build(deps): bump gunicorn from 26.0.0 to 26.1.0 in /backend

[dependabot]

Bumps gunicorn from 26.0.0 to 26.1.0.

Release notes

Sourced from gunicorn's releases.

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [ are treated as patterns, so ui/*/config.json watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and ** recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (#1643, #3662).

Security

• Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now require the first clean release; pytest and httpx were unpinned and now carry floors. The tornado example pinned tornado<6, which was both the source of several advisories and older than the >=6.5.0 the tornado worker needs, so the example could not run as pinned.

Bug Fixes

• SIGHUP did not reload the logger configuration: Arbiter.reload() re-read the configuration file but kept using the logger built at startup, calling only reopen_files() on its existing handlers. Changes to logconfig, logconfig_dict, logconfig_json and loglevel were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (#3353).

• Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises ChunkMissingTerminator (#3382, #3685).

• --spew crashed on dynamically generated code: the trace hook indexed the 2-tuple returned by inspect.getsourcelines() by line number rather than indexing the list of lines, so a frame with no __file__ raised AttributeError: 'int' object has no attribute 'rstrip' on line 1 and

... (truncated)

Commits

• 71b59a7 Merge pull request #3698 from benoitc/fix/docker-health-check-readerror
• 48287de test: catch every transport error in the docker health check
• 3110e8c Merge pull request #3696 from benoitc/docs/roadmap
• cc56c41 Merge pull request #3693 from benoitc/release/26.1.0
• 5cf1f16 docs: surface the roadmap on the site home page
• 7e35f72 docs: add FastCGI to the roadmap and point items at Ideas
• 18ddc58 docs: drop the framework and reverse-proxy non-goals from the roadmap
• 1ecae56 docs: add a roadmap and make the chat easy to find
• ca412e3 docs: sync the Latest changelog page with 26.1.0
• 640936f docs: note the dependency security work in 26.1.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)