chore(deps): bump the pip group across 1 directory with 2 updates

[dependabot]

Bumps the pip group with 2 updates in the /backend directory: python-socketio and python-multipart.

Updates python-socketio from 5.10.0 to 5.14.0

Release notes

Sourced from python-socketio's releases.

Release 5.14.0

See CHANGES.md for release notes.

Release 5.13.0

See CHANGES.md for release notes.

Release 5.12.1

See CHANGES.md for release notes.

Release 5.12.0

See CHANGES.md for release notes.

Release 5.11.4

See CHANGES.md for release notes.

Release 5.11.3

See CHANGES.md for release notes.

Release 5.11.2

See CHANGES.md for release notes.

Release 5.11.1

See CHANGES.md for release notes.

Release 5.11.0

See CHANGES.md for release notes.

Changelog

Sourced from python-socketio's changelog.

python-socketio change log

Release 5.14.1 - 2025-10-02

• Restore support for rediss:// URLs, and add support for valkeys:// as well (commit)
• Add support for Redis connections using unix sockets #1503 (commit) (thanks Darren Chang!)

Release 5.14.0 - 2025-09-30

• Replace pickle with json in message queue communications #1502 (commit)
• Add support for Valkey in the Redis client managers #1488 (commit) (thanks phi-friday!)
• Keep track of which namespaces failed to connect #1496 (commit)
• Fixed transport property of the simple clients to be a string as documented #1499 (commit)
• SimpleClient.call does not raise TimeoutError on timeout #1501 (commit) (thanks James Thistlewood!)
• Wait for client to end background tasks on disconnect #1500 (commit)
• Better error logging for the Redis managers #1479 (commit) (thanks Eugnee!)
• Channel was not properly initialized in several pubsub client managers #1476 (commit) (thanks Eugnee!)
• Add message queue deployment recommendations for security (commit)
• Add missing async on session examples for the async server #1465 (commit) (thanks Func!)
• Add SPDX license identifier #1453 (commit) (thanks Marc Mueller!)

Release 5.13.0 - 2025-04-12

• Eliminate race conditions on disconnect #1441 (commit)
• Preserve exception context in Client.connect and AsyncClient.connect #1450 (commit) (thanks Tim Van Baak!)
• Allow custom client subclasses to be used in SimpleClient and AsyncSimpleClient #1432 (commit)
• Add support for Redis Sentinel URLs in RedisManager and AsyncRedisManager #1448 (commit)
• Remove incorrect reference to an asyncio installation extra in documentation #1449 (commit)

Release 5.12.1 - 2024-12-29

• Fix admin instrumentation support of disconnect reasons #1423 (commit)
• Stop using deprecated datetime functions (commit)
• Enable admin instrumentation by default in WSGI and ASGI examples (commit)
• Fixed broken gevent URL in documentation #1427 (commit) (thanks Carlos Guerrero!)

Release 5.12.0 - 2024-12-18

• Added a reason argument to the disconnect handler #1422 (commit)
• Prevented starting multiple tasks for reconnection #1369 (commit) (thanks humayunsr!)
• Fixed AsyncClient::wait() unexpected return after success reconnect #1407 (commit) (thanks Arseny!)
• Removed old constructs from old and unsupported Python versions (commit)
• Removed dependency on unittest.TestCase base class in unit tests (commit)
• Adopted pyenv-asyncio for async unit tests (commit)
• Adopted unittest.mock.AsyncMock in async unit tests (commit)
• Fix typo with AsyncClient.connect example #1403 (commit) (thanks Peter Bierma!)
• Documentation typo #1421 (commit) (thanks Masen Furer!)
• Renamed flask-socketio references to python-socketio in documentation #1377 (commit)
• Added Python 3.13 CI builds (commit)

... (truncated)

Commits

• 400200e Release 5.14.0
• 53f6be0 Replace pickle with json (#1502)
• a59c6f5 Fix: SimpleClient.call does not raise TimeoutError on timeout (#1501)
• f61e0be wait for client to end background tasks on disconnect (#1500)
• 23556fb Fixed transport property of the simple clients to be a string as documented (...
• e59acf1 Address failures of test suite on Mac (#1497)
• 36a8922 Add support for valkey in the Redis client managers (#1488)
• 5dc2aea keep track of which namespaces failed to connect (#1496)
• b3da354 Add message queue deployment recommendations
• 3625fe8 Bump eventlet from 0.35.2 to 0.40.3 in /examples/server/wsgi (#1491) #nolog
• Additional commits viewable in compare view

Updates python-multipart from 0.0.6 to 0.0.18

Release notes

Sourced from python-multipart's releases.

Version 0.0.18

What's Changed

• Hard break if found data after last boundary on MultipartParser by @​Kludex in Kludex/python-multipart#189

---

Full Changelog: Kludex/python-multipart@0.0.17...0.0.18

Version 0.0.17

What's Changed

• Handle PermissionError in fallback code for old import name by @​defnull in Kludex/python-multipart#182

---

Full Changelog: Kludex/python-multipart@0.0.16...0.0.17

Version 0.0.16

What's Changed

• Add dunder attributes to multipart package by @​Kludex in Kludex/python-multipart#177

---

Full Changelog: Kludex/python-multipart@0.0.15...0.0.16

Version 0.0.15

What's Changed

• Replace FutureWarning to PendingDeprecationWarning #174.
• Add missing files to SDist #171.

---

Full Changelog: Kludex/python-multipart@0.0.14...0.0.15

Version 0.0.14

What's Changed

• fix: use alternate scheme for importing multipart by @​henryiii in Kludex/python-multipart#168

Full Changelog: Kludex/python-multipart@0.0.13...0.0.14

Version 0.0.13

What's Changed

• Rename import to python_multipart by @​henryiii in Kludex/python-multipart#166

New Contributors

• @​henryiii made their first contribution in Kludex/python-multipart#166

Full Changelog: Kludex/python-multipart@0.0.12...0.0.13

... (truncated)

Changelog

Sourced from python-multipart's changelog.

0.0.18 (2024-11-28)

• Hard break if found data after last boundary on MultipartParser #189.

0.0.17 (2024-10-31)

• Handle PermissionError in fallback code for old import name #182.

0.0.16 (2024-10-27)

• Add dunder attributes to multipart package #177.

0.0.15 (2024-10-27)

• Replace FutureWarning to PendingDeprecationWarning #174.
• Add missing files to SDist #171.

0.0.14 (2024-10-24)

• Fix import scheme for multipart module (#168).

0.0.13 (2024-10-20)

• Rename import to python_multipart #166.

0.0.12 (2024-09-29)

• Improve error message when boundary character does not match #124.
• Add mypy strict typing #140.
• Enforce 100% coverage #159.

0.0.11 (2024-09-28)

• Improve performance, especially in data with many CR-LF #137.
• Handle invalid CRLF in header name #141.

0.0.10 (2024-09-21)

• Support on_header_begin #103.
• Improve type hints on FormParser #104.
• Fix OnFileCallback type #106.
• Improve type hints #110.
• Improve type hints on File #111.
• Add type hint to helper functions #112.
• Minor fix for Field.repr #114.
• Fix use of chunk_size parameter #136.
• Allow digits and valid token chars in headers #134.
• Fix headers being carried between parts #135.

0.0.9 (2024-02-10)

... (truncated)

Commits

• 5b1aed8 Version 0.0.18 (#191)
• 9205a0e Hard break if found data after last boundary on MultipartParser (#189)
• 170e604 Update ruff & mypy (#188)
• e53b541 Create SECURITY.md (#187)
• 02d1ec1 fuzz: fix boundary error (#179)
• 616b81e Version 0.0.17 (#183)
• ca52662 Handle PermissionError in fallback code for old import name (#182)
• 8764067 Version 0.0.16 (#177)
• ce85154 Version 0.0.15 (#175)
• 73fb55d ci: check-sdist (#172)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​python-multipart@​0.0.6 ⏵ 0.0.18	+2
	pypi/​python-socketio@​5.10.0 ⏵ 5.14.0	+1

View full report

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Oct 08 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml