fix(deps): bump pypdf to 6.16.2 and tornado to 6.5.8 to clear OSV advisories

[sowmy86]

TLDR

Problem this solves:

• The required OSV Scan check fails on every open PR
• New advisories landed for pinned pypdf 6.15.0 and tornado 6.5.7

How it solves it:

• Bumps pypdf to 6.16.2 and tornado to 6.5.8 in uv.lock
• Both stay inside the ranges pyproject.toml already allows

User Flow

Before: any contributor opening a PR sees a required check fail through no fault of their change

1. They push a branch and open a PR against litellm_internal_staging
2. The OSV Scan check on the PR's checks page turns red in about 15 seconds
3. Opening the run shows five fixable pypdf and tornado advisories from uv.lock
4. Their PR cannot go green no matter what their diff contains

After: the same PR flow passes the scan

1. They push a branch and open a PR against litellm_internal_staging
2. The OSV Scan check on the PR's checks page turns green
3. Opening the run shows "No issues found"

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

No tests are added because this PR only moves two locked dependency versions; the existing suites exercise both packages in CI

Screenshots / Proof of Fix

Shared setup: osv-scanner v2.3.8 (the exact build the workflow pins, checksum verified against the release's official SHA256SUMS), run with the same command as .github/workflows/osv-scan.yml

osv-scanner scan source --config osv-scanner.toml -L uv.lock -L ui/litellm-dashboard/package-lock.json

Before (31ca4dd)

1. Run the command above on the base branch's lockfiles
2. Output ends with the failing table:

Total 2 packages affected by 5 known vulnerabilities (0 Critical, 0 High, 4 Medium, 1 Low, 0 Unknown) from 1 ecosystem.
5 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+---------+---------+---------------+---------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE  |
+-------------------------------------+------+-----------+---------+---------+---------------+---------+
| https://osv.dev/GHSA-23w6-3w8w-8484 | 4.8  | PyPI      | pypdf   | 6.15.0  | 6.16.1        | uv.lock |
| https://osv.dev/GHSA-763m-79hh-57f2 | 4.8  | PyPI      | pypdf   | 6.15.0  | 6.16.1        | uv.lock |
| https://osv.dev/GHSA-jp53-mhqp-8xcg | 6.9  | PyPI      | pypdf   | 6.15.0  | 6.16.0        | uv.lock |
| https://osv.dev/GHSA-8423-8fgw-73vq | 6.9  | PyPI      | tornado | 6.5.7   | 6.5.8         | uv.lock |
| https://osv.dev/GHSA-wwv5-g3v4-889x | 2.3  | PyPI      | tornado | 6.5.7   | 6.5.8         | uv.lock |
+-------------------------------------+------+-----------+---------+---------+---------------+---------+

After (8dae828)

1. Run the same command on this branch's lockfiles
2. Output ends clean:

GHSA-w8v5-vhqr-4h9v and 2 aliases have been filtered out because: diskcache has no fixed release published; remove this entry once one exists
GHSA-h7x2-h6g9-p789 and 1 alias have been filtered out because: mlflow has no fixed release published; remove this entry once one exists
Filtered 3 vulnerabilities from output

No issues found

This PR's own OSV Scan check is the same run executed by CI

Type

🚄 Infrastructure

Caveats (if any)

Low

• The lock was regenerated with uv 0.10.9, the version CI pins, so only the two packages and the lock's exclude-newer timestamp move
• exclude-newer advances to 2026-08-30 because the fixed releases were published after the old cutoff

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

No reviewable files after applying ignore patterns.

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing sowmy86:fix-osv-pypdf-tornado (8dae828) with litellm_internal_staging (31ca4dd)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[mateo-berri]

Superseded by #39188 (merged as 2f0f068), which raises the tornado and pypdf floors and relocks to the same versions. Thanks for the PR.