fix(deps): lock tornado 6.5.10 for GHSA-chx6-46f5-w4vp, GHSA-c2m8-h5v5-343r and GHSA-3hv7-mjh2-fv65

[mahdi-shafiei]

Summary

Locks tornado 6.5.10 (from 6.5.8) to close three advisories fixed in 6.5.9:

• GHSA-chx6-46f5-w4vp: unbounded decompressed body in CurlAsyncHTTPClient
• GHSA-c2m8-h5v5-343r: StaticFileHandler symlink escape from the static root
• GHSA-3hv7-mjh2-fv65: no field-count limit on query-string parsing

Produced by uv lock --upgrade-package tornado (uv 0.12.21). Only uv.lock changes; no other package moves and the resolution markers are unchanged.

Verification

Audit run as the Security workflow runs it, with a fresh pip-audit cache:

uv sync --locked --extra dev
uv export --frozen --extra dev --no-emit-project -o requirements-audit.txt
uvx pip-audit -r requirements-audit.txt --disable-pip --no-deps

• Lock on main: 3 findings (the three tornado advisories)
• This branch: no known vulnerabilities
• pre-commit run --all-files: exit 0

The Security workflow does not see these advisories

The workflow's own command, uv run --with pip-audit pip-audit --local --desc, reports
"No known vulnerabilities found" on the lock on main, with tornado 6.5.8 installed. pip-audit
is not in the dev extra, so --with runs it from an ephemeral environment layered over the
project venv, and --local restricts the audit to that ephemeral environment: it audits
pip-audit's own dependencies and none of the project's. The audit above therefore exports the
dev extra from the lock instead. The workflow itself is unchanged here.