chore(deps): update tornado requirement from >=6.5.8 to >=6.5.10

[dependabot]

Updates the requirements on tornado to permit the latest version.

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2

... (truncated)

Commits

• 143a06b Merge pull request #3727 from bdarnell/relnotes-6510
• e0084ec Release notes and version bump for 6.5.10
• dde5765 Merge pull request #3725 from bdarnell/jupyter-fix
• 494648f web: Allow a list of allowed_symlink_directory values
• 6bd9c4e web: Fix subclasses that do not set allowed_symlink_directory
• bec4c82 Merge pull request #3722 from bdarnell/relnotes-fix-2
• acae151 docs: More proofreading of release notes
• 8f66d2d Merge pull request #3721 from bdarnell/relnotes-fix
• baaedd7 docs: Add credit for Yasha-ops to 6.5.9 release notes
• 75ef8b1 Merge pull request #3719 from bdarnell/fixes-659
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Reviewed this Dependabot PR. It's a minimal, low-risk change:

• Bumps the floor constraint on tornado from >=6.5.8 to >=6.5.10 in requirements/base.txt, requirements/local.txt, and requirements/production.txt.
• All three files are updated consistently (no drift between them).
• This is a transitive dependency (not directly required, per the existing comment), pinned by Snyk for vulnerability avoidance — same pattern as the other pins in these files, so consistent with existing conventions.
• No application code changes, no test coverage impact expected.

Looks safe to merge. One minor note for whoever merges: since this only raises a floor (>=) rather than pinning an exact version, it's worth confirming CI installs actually pick up 6.5.10+ (no tornado== override elsewhere) so the intended vulnerability fix is actually applied in built environments — a quick pip show tornado in CI or lockfile check would confirm.