chore(deps): bump gitpython and tornado, extend diskcache osv ignore to Nov 1

[yuneng-berri]

TLDR

Problem this solves:

• The osv-scan lockfile check is red on every PR to main
• gitpython and tornado have fixed releases we haven't picked up
• The diskcache ignore expired on 2026-10-01 with still no fixed release

How it solves it:

• Bump gitpython 3.1.61 to 3.1.62 (released 2026-09-07)
• Bump tornado 6.5.8 to 6.5.10 (released 2026-09-15)
• Move the diskcache ignore to 2026-11-01

Both bumps are past the 3-day uv cooldown. uv.lock only touches those two package blocks, since a full relock rewrote unrelated markers. uv lock --check passes

Screenshots / Proof of Fix

Before (6997223)

1. Failing CI run on a PR to main: https://github.com/BerriAI/litellm/actions/runs/36799075151/job/110169119114
2. Output: Total 3 packages affected by 5 known vulnerabilities (diskcache 5.6.3, gitpython 3.1.61, tornado 6.5.8), and osv-scanner.toml has unused ignores: GHSA-w8v5-vhqr-4h9v because its ignoreUntil had passed

After (1f0e543)

1. osv-scanner scan source --config osv-scanner.toml -L uv.lock -L ui/litellm-dashboard/package-lock.json -L vscode-extension/package-lock.json
2. Output: GHSA-w8v5-vhqr-4h9v and 2 aliases have been filtered out, then No issues found

Type

🚄 Infrastructure

Caveats (if any)

Medium

• The two oauthlib ignores expire 2026-10-02, so this check goes red again then
  • oauthlib 4.0.0 clears the cooldown around 2026-10-01 06:00 UTC, but it is a major bump

[greptile-apps]

Confidence Score: 5/5

[High risk] Bumps gitpython and tornado dependencies.

The PR appears safe to merge based on the reviewed changes.

Summary

Updates the locked GitPython and Tornado releases and extends the existing diskcache advisory ignore through November 1.

• The dependency changes remain within the repository’s declared constraints.
• The diskcache suppression remains explicitly time-limited.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump gitpython and tornado,..."}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_/lockout-exception-handling-7e0b37 (1f0e543) with main (6997223)}