Bump the uv group across 8 directories with 5 updates

[dependabot]

Bumps the uv group with 3 updates in the / directory: python-socketio, joserfc and ujson.
Bumps the uv group with 3 updates in the /backend directory: python-socketio, azure-identity and ujson.
Bumps the uv group with 1 update in the /platform-service directory: ujson.
Bumps the uv group with 1 update in the /unstract/connectors directory: ujson.
Bumps the uv group with 1 update in the /unstract/filesystem directory: ujson.
Bumps the uv group with 1 update in the /unstract/sdk1 directory: ujson.
Bumps the uv group with 1 update in the /unstract/tool-registry directory: ujson.
Bumps the uv group with 2 updates in the /workers directory: python-socketio and ujson.

Updates python-socketio from 5.16.1 to 5.16.2

Release notes

Sourced from python-socketio's releases.

Release 5.16.2

See CHANGES.md for release notes.

Changelog

Sourced from python-socketio's changelog.

python-socketio change log

Release 5.16.3 - 2026-06-15

• Catch all exceptions in redis and rabbitmq client managers #1581 (commit)

Release 5.16.2 - 2026-05-21

• Prevent unnecessary resource allocations #1574 (commit)
• Add zizmor to CI builds #1570 (commit)

Release 5.16.1 - 2026-02-06

• Use configured JSON module in managers #1549 (commit)
• Admin UI fixes: remove duplicate tasks, report transport upgrades (commit)
• Switch to Furo documentation template (commit)
• Add Python free-threading to CI #1554 (commit)

Release 5.16.0 - 2025-12-24

• Address deprecation warnings (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 5.15.1 - 2025-12-16

• Restore support multiple arguments via pubsub emits #1540 (commit)

Release 5.15.0 - 2025-11-22

• Retry initial Redis connection #1534 ([commit #1](miguelgrinberg/python-socketio@1e903e1) [commit #2](miguelgrinberg/python-socketio@5e898a9))
• Correctly regenerate RabbitMQ binding after a connection failure #1516 (commit) (thanks Gritty_dev!)
• Support ext_type in the MsgPackPacket class #1521 (commit)
• Support sending bytesarrays when using pub/sub managers (commit)
• Fix typos in documentation #1520 (commit) (thanks Lê Nam Khánh!)
• Improvements to the logging documentation (commit)

Release 5.14.3 - 2025-10-29

• Support Python's native ConnectionRefusedError exception to reject a connection #1515 (commit)
• Push binary data to the aiopika client manager #1514 (commit)

Release 5.14.2 - 2025-10-15

• Restore binary message support in message queue setups #1509 (commit)
• Fix formatting of client connection error #1507 (commit)
• Add 3.14 and pypy-3.11 CI tasks (commit)
• Improve documentation of the BaseManager.get_participants() method (commit)

Release 5.14.1 - 2025-10-02

... (truncated)

Commits

• 6e2b717 Release 5.16.2
• cb65829 update python-engineio version
• ca140fe prevent unnecessary resource allocation (#1574)
• b29beef tox configuration
• e898130 Bump ujson from 5.4.0 to 5.12.1 in /examples/server/sanic (#1573) #nolog
• 05c32f5 Bump qs and body-parser in /examples/server/javascript (#1572) #nolog
• 287dc67 Bump qs and body-parser in /examples/client/javascript (#1571) #nolog
• 664dc27 add zizmor to ci (#1570)
• 14c6236 Bump django in /examples/server/wsgi/django_socketio (#1566) #nolog
• 29b2e5c Bump aiohttp from 3.13.3 to 3.13.4 in /examples/server/aiohttp (#1565) #nolog
• Additional commits viewable in compare view

Updates joserfc from 1.6.5 to 1.6.8

Release notes

Sourced from joserfc's releases.

1.6.8

• Reject empty OctKey.

Full Changelog: authlib/joserfc@1.6.7...1.6.8

1.6.7

   🐞 Bug Fixes

• jws: Validate payload size for b64=false  -  by @​lepture (4d4ea)
• typing: Accept any Collection for algorithms, not just list  -  by @​jonathangreen (102a7)
• typing: Use cast for type hints  -  by @​lepture (75d9f)

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.6.8

Released on May 27, 2026

• Reject empty OctKey.

1.6.7

Released on May 23, 2026

• Update for type hints.

1.6.6

Released on May 18, 2026

• JWS: validate payload size when b64=false.

Commits

• ea1d9e3 chore: release 1.6.8
• 86d0091 Reject empty oct key material and empty HMAC keys at sign/verify entry
• 1e5b94d chore: release 1.6.7
• 75d9f95 fix(typing): use cast for type hints
• 6d24037 Merge pull request #98 from jonathangreen/algorithms-accept-collection
• 102a7a7 fix(typing): accept any Collection for algorithms, not just list
• 8b869e8 chore: release 1.6.6
• 00d599b chore: update actions
• 9186561 Merge pull request #97 from authlib/fix-b64
• 4d4ea2e fix(jws): validate payload size for b64=false
• Additional commits viewable in compare view

Updates python-engineio from 4.13.1 to 4.13.3

Release notes

Sourced from python-engineio's releases.

Release 4.13.3

See CHANGES.md for release notes.

Release 4.13.2

See CHANGES.md for release notes.

Changelog

Sourced from python-engineio's changelog.

python-engineio change log

Release 4.13.3 - 2026-06-20

• Make sure client disconnects when write loop exits #455 (commit)
• Address flaky unit test #444 (commit)
• Stop using codecov service, since it has been failing for a long time (commit)

Release 4.13.2 - 2026-05-21

• Prevent unnecessary resource allocations #441 (commit)
• Add zizmor to CI builds #437 (commit)

Release 4.13.1 - 2026-02-06

• Document that a process can have only one custom JSON module (commit)
• Switch to Furo documentation template (commit)

Release 4.13.0 - 2025-12-24

• Apply escaping rules when parsing cookie values (commit)
• Several minor improvements to the aiohttp integration #419 (commit) (thanks PaulWasTaken!)
• Clarify logging behavior in documentation #421 (commit) (thanks ZipFile!)
• Address deprecation warnings #422 (commit)
• Add 3.14 and pypy-3.11 CI builds (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 4.12.3 - 2025-09-28

• Reset client queue upon disconnection #414 (commit)
• Support ['*'] in addition to '*' in the cors_allowed_origins option #410 (commit) (thanks Wu Clan!)

Release 4.12.2 - 2025-06-04

• Support new monkey-patched gevent Queue class in the client #403 (commit)
• Better support of the ASGI spec when interpreting WebSocket events #405 (commit) (thanks Eric Zhang!)

Release 4.12.1 - 2025-05-11

• Accept empty binary values in the async server #404 (commit)
• Add SPDX license identifier #401 (commit) (thanks Marc Mueller!)

Release 4.12.0 - 2025-04-12

• Optimize packet parsing to avoid unnecessary calls to JSON parser #399 (commit)
• Pass environ as a second argument to callable option cors_allowed_origins #398 (commit) (thanks wft-swas!)

Release 4.11.2 - 2024-12-29

• Fix incorrect disconnection reason reported when browser page is closed (commit)

... (truncated)

Commits

• a53d58c Release 4.13.3
• 9e72608 Remove failing coverage.py service
• 7517473 Make sure client disconnects when write loop exists (Fixes #454) (#455)
• 6902ffc Bump ws, engine.io and engine.io-client in /examples/client/javascript (#453)...
• 883c8f4 Bump tornado from 6.5.5 to 6.5.7 in /examples/server/tornado (#451)
• 0d6654e Bump aiohttp from 3.14.0 to 3.14.1 in /examples/server/aiohttp (#450) #nolog
• 588a4db Bump qs and express in /examples/server/javascript (#447) #nolog
• 28ed709 Bump aiohttp from 3.13.4 to 3.14.0 in /examples/server/aiohttp (#446) #nolog
• d5ef0e4 Bump qs and express in /examples/client/javascript (#445) #nolog
• ed46b24 Bump ws, engine.io and engine.io-client in /examples/client/javascript (#442)...
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733) @​timfel

Changed

• Move metadata from setup.cfg to pyproject.toml (#736) @​hugovk

Fixed

• Tighten UTF-8 validation for ujson.dumps(b"...", reject_bytes=False) (169eaf36b1116fece5034ee79a7a0ef3f6deedcf) @​bwoodsend
• Replace generated version.h with macro (#735) @​hugovk

Commits

• 1a23a68 Create manylinux2014 wheels (#745)
• bd943e8 Build separate manylinux2014 + modern wheels
• 87ae2df Create manylinux2014 wheels
• 209371e Verify expected number of dists (#743)
• 6392258 Also check SHA of wheels in case manylinux version changes
• a00edea Verify expected number of dists
• e24aeb7 Fix utf-8 test for graalpy
• 9122ebe Replace pre-commit with prek to fix deprecation warning (#744)
• 0bbf9a3 Add support for Python 3.15 (#742)
• 90ddea2 Replace pre-commit with prek to fix deprecation warning
• Additional commits viewable in compare view

Updates python-socketio from 5.16.1 to 5.16.2

Release notes

Sourced from python-socketio's releases.

Release 5.16.2

See CHANGES.md for release notes.

Changelog

Sourced from python-socketio's changelog.

python-socketio change log

Release 5.16.3 - 2026-06-15

• Catch all exceptions in redis and rabbitmq client managers #1581 (commit)

Release 5.16.2 - 2026-05-21

• Prevent unnecessary resource allocations #1574 (commit)
• Add zizmor to CI builds #1570 (commit)

Release 5.16.1 - 2026-02-06

• Use configured JSON module in managers #1549 (commit)
• Admin UI fixes: remove duplicate tasks, report transport upgrades (commit)
• Switch to Furo documentation template (commit)
• Add Python free-threading to CI #1554 (commit)

Release 5.16.0 - 2025-12-24

• Address deprecation warnings (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 5.15.1 - 2025-12-16

• Restore support multiple arguments via pubsub emits #1540 (commit)

Release 5.15.0 - 2025-11-22

• Retry initial Redis connection #1534 ([commit #1](miguelgrinberg/python-socketio@1e903e1) [commit #2](miguelgrinberg/python-socketio@5e898a9))
• Correctly regenerate RabbitMQ binding after a connection failure #1516 (commit) (thanks Gritty_dev!)
• Support ext_type in the MsgPackPacket class #1521 (commit)
• Support sending bytesarrays when using pub/sub managers (commit)
• Fix typos in documentation #1520 (commit) (thanks Lê Nam Khánh!)
• Improvements to the logging documentation (commit)

Release 5.14.3 - 2025-10-29

• Support Python's native ConnectionRefusedError exception to reject a connection #1515 (commit)
• Push binary data to the aiopika client manager #1514 (commit)

Release 5.14.2 - 2025-10-15

• Restore binary message support in message queue setups #1509 (commit)
• Fix formatting of client connection error #1507 (commit)
• Add 3.14 and pypy-3.11 CI tasks (commit)
• Improve documentation of the BaseManager.get_participants() method (commit)

Release 5.14.1 - 2025-10-02

... (truncated)

Commits

• 6e2b717 Release 5.16.2
• cb65829 update python-engineio version
• ca140fe prevent unnecessary resource allocation (#1574)
• b29beef tox configuration
• e898130 Bump ujson from 5.4.0 to 5.12.1 in /examples/server/sanic (#1573) #nolog
• 05c32f5 Bump qs and body-parser in /examples/server/javascript (#1572) #nolog
• 287dc67 Bump qs and body-parser in /examples/client/javascript (#1571) #nolog
• 664dc27 add zizmor to ci (#1570)
• 14c6236 Bump django in /examples/server/wsgi/django_socketio (#1566) #nolog
• 29b2e5c Bump aiohttp from 3.13.3 to 3.13.4 in /examples/server/aiohttp (#1565) #nolog
• Additional commits viewable in compare view

Updates python-engineio from 4.13.1 to 4.13.3

Release notes

Sourced from python-engineio's releases.

Release 4.13.3

See CHANGES.md for release notes.

Release 4.13.2

See CHANGES.md for release notes.

Changelog

Sourced from python-engineio's changelog.

python-engineio change log

Release 4.13.3 - 2026-06-20

• Make sure client disconnects when write loop exits #455 (commit)
• Address flaky unit test #444 (commit)
• Stop using codecov service, since it has been failing for a long time (commit)

Release 4.13.2 - 2026-05-21

• Prevent unnecessary resource allocations #441 (commit)
• Add zizmor to CI builds #437 (commit)

Release 4.13.1 - 2026-02-06

• Document that a process can have only one custom JSON module (commit)
• Switch to Furo documentation template (commit)

Release 4.13.0 - 2025-12-24

• Apply escaping rules when parsing cookie values (commit)
• Several minor improvements to the aiohttp integration #419 (commit) (thanks PaulWasTaken!)
• Clarify logging behavior in documentation #421 (commit) (thanks ZipFile!)
• Address deprecation warnings #422 (commit)
• Add 3.14 and pypy-3.11 CI builds (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 4.12.3 - 2025-09-28

• Reset client queue upon disconnection #414 (commit)
• Support ['*'] in addition to '*' in the cors_allowed_origins option #410 (commit) (thanks Wu Clan!)

Release 4.12.2 - 2025-06-04

• Support new monkey-patched gevent Queue class in the client #403 (commit)
• Better support of the ASGI spec when interpreting WebSocket events #405 (commit) (thanks Eric Zhang!)

Release 4.12.1 - 2025-05-11

• Accept empty binary values in the async server #404 (commit)
• Add SPDX license identifier #401 (commit) (thanks Marc Mueller!)

Release 4.12.0 - 2025-04-12

• Optimize packet parsing to avoid unnecessary calls to JSON parser #399 (commit)
• Pass environ as a second argument to callable option cors_allowed_origins #398 (commit) (thanks wft-swas!)

Release 4.11.2 - 2024-12-29

• Fix incorrect disconnection reason reported when browser page is closed (commit)

... (truncated)

Commits

• a53d58c Release 4.13.3
• 9e72608 Remove failing coverage.py service
• 7517473 Make sure client disconnects when write loop exists (Fixes #454) (#455)
• 6902ffc Bump ws, engine.io and engine.io-client in /examples/client/javascript (#453)...
• 883c8f4 Bump tornado from 6.5.5 to 6.5.7 in /examples/server/tornado (#451)
• 0d6654e Bump aiohttp from 3.14.0 to 3.14.1 in /examples/server/aiohttp (#450) #nolog
• 588a4db Bump qs and express in /examples/server/javascript (#447) #nolog
• 28ed709 Bump aiohttp from 3.13.4 to 3.14.0 in /examples/server/aiohttp (#446) #nolog
• d5ef0e4 Bump qs and express in /examples/client/javascript (#445) #nolog
• ed46b24 Bump ws, engine.io and engine.io-client in /examples/client/javascript (#442)...
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733) @​timfel

Changed

• Move metadata from setup.cfg to pyproject.toml (#736) @​hugovk

Fixed

• Tighten UTF-8 validation for ujson.dumps(b"...", reject_bytes=False) (169eaf36b1116fece5034ee79a7a0ef3f6deedcf) @​bwoodsend
• Replace generated version.h with macro (#735) @​hugovk

Commits

• 1a23a68 Create manylinux2014 wheels (#745)
• bd943e8 Build separate manylinux2014 + modern wheels
• 87ae2df Create manylinux2014 wheels
• 209371e Verify expected number of dists (#743)
• 6392258 Also check SHA of wheels in case manylinux version changes
• a00edea Verify expected number of dists
• e24aeb7 Fix utf-8 test for graalpy
• 9122ebe Replace pre-commit with prek to fix deprecation warning (#744)
• 0bbf9a3 Add support for Python 3.15 (#742)
• 90ddea2 Replace pre-commit with prek to fix deprecation warning
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733) @​timfel

Changed

• Move metadata from setup.cfg to pyproject.toml (#736) @​hugovk

Fixed

• Tighten UTF-8 validation for ujson.dumps(b"...", reject_bytes=False) (169eaf36b1116fece5034ee79a7a0ef3f6deedcf) @​bwoodsend
• Replace generated version.h with macro (#735) @​hugovk

Commits

• 1a23a68 Create manylinux2014 wheels (#745)
• bd943e8 Build separate manylinux2014 + modern wheels
• 87ae2df Create manylinux2014 wheels
• 209371e Verify expected number of dists (#743)
• 6392258 Also check SHA of wheels in case manylinux version changes
• a00edea Verify expected number of dists
• e24aeb7 Fix utf-8 test for graalpy
• 9122ebe Replace pre-commit with prek to fix deprecation warning (#744)
• 0bbf9a3 Add support for Python 3.15 (#742)
• 90ddea2 Replace pre-commit with prek to fix deprecation warning
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733) @​timfel

Changed

• Move metadata from setup.cfg to pyproject.toml (#736) @​hugovk

Fixed

• Tighten UTF-8 validation for ujson.dumps(b"...", reject_bytes=False) (169eaf36b1116fece5034ee79a7a0ef3f6deedcf) @​bwoodsend
• Replace generated version.h with macro (#735) @​hugovk

Commits

• 1a23a68 Create manylinux2014 wheels (#745)
• bd943e8 Build separate manylinux2014 + modern wheels
• 87ae2df Create manylinux2014 wheels
• 209371e Verify expected number of dists (#743)
• 6392258 Also check SHA of wheels in case manylinux version changes
• a00edea Verify expected number of dists
• e24aeb7 Fix utf-8 test for graalpy
• 9122ebe Replace pre-commit with prek to fix deprecation warning (#744)
• 0bbf9a3 Add support for Python 3.15 (#742)
• 90ddea2 Replace pre-commit with prek to fix deprecation warning
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733) @​timfel

Changed

• Move metadata from setup.cfg to pyproject.toml (#736) @​hugovk

Fixed

• Tighten UTF-8 validation for ujson.dumps(b"...", reject_bytes=False) (169eaf36b1116fece5034ee79a7a0ef3f6deedcf) @​bwoodsend
• Replace generated version.h with macro (#735) @​hugovk

Commits

• 1a23a68 Create manylinux2014 wheels (#745)
• bd943e8 Build separate manylinux2014 + modern wheels
• 87ae2df Create manylinux2014 wheels
• 209371e Verify expected number of dists (#743)
• 6392258 Also check SHA of wheels in case manylinux version changes
• a00edea Verify expected number of dists
• e24aeb7 Fix utf-8 test for graalpy
• 9122ebe Replace pre-commit with prek to fix deprecation warning (#744)
• 0bbf9a3 Add support for Python 3.15 (#742)
• 90ddea2 Replace pre-commit with prek to fix deprecation warning
• Additional commits viewable in compare view

Updates ujson from 5.12.1 to 5.13.0

Release notes

Sourced from ujson's releases.

5.13.0

Added

• Create manylinux2014 wheels (#745) @​hugovk
• Add support for Python 3.15 (#742) @​hugovk
• Disable global interpreter lock for freethreading (#737) @​bwoodsend
• Re-enable building GraalPy wheels on macOS arm64 (#733)...

  Description has been truncated

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

Automated dependabot bump of 5 packages across 8 directories. All updates stay within the same major version and are fully backward-compatible patch/minor releases.

• python-socketio pinned to ==5.9.0 in backend/pyproject.toml is bumped to ==5.16.2 — a large skip over 7 minor releases, all of which are bug-fix and maintenance releases within the stable 5.x API surface.
• ujson bumped from 5.12.1 → 5.13.0 across 7 lock files; joserfc from 1.6.5 → 1.6.8; azure-identity from 1.16.0 → 1.16.1; python-engineio (transitive) from 4.13.1 → 4.13.3.

Confidence Score: 5/5

Safe to merge — all updates are patch/minor releases within stable major versions with no documented breaking API changes.

All five packages stay within their current major version. The largest jump is python-socketio from 5.9.0 to 5.16.2 in the backend, but the 5.x changelog shows only bug fixes and maintenance work with no breaking API surface changes. Lock files across all 8 directories are consistently updated.

No files require special attention. The backend/pyproject.toml pin change for python-socketio (5.9.0→5.16.2) is the largest delta, but the 5.x line is backward-compatible.

Important Files Changed

Filename	Overview
backend/pyproject.toml	python-socketio pinned from ==5.9.0 to ==5.16.2, azure-identity from 1.16.0 to 1.16.1 — all within stable 5.x/1.x lines
workers/pyproject.toml	python-socketio lower bound raised from >=5.9.0 to >=5.16.2, ujson updated in lock file
backend/uv.lock	Lock file updated consistently with pyproject.toml changes for python-socketio, azure-identity, python-engineio, and ujson
uv.lock	Root lock updated for joserfc 1.6.5→1.6.8, python-socketio 5.16.1→5.16.2, python-engineio 4.13.1→4.13.3, ujson 5.12.1→5.13.0
workers/uv.lock	Lock file updated for python-socketio and ujson in the workers directory
platform-service/uv.lock	ujson 5.12.1→5.13.0 lock update
unstract/connectors/uv.lock	ujson 5.12.1→5.13.0 lock update
unstract/filesystem/uv.lock	ujson 5.12.1→5.13.0 lock update
unstract/sdk1/uv.lock	ujson 5.12.1→5.13.0 lock update
unstract/tool-registry/uv.lock	ujson 5.12.1→5.13.0 lock update

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Root
        A[python-socketio 5.16.1 to 5.16.2]
        B[joserfc 1.6.5 to 1.6.8]
        C[ujson 5.12.1 to 5.13.0]
        D[python-engineio 4.13.1 to 4.13.3 transitive]
    end
    subgraph Backend
        E[python-socketio 5.9.0 to 5.16.2]
        F[azure-identity 1.16.0 to 1.16.1]
        G[ujson 5.12.1 to 5.13.0]
    end
    subgraph Workers
        I[python-socketio min 5.9.0 to 5.16.2]
        J[ujson 5.12.1 to 5.13.0]
    end
    subgraph Other
        K[platform-service ujson]
        L[connectors ujson]
        M[filesystem ujson]
        N[sdk1 ujson]
        O[tool-registry ujson]
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    subgraph Root
        A[python-socketio 5.16.1 to 5.16.2]
        B[joserfc 1.6.5 to 1.6.8]
        C[ujson 5.12.1 to 5.13.0]
        D[python-engineio 4.13.1 to 4.13.3 transitive]
    end
    subgraph Backend
        E[python-socketio 5.9.0 to 5.16.2]
        F[azure-identity 1.16.0 to 1.16.1]
        G[ujson 5.12.1 to 5.13.0]
    end
    subgraph Workers
        I[python-socketio min 5.9.0 to 5.16.2]
        J[ujson 5.12.1 to 5.13.0]
    end
    subgraph Other
        K[platform-service ujson]
        L[connectors ujson]
        M[filesystem ujson]
        N[sdk1 ujson]
        O[tool-registry ujson]
    end

Loading

_{Reviews (3): Last reviewed commit: "Bump the uv group across 8 directories w..." | Re-trigger Greptile}

[greptile-apps]

Unexpectedly large protobuf minimum constraint jump

The lower bound on protobuf jumped from >=4.25.0 to >=7.35.1, skipping three major versions (4 → 5 → 6 → 7). Each major version of protobuf introduced breaking changes in the Python runtime (e.g. descriptor-pool access, symbol database APIs, enforcement of generated-code compatibility). More concretely, this constraint change is already forcing weaviate-client down from 4.21.0 to 4.16.2 in unstract/workflow-execution/uv.lock, and is pulling protobuf from 5.29.6 to 7.35.1 in platform-service and runner — environments where the serialized .proto message format has not been tested against 7.x.

Prompt To Fix With AI

This is a comment left during a code review.
Path: unstract/flags/pyproject.toml
Line: 8

Comment:
**Unexpectedly large protobuf minimum constraint jump**

The lower bound on `protobuf` jumped from `>=4.25.0` to `>=7.35.1`, skipping three major versions (4 → 5 → 6 → 7). Each major version of protobuf introduced breaking changes in the Python runtime (e.g. descriptor-pool access, symbol database APIs, enforcement of generated-code compatibility). More concretely, this constraint change is already forcing `weaviate-client` down from 4.21.0 to 4.16.2 in `unstract/workflow-execution/uv.lock`, and is pulling `protobuf` from 5.29.6 to 7.35.1 in `platform-service` and `runner` — environments where the serialized `.proto` message format has not been tested against 7.x.

How can I resolve this? If you propose a fix, please make it concise.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Superseded by #2161.