fix: bump pypdf to 6.16.2 for GHSA-jp53-mhqp-8xcg

[Vidit-Ostwal]

Summary

• Raise the pypdf floor from 6.15.0 to 6.16.1 in the workspace override and crewai-files
• Refresh uv.lock to 6.16.2 so pip-audit no longer reports GHSA-jp53-mhqp-8xcg, GHSA-23w6-3w8w-8484, and GHSA-763m-79hh-57f2
• Take 6.16.2 rather than 6.16.1 so the latest patched release is locked (6.16.2 is bugfixes only)

Test plan

• Vulnerability Scan / pip-audit no longer reports pypdf==6.15.0 for those three GHSAs
• uv.lock resolves pypdf 6.16.2

Follow-up

• After this greens CI, merge fix(memory): preserve reusable scope configs #7068 (fix(memory): preserve reusable scope configs, [BUG] Memory scope validation mutates reusable configuration dictionaries #7204)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: cb6e54a3-b297-405e-969d-4296be81d001

📥 Commits

Reviewing files that changed from the base of the PR and between a6131e6 and d2301e1.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR updates pypdf requirements to 6.16.1 or newer and removes the package-specific cutoff. pypdf now follows the global three-day cutoff.

Changes

pypdf constraint and cutoff updates

Layer / File(s)	Summary
Update pypdf constraints and cutoff configuration lib/crewai-files/pyproject.toml, pyproject.toml	The pypdf requirement changes to ~=6.16.1. The override remains pypdf>=6.16.1,<7. The package-specific exclude-newer cutoff and related exception note are removed.

Merge Risk: ⚪ Minimal · up to d2301

This PR updates the pypdf dependency and lockfile to a patched release; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the pypdf version bump and the GHSA addressed. It matches the main change.
Description check	✅ Passed	The description explains the dependency update, affected vulnerabilities, lockfile target, and verification plan. It does not use the exact template headings and does not provide a dedicated Related i…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the dependency update, affected vulnerabilities, lockfile target, and verification plan. It does not use the exact template headings and does not provide a dedicated Related issue section, but it includes issue references in the follow-up section and is substantially complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pip-audit-pypdf-ghsa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Vidit-Ostwal]

Follow-up after this lands: merge #7068 (memory scope validation no longer mutates caller-owned configs; #7204). CI on that PR is red because of the same pip-audit / cancelled-test noise this bump should clear.