Bumps the 12 packages osv-scanner flags on litellm_internal_staging, taking
the scan from 24 known vulnerabilities to zero. vcrpy goes to 8.2.1 first so
aiohttp can move to 3.14.1 (vcrpy <= 8.1.1 cannot import aiohttp 3.14), then
the two aiohttp ignore entries are dropped from osv-scanner.toml. The
langchain stack moves together since langchain 1.3.9 requires langgraph 1.2.x.
Runtime deps cryptography (48.0.1), starlette (1.3.1), python-multipart
(0.0.32), pydantic-settings (2.14.2) and pypdf (6.13.3) are bumped via relock,
and the dashboard's js-yaml, ws and form-data overrides are bumped too.
Also removes the paths filter on the OSV workflow so it runs on every PR
rather than only when a lockfile changes, which is why it never showed up on
recent code-only PRs
* ci: add osv-scanner lockfile scan workflow
Daily scheduled scan plus a pull_request scan scoped to uv.lock and the
dashboard package-lock.json. The osv-scanner v2.3.8 binary is fetched by
full release URL and verified against its official SHA-256 before use;
the job needs no credentials and runs with contents: read only.
osv-scanner.toml carries the single suppression for the diskcache
advisory, which has no fixed release published
* ci: temporary push trigger for runtime verification (will be dropped)
* ci: harden osv-scan per review (RUNNER_TEMP, job-scoped permissions, suppression expiry)
* ci: drop temporary push trigger after runtime verification
* ci: suppress aiohttp advisories while vcrpy blocks the 3.14 bump
Time-boxed like the diskcache entry: ignoreUntil forces a dated
re-triage if no vcrpy release has shipped by then
