fix(deps): bump pypdf 6.15.0 -> 6.16.2 to close 3 MEDIUM CVEs

[seonghobae]

Summary

• Trivy filesystem scan flagged CVE-2026-84309/CVE-2026-84310/CVE-2026-84311 (MEDIUM) against the pinned pypdf 6.15.0, failing the required trivy-fs check on every open PR regardless of that PR's own diff -- discovered via an unrelated PR (#792) whose own change (CodeQL trigger dedup) has nothing to do with pypdf. The check's own log output says exactly where the fix belongs: "Remediate each finding at the shared base branch so open PRs inherit the fix."
• pypdf's own CHANGELOG.md confirms two Security-tagged releases since 6.15.0: 6.16.0 ("Detect cycles in TreeObject.insert_child") and 6.16.1 ("Limit iterations for outline retrieval and XForm text extraction"). Bumped to the current latest, 6.16.2 (bug fixes only since 6.16.1, no further security entries).
• pyproject.toml's existing constraint (>=6.15.0,<7.0) already permits 6.16.2; only uv.lock's resolved pin needed updating (uv lock --upgrade-package pypdf), so this is a one-package, minimal-diff bump.
• GitHub's own push output independently confirmed the same count: "GitHub found 3 vulnerabilities on ContextualWisdomLab/newsdom-api's default branch (3 moderate)."

Test plan

• uv run python -m pytest tests -q -m "not integration" -> 483 passed, 0 failures
• tests/test_parse_endpoint.py's 26 tests exercising pypdf.PdfReader/PdfReadError directly -> all pass
• Confirmed pyproject.toml's version constraint already permits 6.16.2 (no constraint change needed)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 04edb437-c65c-42f2-b2f5-12df040709e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Verified-successor closure evidence (fresh 2026-09-04): this PR changes only uv.lock, moving pypdf 6.15.0 -> 6.16.2. Canonical security PR #794 exact 4ecca54ebe2df35612f1b1125e39ad65236a8dec also locks the exact 6.16.2 sdist/wheel artifacts and hashes, while additionally raising the declared direct floor to >=6.16.1,<7.0, adding CVE/provenance doctoring, CHANGELOG traceability, and executable floor/no-suppression contracts. #802 contributes no independent test/fixture/contract file; its local test output is predecessor evidence, not a semantic delta. Closing only because the valid lock-artifact delta is fully inherited and strengthened by #794. #794 remains Draft and must earn its own exact-head gates before merge.