* Add a pgEdge Starfleet API client for cloud deployment.
* Add a pgacloud provider for pgEdge Starfleet.
* Add the pgEdge Starfleet cloud deployment blueprint.
* Return the generated pgEdge Starfleet password once on deployment and allow saving it.
* Add pgEdge Starfleet to the Deploy Cloud Instance wizard.
* Test the Starfleet password is fetched once and validate the save request body.
* Show the generated pgEdge Starfleet password once after deployment.
* Document pgEdge Starfleet cloud deployment.
* Show the Starfleet password dialog at most once per job and handle copy failures.
* Wait for the Starfleet instance schema before rendering its form.
The schema is built after an asynchronous client IP lookup, but SchemaView
takes its initial data from the first schema it receives, so mounting it
early left the deployment type unset and hid the managed-only fields.
* Keep the Starfleet token for each deployment job until it completes.
The wizard clears its cloud session as soon as the deployment starts, so
the token was gone by the time the job finished and the generated
password could never be fetched. Copy the token for the job when it is
started, read the password with that copy, and discard it on completion.
* Show the reason a cloud deployment failed.
pgacloud prints the provider's error as JSON before it exits, but the
failure path ignored it, so the user saw only a generic process failure
whilst the server quietly vanished from the tree. Pass the message
through update_server and show it once per job as a plain-text error.
* Keep the cloud deployment failure message until it is dismissed.
* Explain an empty Starfleet BYOC cluster list.
* Wait for Starfleet connection details before finishing a deployment.
* Handle malformed Starfleet responses without a server error.
* Clear the Starfleet PostgreSQL version when the deployment type changes.
* Show the Starfleet size label in the deployment summary.
* Stop logging the values of a background process's environment.
* Use the official pgEdge logo for the Starfleet provider.
* Only mount the selected provider's credentials form in the cloud wizard.
* Require HTTPS and handle malformed pgEdge Starfleet responses.
Addresses CodeRabbit review on #10499: the API client refuses a non-HTTPS
URL before sending credentials, a 2xx body that is not JSON or lacks an
access token raises StarfleetError, and the provider and credential check
report an unexpected response shape instead of failing with a traceback.
* Reject an empty or non-string pgEdge Starfleet access token.
* Note that the pgEdge Starfleet API URL must use HTTPS.
* Add screenshots to the pgEdge Starfleet deployment documentation.
* Update the cloud provider screenshot to include pgEdge Starfleet.
* Remove pgEdge Starfleet BYOC support from the cloud deployment wizard.
Only Managed databases are now offered, so the Deployment type selector,
the cluster list, the BYOC PostgreSQL version list and the BYOC capability
probe are gone, along with the --kind and --cluster-id options of
pgacloud's starfleet create-instance command.
* Regenerate the Starfleet instance and review screenshots without the deployment type.
* Retry transient pgEdge Starfleet polling errors and write job tokens through.
A network error, rate limit or server error whilst waiting for a new
database no longer ends the deployment, leaving the database running in
Starfleet but removed from pgAdmin; polling now retries until its
deadline, failing at once only on other client errors.
The job's copy of the access token is now written to the session store
immediately, so a status poll handled by another worker can still fetch
the generated password.
* Write the pgEdge Starfleet wizard token through, and warn that a failed deployment may leave the database behind.
5.8.3 fixes an open redirect in Flask-Security's default configuration
(GHSA-ccgp-pv8r-95wm). The fix is also in 5.9.1, but 5.9 needs Python
3.11 or later and removes get_post_login_redirect(), which pgAdmin
imports, so raise the lower bound within the 5.8 series instead.
Adds browser support for PostgreSQL 14+ extended statistics objects
(CREATE STATISTICS), with the create/edit dialog, reverse engineered SQL,
the computed values ANALYZE collected where the role may see them, and
schema diff support. Completes Murtuza Zabuawala's #9748.
Co-authored-by: Dave Page <dpage@pgadmin.org>
Adds OAUTH2_SERVER_GROUP_CLAIM and OAUTH2_SERVER_GROUP_CLAIM_MAPPING. When
the claim is configured for a provider, shared servers owned by other users
are only visible and accessible if their server group's name appears in the
(optionally mapped) claim values; if the claim is missing, none are. The
user's own servers, and users of other authentication methods, are
unaffected. The claim is resolved at login and only stored once the login
has been authorised.
Co-authored-by: Dave Page <dpage@pgadmin.org>
When SPNEGO negotiation failed, the exception object was passed to flash(), so the session could not be serialised and the login page was replaced by a 500 JSON response. A generic message is now flashed; the detail is already logged.
Also fix a redirect to a non-existent 'authenticate.kerberos_login' endpoint (it is 'kerberos.login'), which had caused every Kerberos mock test to skip unconditionally, and return the username from Kerberos auto-creation so a user's first login is not rejected with "Incorrect username or password".
Co-authored-by: Dave Page <dpage@pgadmin.org>
Share one explicit react-dnd manager between DataGridView and PgTreeView. react-arborist bundles react-dnd 14, which stores its manager under the same global key as react-dnd 16 but keeps a separate reference count, so unmounting one provider could drop the manager while its HTML5 backend was still attached to window.
Moves table construction to useTable() with a shared tableFeatures() registry (filtering, sorting, selection, expanding, sizing/resizing, visibility, row models, sort and filter functions), renames sortingFn to sortFn, adapts to v9 state access, prototype-bound row/cell methods and getRowCanExpand, feeds the DataGridView search state through table state instead of setOptions(), and lets Jest transform the ESM-only @tanstack packages.
Also points the react-checkbox-tree webpack alias at lib/index.js, the 2.1 ESM build, as lib/index.esm.js is a stale 2.0.2 build that leaves the app blank.
* Parse react-frame-component as CommonJS so 5.3 bundles correctly
react-frame-component 5.3 added "type": "module" to its package.json
whilst mapping the "require" condition of its exports to a UMD build.
Babel compiles our imports to require(), so webpack resolves the UMD
file and, honouring the package type, parses it as an ES module. With no
exports object in scope, the UMD wrapper falls through to its browser
global branch and the module exports nothing, so <Frame> is undefined.
Opening the Query Tool then throws React error #130 and unmounts the
whole app, which is why every feature test timed out with the 5.3.2
bump in #10460. Node shows the same packaging fault: require() of the
package returns an empty object.
Tell webpack to parse the package as javascript/auto so the UMD takes
its CommonJS branch. Jest is unaffected, as it loads the UMD as CommonJS.
* Bump react-frame-component to 5.3.2.
Take the version the webpack rule exists for in the same change, so CI
exercises the rule against it.
YAML consumes the quotes around a Compose scalar, so a value such as
PGADMIN_CONFIG_MAIL_SERVER: "mail.example.com" reaches config_distro.py
as a bare name and fails with NameError at startup. Document the nested
quoting needed in map syntax and env_file, how the list form differs,
escaping $ as $$, when config_distro.py is regenerated, and add a Compose
example.
Adds a pgTimeTable Chains node under Servers when pg_timetable is
installed in the maintenance database, with Tasks beneath each chain.
Chains and tasks can be created, edited and deleted, a chain can be
triggered with Run Now, and both have statistics tabs. Includes
regression tests, CI installation of pg_timetable, and documentation.
Reformat pkg/docker/entrypoint.sh to use bash conditionals, arithmetic and
parameter expansion instead of the workarounds needed for BusyBox ash.
The email validation settings and PGADMIN_DEFAULT_EMAIL are now read from
the environment inside Python rather than interpolated into the Python
source, so an address containing an apostrophe works, and a Python error
during validation stops the container instead of passing silently.
Correct 162 entries in the zh_Hans_CN catalogue: strings that are wrong
rather than merely worded differently, plus terminology aligned with
the Chinese PostgreSQL documentation.
- Restore the order of positional %s placeholders in three strings.
The JavaScript gettext fills %s strictly left to right, so the
reordered translations garbled the update notice, the preference
load error and the user password length error.
- Keep the half-width colons in ': error: ', which ProcessDetails.jsx
matches with a regex to highlight error lines, and the SQL comment
marker in '-- missing definition'.
- Fix strings whose meaning was wrong or reversed, e.g. the ERD drag
and drop message, relhassubclass, RESTART IDENTITY, ENABLE REPLICA,
COLLATABLE, CREATE TABLE ... LIKE, and the DBMS Scheduler
"Schedule" object being called a task.
- Give distinct labels to adjacent fields that shared one, and remove
leftovers such as "表(s)", "会话token" and an untranslated
"date/time".
- Use the established Chinese terms where the translation picked the
wrong sense, e.g. Dependents (previously given the word for
dependencies), local variables and the package body.
- Follow the terminology of the Chinese PostgreSQL documentation:
注释 (comment), 字符分类 (LC_CTYPE), 操作符 (operator), 聚簇
(CLUSTER), 提供者 (provider), 流复制 (streaming replication),
预备事务 (prepared transaction), 载荷 (NOTIFY payload) and 过滤
(filter).
- Translate Tab as 标签页 throughout, and the month-day options
1st-31st as 1 日-31 日.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
When an index metadata query failed, the Properties and SQL handlers
could replace the original database error with 'string indices must be
integers', or with an error about using a Response as index metadata.
get_column_details() read rset['rows'] before checking the query status,
and get_column_details(), get_include_details() and get_sql() returned
HTTP responses where their callers expect data.
Raise ExecuteError instead, as get_reverse_engineered_sql() already
does, so the original database error reaches the user. Adds regression
tests covering Properties, SQL, modified SQL and update.
The dialog hardcoded the pgpass flag to false, so it always demanded the
current password even when the connection authenticates via a passfile.
Pass the flag from check_pgpass through to the schema instead.
check_pgpass and change_password also disagreed about when a passfile is
in use: the former treated a password entered at connect but not saved
as a passfile connection, which would now disable the Current Password
field whilst the endpoint still required it. Both now use a shared
is_using_passfile() helper.
Fixes#10449
The Windows, Linux and macOS builds now read the Electron version from
runtime/yarn.lock using 'yarn info electron --json' inside runtime/,
rather than querying the npm registry or using the lower bound of the
range in runtime/package.json. This needs no network access or
node_modules, and packages exactly the version that yarn install
resolves. The build stops with an error if the lockfile is missing or
does not yield a valid version.
A fork with Actions enabled inherits the nightly schedule but none of the
signing secrets or self-hosted runners, so its snapshot fails at the macOS
certificate import and leaves the Windows job queued for a day. The
location job now skips a scheduled run anywhere else, and every build job
waits on it so that the whole run skips with it. A manual dispatch still
runs anywhere.
The test asserted that no X-Remote-User header is sent on the request
after a logout, which only holds in server mode. In desktop mode the
before_request hook logs the desktop user straight back in, so the
header is reported again, and every run-python-tests-pg job (which runs
in desktop mode) has failed on it since #10410. Assert the mode-specific
behaviour instead.
The one-step "signtool sign /fd sha256" fails on the build host with
0xc0000225 before the PIN is asked for, because crypt32 converts the
legacy CryptoAPI key handle to a CNG one for SHA-2 digests, and no CNG
provider is registered under the name of Certum's crypto3 CSP. Rebinding
to cryptoCertum3 KSP is not an option, as it cannot see the Common
profile's code-signing key.
signtool's split flow avoids the conversion, so pkg/win32/sign-files.bat
now does the signing in /dg, /ds, /di, timestamp and verify steps, with
one PIN prompt per call as before. Make.bat's :SIGN_FILES and Inno
Setup's SignTool both go through it, the latter via cmd /c.
Also default PGADMIN_SIGNTOOL_DIR to SDK 10.0.26100.0, the one installed
on the host, and match the PIN dialog on "Logowanie do profilu zwyk" so
that a Secure profile prompt is never answered with the Common PIN.
SIGNING.md gains the full setup procedure, the root cause and the split
signing flow.
A new Debian, Ubuntu, Fedora or EL release is named in seven places across
the build matrices, the snapshot and release workflows, the acceptance tests
and the publishing wrapper, and missing the wrapper leaves the packages built
and uploaded but never indexed. pkg/linux/PLATFORMS.md lists them all, with
the steps for adding a platform, retiring one and the server-side follow-up.
The platform lists in the Debian and Red Hat READMEs had drifted (Ubuntu
25.04, Fedora 40 and 41, RHEL 8), so they now point at the build matrices
instead.
#10355 moved signtool to /fd sha256 on the assumption that the key
provider repair described in pkg/win32/SIGNING.md made SHA-256 possible.
It does not: that repair binds the certificate to the Certum card's
legacy CryptoAPI provider, crypto3 CSP, which fails a SHA-256 file digest
in SignerSign() with 0xc0000225 before the PIN is requested, whilst
/fd sha1 signs and verifies. SHA-1 is what every previous release has
shipped with, so go back to it for both the component and the installer
signatures, and document why.
The timestamp digest stays at SHA-256, which works. Rebinding the
certificate to Certum's CNG provider is the likely route to SHA-256 file
digests, but is untested and is left for later.
The messages that report a missing prerequisite were changed from !VAR!
to %VAR% in commit afa0c773a, since the file does not enable delayed
expansion and they printed the variable name rather than the path. That
made them correct and unparseable at the same time: cmd expands %VAR%
when it parses a parenthesised block rather than when it runs it, and
PGADMIN_INNOTOOL_DIR defaults to "C:\Program Files (x86)\Inno Setup 6",
whose closing parenthesis then ended the IF block early. Every Windows
build has failed at "Checking the environment..." since, with "\Inno was
unexpected at this time", whether or not Inno Setup was installed, which
took the nightly snapshot with it.
The four checks move into a :REQUIRE_DIR subroutine that takes the
directory and the hint, and echoes both outside any block, where a
parenthesis is just a character. Enabling delayed expansion would also
have worked, but only by making ! a metacharacter for the whole file.
The other uses of these two paths are all inside double quotes, which
the parser does respect, so they were never affected.
The 'Change Password...' option on a server node was ambiguous, because it
changes the password of the PostgreSQL role that pgAdmin connects with, yet
read as though it might change the pgAdmin login password instead. The menu
option and its dialog are now called 'Change Server Password', with the
connected role name in the dialog title, and the equivalent option in the
user menu becomes 'Change pgAdmin Password', so that the two can no longer
be confused with one another.
The dialog's own 'User' field was always blank, since the userName prop that
showChangeServerPassword passes was never accepted by ChangePasswordContent;
it is now wired through, which also makes the existing documentation of that
field accurate. The documentation for both dialogs has been updated to match
the new names, along with a couple of button names that had drifted.
Fixes#9230.
Dave Page
dependabot[bot]
Murtuza ZabuawalaandDave Page
Bea SteersandDave Page
Rohit BhatiandDave Page
dev-hari-prasadandDave Page
Kundan Sable
Matt Van Horn
Regina Obe
Guiorgy
耗子andClaude Opus 5.5
Ian
Sanskar Kharya