benoitc/gunicorn 25.3.0 on GitHub

Bug Fixes

HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2
ASGI requests, causing JSON parsing errors with "Extra data" messages
(#3558)
ASGI Chunked EOF Handling: Add finish() method to callback parser to handle
chunked encoding edge case where connection closes before final CRLF after zero-chunk
HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string
instead of list syntax (#3561)
Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112
(#3556)
Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented,
instead of using default maximum. Works with both Python and fast C parser.
(#3563)

ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
- Reject duplicate Content-Length headers
- Reject requests with both Content-Length and Transfer-Encoding
- Reject chunked transfer encoding in HTTP/1.0
- Reject stacked chunked encoding
- Validate Transfer-Encoding values
- Strict chunk size validation

Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property
and InvalidChunkExtension validation for bare CR rejection
ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser
Docker Images: Update to Python 3.14