chore: bump pypdf to 6.10.0 for GHSA-3crg-w4f6-42mx

[greysonlalonde]

Summary

• Bumps pypdf from ~=6.9.1 to ~=6.10.0 in lib/crewai-files/pyproject.toml to resolve GHSA-3crg-w4f6-42mx / CVE-2026-40260, where manipulated XMP metadata entity declarations can exhaust RAM.
• Regenerates uv.lock (pypdf 6.9.2 → 6.10.0).

Unblocks the pip-audit vulnerability scan workflow, which was failing with:

Found vulnerabilities in 1 package(s)
  - pypdf==6.9.2: GHSA-3crg-w4f6-42mx

Test plan

• pip-audit workflow passes on CI
• uv lock --check

---

Note

Low Risk
Low risk dependency-only change, but it may subtly affect PDF parsing/chunking behavior since pypdf is used in file processing utilities.

Overview
Updates lib/crewai-files to require pypdf~=6.10.0 (from ~=6.9.1) to address GHSA-3crg-w4f6-42mx.

Regenerates uv.lock, moving the resolved pypdf version from 6.9.2 to 6.10.0 with corresponding artifact hashes/URLs.

^{Reviewed by Cursor Bugbot for commit 0b1a652. Bugbot is set up for automated code reviews on this repo. Configure here.}

[iris-clawd]

pypdf 6.9.1 → 6.10.0 for CVE-2026-40260 (XMP metadata entity expansion → RAM exhaustion). Unblocks pip-audit. LGTM 🚀 💬 222