v3.10.1

Compare Source

Bug Fixes

• raise ValueError if api_endpoint is unset when using AnonymousCredentials in AsyncGrpcClient. (#​1778) (17828ea316872938a98a6360b10a2495c54bbbcb)

v3.10.0

Compare Source

Features

• [Bucket Encryption Enforcement] add support for bucket encryption enforcement config (#​1742) (2a6e8b00e4e6ff57460373f8e628fd363be47811)

Perf Improvments

• [Rapid Buckets Reads] Use raw proto access for read resumption strategy (#​1764) (14cfd61ce35365a409650981239ef742cdf375fb)
• [Rapid Buckets Benchmarks] init mp pool & grpc client once, use os.sched_setaffinity (#​1751) (a9eb82c1b9b3c6ae5717d47b76284ed0deb5f769)
• [Rapid Buckets Writes] don't flush at every append, results in bad perf (#​1746) (ab62d728ac7d7be3c4fe9a99d72e35ead310805a)

Bug Fixes

• [Windows] skip downloading blobs whose name contain ":" eg: C: D: etc when application runs in Windows. (#​1774) (558198823ed51918db9c0137715d1e7f5b593975)
• [Path Traversal] Prevent path traversal in download_many_to_path (#​1768) (700fec3bf7aa37bd5ea4b163cc3f9e8e6892bd5a)
• [Rapid Buckets] pass token correctly, '&' instead of ',' (#​1756) (d8dd1e074d2431de9b45e0103181dce749a447a0)

v25.2.0: Gunicorn 25.2.0

Compare Source

New Features

• Fast HTTP Parser (gunicorn_h1c 0.4.1): Integrate new exception types and limit parameters from gunicorn_h1c 0.4.1 for both WSGI and ASGI workers
  • Requires gunicorn_h1c >= 0.4.1 for http_parser='fast'
  • Falls back to Python parser in auto mode if version not met
  • Proper HTTP status codes for limit errors (414, 431)

Bug Fixes

• uWSGI Async Workers: Fix InvalidUWSGIHeader: incomplete header error when using gevent or gthread workers with uwsgi protocol behind nginx. (#​3552, PR #​3554)

• FileWrapper Iterator Protocol: Add __iter__ and __next__ methods to FileWrapper for full PEP 3333 compliance. (#​3396, PR #​3550)

Performance

• ASGI HTTP Parser Optimizations: Improve ASGI worker HTTP parsing performance
  • Read chunks in 64-byte blocks instead of 1 byte at a time
  • Reuse BytesIO buffers with truncate/seek instead of creating new objects
  • Use bytearray.find() directly instead of converting to bytes first
  • Use index-based iteration for header parsing instead of list.pop(0)

v5.3.0

Compare Source

Minor Changes

• Use new ECMA features in code. (by @​alexander-akait in #​713)

• Added propTypes to client components. (by @​alexander-akait in #​713)

Patch Changes

• Fix a race condition in writeStats that could lead to incorrect content in stats.json. (by @​alexander-akait in #​713)

• Apply prettier and update dependencies. (by @​alexander-akait in #​713)

v3.1.7

Compare Source

Released 2026-03-23

• parse_list_header preserves partially quoted items, discards empty
  items, and returns empty for unclosed quoted values. :pr:3128
• WWWAuthenticate.to_header does not produce a trailing space when there
  are no parameters. :issue:3127
• Transfer-Encoding is parsed as a set. :pr:3134
• Request.host, get_host, and host_is_trusted validate the
  characters of the value. An empty value is no longer allowed. A Unix socket
  server address is ignored. The trusted_list argument to
  host_is_trusted is optional. :pr:3113
• Fix multipart form parser handling of newline at boundary. :issue:3088
• Response.make_conditional sets the Accept-Ranges header even if it
  is not a satisfiable range request. :issue:3108
• merge_slashes merges any number of consecutive slashes. :issue:3121