==1.8.0
     # via
-    #   -r runtime-deps.in
+    #   -r requirements/runtime-deps.in
     #   aiosignal
-gunicorn==24.1.1
-    # via -r base.in
+gunicorn==25.0.1
+    # via -r requirements/base.in
 identify==2.6.16
     # via pre-commit
 idna==3.7
@@ -96,8 +96,8 @@ iniconfig==2.3.0
     # via pytest
 isal==1.7.2 ; python_version < "3.14"
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 jinja2==3.1.6
     # via
     #   sphinx
@@ -112,13 +112,13 @@ mdurl==0.1.2
     # via markdown-it-py
 multidict==6.7.1
     # via
-    #   -r multidict.in
-    #   -r runtime-deps.in
+    #   -r requirements/multidict.in
+    #   -r requirements/runtime-deps.in
     #   yarl
 mypy==1.19.1 ; implementation_name == "cpython"
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 mypy-extensions==1.1.0
     # via mypy
 nodeenv==1.10.0
@@ -133,25 +133,25 @@ packaging==26.0
 pathspec==1.0.4
     # via mypy
 pip-tools==7.5.2
-    # via -r dev.in
+    # via -r requirements/dev.in
 pkgconfig==1.5.5
-    # via -r test-common.in
+    # via -r requirements/test-common.in
 platformdirs==4.5.1
     # via virtualenv
 pluggy==1.6.0
     # via
     #   pytest
     #   pytest-cov
 pre-commit==4.5.1
-    # via -r lint.in
+    # via -r requirements/lint.in
 propcache==0.4.1
     # via
-    #   -r runtime-deps.in
+    #   -r requirements/runtime-deps.in
     #   yarl
 proxy-py==2.4.10
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 pycares==5.0.1
     # via aiodns
 pycparser==3.0
@@ -173,30 +173,30 @@ pyproject-hooks==1.2.0
     #   pip-tools
 pytest==9.0.2
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
     #   pytest-codspeed
     #   pytest-cov
     #   pytest-mock
     #   pytest-xdist
 pytest-codspeed==4.2.0
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 pytest-cov==7.0.0
-    # via -r test-common.in
+    # via -r requirements/test-common.in
 pytest-mock==3.15.1
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 pytest-xdist==3.8.0
-    # via -r test-common.in
+    # via -r requirements/test-common.in
 python-dateutil==2.9.0.post0
     # via freezegun
 python-on-whales==0.80.0
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 pyyaml==6.0.3
     # via pre-commit
 requests==2.32.5
@@ -206,16 +206,16 @@ requests==2.32.5
 rich==14.3.1
     # via pytest-codspeed
 setuptools-git==1.2
-    # via -r test-common.in
+    # via -r requirements/test-common.in
 six==1.17.0
     # via python-dateutil
 slotscheck==0.19.1
-    # via -r lint.in
+    # via -r requirements/lint.in
 snowballstemmer==3.0.1
     # via sphinx
 sphinx==8.1.3
     # via
-    #   -r doc.in
+    #   -r requirements/doc.in
     #   sphinxcontrib-spelling
     #   sphinxcontrib-towncrier
 sphinxcontrib-applehelp==2.0.0
@@ -231,9 +231,9 @@ sphinxcontrib-qthelp==2.0.0
 sphinxcontrib-serializinghtml==2.0.0
     # via sphinx
 sphinxcontrib-spelling==8.0.2 ; platform_system != "Windows"
-    # via -r doc-spelling.in
+    # via -r requirements/doc-spelling.in
 sphinxcontrib-towncrier==0.5.0a0
-    # via -r doc.in
+    # via -r requirements/doc.in
 tomli==2.3.0
     # via
     #   build
@@ -246,15 +246,15 @@ tomli==2.3.0
     #   towncrier
 towncrier==25.8.0
     # via
-    #   -r doc.in
+    #   -r requirements/doc.in
     #   sphinxcontrib-towncrier
 trustme==1.2.1 ; platform_machine != "i686"
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 typing-extensions==4.15.0 ; python_version < "3.13"
     # via
-    #   -r runtime-deps.in
+    #   -r requirements/runtime-deps.in
     #   aiosignal
     #   cryptography
     #   exceptiongroup
@@ -271,22 +271,22 @@ urllib3==2.6.3
     # via requests
 uvloop==0.21.0 ; platform_system != "Windows"
     # via
-    #   -r base.in
-    #   -r lint.in
+    #   -r requirements/base.in
+    #   -r requirements/lint.in
 valkey==6.1.1
-    # via -r lint.in
+    # via -r requirements/lint.in
 virtualenv==20.36.1
     # via pre-commit
 wait-for-it==2.3.0
-    # via -r test-common.in
+    # via -r requirements/test-common.in
 wheel==0.46.3
     # via pip-tools
 yarl==1.22.0
-    # via -r runtime-deps.in
+    # via -r requirements/runtime-deps.in
 zlib-ng==1.0.0
     # via
-    #   -r lint.in
-    #   -r test-common.in
+    #   -r requirements/lint.in
+    #   -r requirements/test-common.in
 
 # The following packages are considered to be unsafe in a requirements file:
 pip==26.0