test(backup, restore): fix stale XSS check after PGDATABASE dbname fix

Backup/restore now pass the target database via PGDATABASE instead of
a CLI/positional argument, so the XSS regression test's check against
the displayed command string could never find the db name (escaped or
not) and always failed. Point Backup's check at the message field,
where the db name is still interpolated; for Restore, where the db
name no longer surfaces anywhere (command shows an always-empty
--dbname, message omits it entirely), assert its absence instead.

.coderabbit.yaml

@@ -0,0 +1,186 @@
+language: en-US
+tone_instructions: ''
+early_access: false
+enable_free_tier: true
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: '@coderabbitai summary'
+  high_level_summary_in_walkthrough: false
+  auto_title_placeholder: '@coderabbitai'
+  auto_title_instructions: ''
+  review_status: true
+  commit_status: true
+  fail_commit_status: false
+  collapse_walkthrough: false
+  changed_files_summary: true
+  sequence_diagrams: true
+  estimate_code_review_effort: true
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  labeling_instructions: []
+  auto_apply_labels: false
+  suggested_reviewers: true
+  auto_assign_reviewers: false
+  in_progress_fortune: true
+  poem: false
+  path_filters: []
+  path_instructions: []
+  abort_on_close: true
+  disable_cache: false
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    ignore_title_keywords: []
+    labels: []
+    drafts: false
+    base_branches: []
+    ignore_usernames: []
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: true
+  pre_merge_checks:
+    docstrings:
+      mode: warning
+      threshold: 80
+    title:
+      mode: warning
+      requirements: ''
+    description:
+      mode: warning
+    issue_assessment:
+      mode: warning
+    custom_checks: []
+  tools:
+    ast-grep:
+      rule_dirs: []
+      util_dirs: []
+      essential_rules: true
+      packages: []
+    shellcheck:
+      enabled: true
+    ruff:
+      enabled: true
+    markdownlint:
+      enabled: true
+    github-checks:
+      enabled: true
+      timeout_ms: 900000
+    languagetool:
+      enabled: true
+      enabled_rules: []
+      disabled_rules: []
+      enabled_categories: []
+      disabled_categories: []
+      enabled_only: false
+      level: default
+    biome:
+      enabled: true
+    hadolint:
+      enabled: true
+    swiftlint:
+      enabled: true
+    phpstan:
+      enabled: true
+      level: default
+    phpmd:
+      enabled: true
+    phpcs:
+      enabled: true
+    golangci-lint:
+      enabled: true
+    yamllint:
+      enabled: true
+    gitleaks:
+      enabled: true
+    checkov:
+      enabled: true
+    detekt:
+      enabled: true
+    eslint:
+      enabled: true
+    flake8:
+      enabled: true
+    rubocop:
+      enabled: true
+    buf:
+      enabled: true
+    regal:
+      enabled: true
+    actionlint:
+      enabled: true
+    pmd:
+      enabled: true
+    clang:
+      enabled: true
+    cppcheck:
+      enabled: true
+    semgrep:
+      enabled: true
+    circleci:
+      enabled: true
+    clippy:
+      enabled: true
+    sqlfluff:
+      enabled: true
+    prismaLint:
+      enabled: true
+    pylint:
+      enabled: true
+    oxc:
+      enabled: true
+    shopifyThemeCheck:
+      enabled: true
+    luacheck:
+      enabled: true
+    brakeman:
+      enabled: true
+    dotenvLint:
+      enabled: true
+    htmlhint:
+      enabled: true
+    checkmake:
+      enabled: true
+    osvScanner:
+      enabled: true
+chat:
+  art: true
+  auto_reply: true
+  integrations:
+    jira:
+      usage: auto
+    linear:
+      usage: auto
+knowledge_base:
+  opt_out: false
+  web_search:
+    enabled: true
+  code_guidelines:
+    enabled: true
+    filePatterns: []
+  learnings:
+    scope: auto
+  issues:
+    scope: auto
+  jira:
+    usage: auto
+    project_keys: []
+  linear:
+    usage: auto
+    team_keys: []
+  pull_requests:
+    scope: auto
+  mcp:
+    usage: auto
+    disabled_servers: []
+code_generation:
+  docstrings:
+    language: en-US
+    path_instructions: []
+  unit_tests:
+    path_instructions: []

.dockerignore

@@ -1,4 +1,5 @@
 web/node_modules
+web/config_*.py
 web/*.log
 web/regression
 web/**/tests/

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and normalize end of lines to LF (\n)
+* text=auto eol=lf

.github/dependabot.yml

@@ -1,4 +1,11 @@
 version: 2
+
+# A note on the "groups" blocks below: minor and patch updates are batched into
+# a single PR per manifest per week, whilst major updates continue to arrive
+# individually. Majors are where the breakage lives and each one wants its own
+# review, whereas a dozen separate PRs for patch bumps is pure overhead.
+# Grouping applies to version updates only, so Dependabot security updates are
+# unaffected and still arrive as their own PRs.
 updates:
   - package-ecosystem: "docker"
     directory: "/"
@@ -17,6 +24,20 @@ updates:
       - "Dependencies"
     commit-message:
       prefix: "Python dependency"
+    groups:
+      python-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    # paramiko 5.0 removed DSSKey, which sshtunnel 0.4.0 still references in
+    # SSHTunnelForwarder.get_keys(); a major bump therefore breaks every SSH
+    # tunnelled connection at construction time. sshtunnel has had no release
+    # since 2019, so this stays put until it is fixed or replaced. See #9927.
+    ignore:
+      - dependency-name: "paramiko"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "pip"
     directory: "/tools"
@@ -26,7 +47,17 @@ updates:
       - "Dependencies"
     commit-message:
       prefix: "Python dependency"
+    groups:
+      tools-python-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
+  # Note that web/regression/requirements.txt begins with
+  # "-r ../../requirements.txt", so this entry also sees everything pinned in
+  # the root file and the paramiko exclusion has to be repeated here.
   - package-ecosystem: "pip"
     directory: "/web/regression"
     schedule:
@@ -35,6 +66,16 @@ updates:
       - "Dependencies"
     commit-message:
       prefix: "Python dependency"
+    groups:
+      regression-python-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      - dependency-name: "paramiko"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "npm"
     directory: "/runtime"
@@ -44,6 +85,13 @@ updates:
       - "Dependencies"
     commit-message:
       prefix: "Javascript dependency"
+    groups:
+      runtime-javascript-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "npm"
     directory: "/web"
@@ -53,3 +101,37 @@ updates:
       - "Dependencies"
     commit-message:
       prefix: "Javascript dependency"
+    groups:
+      web-javascript-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # @testing-library/jest-dom 7 requires Node >= 22, whilst Node 20 is the
+      # minimum we support and what most of the buildfarm runs. Revisit once
+      # the buildfarm moves to Node 22. See #10271 and #10210.
+      - dependency-name: "@testing-library/jest-dom"
+        update-types: ["version-update:semver-major"]
+
+      # Babel 8 requires Node ^22.18.0 || >=24.11.0, and every 8.x package
+      # peer-depends on @babel/core ^8.0.0 whilst we are on 7.x. Taking any of
+      # them individually leaves an unsatisfiable peer requirement and a mixed
+      # 7/8 tree, so Babel 8 needs a coordinated migration across all ten
+      # @babel/* packages once we are on Node 22. See #10283, #10284, #10285.
+      - dependency-name: "@babel/*"
+        update-types: ["version-update:semver-major"]
+
+      # pickr 1.10 switched to a dual CJS/ESM build whose CommonJS entry point
+      # exports a namespace object rather than the class, so Babel's interop
+      # leaves _pickr.default as an object and every dialog with a colour field
+      # dies on mount. That took master's feature tests down for three days
+      # (#10264, reverted in #10278). Note 1.9 -> 1.10 is a *minor* bump, so it
+      # otherwise rejoins the grouped PR and comes back around; minor updates
+      # are excluded here as well as majors until withColorPicker.js is adapted
+      # to the new export shape.
+      - dependency-name: "@simonwep/pickr"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"

.github/workflows/check-javascript-style.yml

@@ -19,10 +19,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Upgrade yarn
-        run: |
-          yarn set version berry
-          yarn set version 4
+      # Corepack reads packageManager from web/package.json and provisions
+      # exactly that Yarn: a single pinned download, with nothing written
+      # into the checkout.
+      - name: Enable Corepack
+        run: corepack enable
 
       - name: Install Node modules
         run: |

.github/workflows/run-feature-tests-epas.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        pgver: [13, 14, 15, 16, 17]
+        pgver: [14, 15, 16, 17, 18]
 
     runs-on: ubuntu-22.04
 
@@ -141,10 +141,11 @@ jobs:
           }
           EOF
 
-      - name: Upgrade yarn
-        run: |
-          yarn set version berry
-          yarn set version 4
+      # Corepack reads packageManager from web/package.json and provisions
+      # exactly that Yarn: a single pinned download, with nothing written
+      # into the checkout.
+      - name: Enable Corepack
+        run: corepack enable
 
       - name: Build the JS bundle
         run: |

.github/workflows/run-feature-tests-pg.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        pgver: [13, 14, 15, 16, 17]
+        pgver: [14, 15, 16, 17, 18]
 
     runs-on: ubuntu-22.04
 
@@ -151,10 +151,11 @@ jobs:
           }
           EOF
 
-      - name: Upgrade yarn
-        run: |
-          yarn set version berry
-          yarn set version 4
+      # Corepack reads packageManager from web/package.json and provisions
+      # exactly that Yarn: a single pinned download, with nothing written
+      # into the checkout.
+      - name: Enable Corepack
+        run: corepack enable
 
       - name: Build the JS bundle
         run: |

.github/workflows/run-javascript-tests.yml

@@ -28,10 +28,11 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      - name: Upgrade yarn
-        run: |
-          yarn set version berry
-          yarn set version 4
+      # Corepack reads packageManager from web/package.json and provisions
+      # exactly that Yarn: a single pinned download, with nothing written
+      # into the checkout.
+      - name: Enable Corepack
+        run: corepack enable
 
       - name: Install Node modules
         run: |

.github/workflows/run-python-tests-epas.yml

@@ -32,7 +32,18 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-22.04, windows-latest]
-        pgver: [13, 14, 15, 16, 17]
+        pgver: [14, 15, 16, 17, 18]
+        postgisver: [34]
+        exclude:
+          - pgver: 18
+            postgisver: 34
+        include:
+          - os: ubuntu-22.04
+            pgver: 18
+            postgisver: 36
+          - os: windows-latest
+            pgver: 18
+            postgisver: 36
 
     runs-on: ${{ matrix.os }}
 
@@ -53,7 +64,7 @@ jobs:
         if: ${{ matrix.os == 'ubuntu-22.04' }}
         run: |
           sudo apt update
-          sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev edb-as${{ matrix.pgver }}-server edb-as${{ matrix.pgver }}-server-pldebugger edb-as${{ matrix.pgver }}-postgis34
+          sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev edb-as${{ matrix.pgver }}-server edb-as${{ matrix.pgver }}-server-pldebugger edb-as${{ matrix.pgver }}-postgis${{ matrix.postgisver }}
 
       - name: Install pgagent on Linux
         if: ${{ matrix.os == 'ubuntu-22.04' &&  matrix.pgver <= 16 }}
@@ -73,6 +84,14 @@ jobs:
           IF %ERRORLEVEL% EQU 3010 cmd /c "exit /b 0"
         shell: cmd
 
+      - name: Add pg_config path to PATH
+        shell: pwsh
+        run: |
+          $pgPath = "C:\\EPAS\\${{ matrix.pgver }}\\bin"
+          Write-Output $pgPath
+          Add-Content -Path $env:GITHUB_PATH -Value $pgPath
+          pg_config --version
+
       - name: Create the tablespace directory on Linux
         if: ${{ matrix.os == 'ubuntu-22.04' }}
         run: |

.github/workflows/run-python-tests-pg.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [macos-latest, ubuntu-22.04, windows-latest]
-        pgver: [13, 14, 15, 16, 17]
+        pgver: [14, 15, 16, 17, 18]
 
     runs-on: ${{ matrix.os }}
 
@@ -64,6 +64,7 @@ jobs:
           brew install postgresql@${{ matrix.pgver }}
           echo "/opt/homebrew/opt/postgresql@${{ matrix.pgver }}/bin" >> $GITHUB_PATH
 
+
       - name: Uninstall PostgreSQL if already present on windows
         if: ${{ matrix.os == 'windows-latest' }}
         run: |
@@ -78,13 +79,21 @@ jobs:
         run: |
           FOR /f "delims=" %%F IN ('python tools\get_sb_package.py "https://www.postgresql.org/applications-v2.xml" "postgresql_${{ matrix.pgver }}" "windows-x64"') DO SET INSTALLER_EXE=%%F
           ECHO Running %INSTALLER_EXE%...
-          %INSTALLER_EXE% --prefix C:\PostgreSQL\${{ matrix.pgver }} --datadir C:\PostgreSQL\${{ matrix.pgver }}\data --serverport 59${{ matrix.pgver }} --superpassword postgres --install_runtimes 0 --mode unattended --unattendedmodeui none --disable-components pgAdmin,stackbuilder --enable-components server,commandlinetools"
+          %INSTALLER_EXE% --prefix C:\PostgreSQL_custom\${{ matrix.pgver }} --datadir C:\PostgreSQL_custom\${{ matrix.pgver }}\data --serverport 59${{ matrix.pgver }} --superpassword postgres --install_runtimes 0 --mode unattended --unattendedmodeui none --disable-components pgAdmin,stackbuilder --enable-components server,commandlinetools"
           choco install -y mitkerberos
 
           REM Ignore error 3010 (reboot required)
           IF %ERRORLEVEL% EQU 3010 cmd /c "exit /b 0"
         shell: cmd
 
+      - name: Add pg_config path to PATH
+        shell: pwsh
+        run: |
+          $pgPath = "C:\\PostgreSQL_custom\\${{ matrix.pgver }}\\bin"
+          Write-Output $pgPath
+          Add-Content -Path $env:GITHUB_PATH -Value $pgPath
+          pg_config --version
+
       - name: Create the tablespace directory on Linux
         if: ${{ matrix.os == 'ubuntu-22.04' }}
         run: |

.github/workflows/run-python-tests-server-mode.yml

@@ -0,0 +1,204 @@
+name: Run Python tests in server mode (data isolation)
+
+# This workflow runs the data-isolation tests with SERVER_MODE=True.
+# The main run-python-tests-pg.yml workflow runs everything with
+# SERVER_MODE=False, so any test that gates itself on `config.SERVER_MODE`
+# (notably web/pgadmin/browser/server_groups/tests/test_sg_data_isolation.py
+# and web/pgadmin/browser/server_groups/servers/tests/test_server_data_isolation.py)
+# skips itself in CI. That gap allowed the admin-bypass regression in
+# 9a76ed8 to ship; this workflow exists so regressions to the centralized
+# access-control helpers in web/pgadmin/utils/server_access.py are caught.
+#
+# Scope is intentionally narrow: one OS, one PG version, only the
+# data-isolation modules. Keep it cheap to run on every PR.
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+  workflow_dispatch:
+
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  run-python-tests-server-mode:
+    runs-on: ubuntu-24.04
+
+    env:
+      PG_VER: 18
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # We don't run any authenticated git operations after checkout
+          # (no push, no submodule fetch, no comment back to the PR), so
+          # persisting the token in the local git config only widens the
+          # blast radius of an unrelated step compromise.
+          persist-credentials: false
+
+      - name: Update python version
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+
+      - name: Setup the PGDG APT repo
+        # apt-key is deprecated on Ubuntu 24.04+; install the key into
+        # /etc/apt/keyrings/ and reference it via signed-by= in the
+        # sources.list entry instead.
+        run: |
+          sudo install -d -m 0755 /etc/apt/keyrings
+          wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+            | sudo gpg --dearmor -o /etc/apt/keyrings/pgdg.gpg
+          sudo sh -c 'echo "deb [signed-by=/etc/apt/keyrings/pgdg.gpg] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
+
+      - name: Uninstall PostgreSQL if already present
+        run: |
+          if [ -n "$(ls /etc/postgresql/*/*/postgresql.conf 2>/dev/null)" ]; then
+            installed_pg_version=$( pg_config --version | cut -d ' ' -f 2 | cut -d '.' -f 1 )
+            echo "Installed PostgreSQL version: $installed_pg_version"
+            if [ $installed_pg_version != ${PG_VER} ]; then
+              sudo pg_dropcluster $installed_pg_version main --stop
+              sudo apt-get -y remove "postgresql-${installed_pg_version}"
+            fi
+          fi
+
+      - name: Install platform dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y libpq-dev libffi-dev libssl-dev libkrb5-dev zlib1g-dev postgresql-${PG_VER}
+
+      - name: Start PostgreSQL
+        run: |
+          sudo su -c "echo local all all trust > /etc/postgresql/${PG_VER}/main/pg_hba.conf"
+          sudo sed -i "s/port = 543[0-9]/port = 59${PG_VER}/g" /etc/postgresql/${PG_VER}/main/postgresql.conf
+          sudo su - postgres -c "/usr/lib/postgresql/${PG_VER}/bin/postgres -D /var/lib/postgresql/${PG_VER}/main -c config_file=/etc/postgresql/${PG_VER}/main/postgresql.conf &"
+
+          # Bounded readiness wait: 60 attempts × 2s = 120s cap. If PG
+          # never becomes ready, fail fast with logs rather than hanging
+          # until the job timeout.
+          for attempt in $(seq 1 60); do
+            if sudo runuser -l postgres -c "pg_isready -p 59${PG_VER}" 2>/dev/null; then
+              break
+            fi
+            >&2 echo "Postgres is unavailable (attempt ${attempt}/60) - sleeping for 2 seconds"
+            sleep 2
+            if [ "$attempt" -eq 60 ]; then
+              >&2 echo "Postgres failed to become ready within 120 seconds"
+              sudo tail -n 200 /var/log/postgresql/postgresql-${PG_VER}-main.log || true
+              exit 1
+            fi
+          done
+
+      - name: Install Python dependencies
+        run: make install-python-testing
+
+      - name: Create the test configuration (SERVER_MODE=True)
+        run: |
+          mkdir -p var
+          cat <<EOF > web/config_local.py
+          from config import *
+
+          # Debug mode
+          DEBUG = True
+
+          # App mode — this is the whole point of this workflow.
+          SERVER_MODE = True
+
+          # Log
+          CONSOLE_LOG_LEVEL = DEBUG
+          FILE_LOG_LEVEL = DEBUG
+
+          DEFAULT_SERVER = '127.0.0.1'
+
+          UPGRADE_CHECK_ENABLED = False
+
+          LOG_FILE = "$(pwd)/var/pgadmin4.log"
+          SESSION_DB_PATH = "$(pwd)/var/sessions"
+          STORAGE_DIR = "$(pwd)/var/storage"
+          SQLITE_PATH = "$(pwd)/var/pgadmin4.db"
+          TEST_SQLITE_PATH = "$(pwd)/var/pgadmin4.db"
+          AZURE_CREDENTIAL_CACHE_DIR = "$(pwd)/var/azurecredentialcache"
+          EOF
+
+          cat <<EOF > web/regression/test_config.json
+          {
+            "pgAdmin4_login_credentials": {
+              "new_password": "NEWPASSWORD",
+              "login_password": "PASSWORD",
+              "login_username": "USER@EXAMPLE.COM"
+            },
+            "pgAdmin4_test_user_credentials": {
+              "new_password": "NEWPASSWORD",
+              "login_password": "PASSWORD",
+              "login_username": "USER2@EXAMPLE.COM"
+            },
+            "pgAdmin4_test_non_admin_credentials": {
+              "new_password": "NEWPASSWORD",
+              "login_password": "PASSWORD",
+              "login_username": "USER3@EXAMPLE.COM"
+            },
+            "server_group": 1,
+            "server_credentials": [
+              {
+                "name": "PostgreSQL ${{ env.PG_VER }}",
+                "comment": "PostgreSQL ${{ env.PG_VER }} Server",
+                "db_username": "postgres",
+                "host": "/var/run/postgresql",
+                "db_password": "postgres",
+                "db_port": 59${{ env.PG_VER }},
+                "maintenance_db": "postgres",
+                "sslmode": "prefer",
+                "tablespace_path": "/var/lib/postgresql/tablespaces/${{ env.PG_VER }}",
+                "enabled": true,
+                "default_binary_paths": {
+                  "pg": "/usr/lib/postgresql/${{ env.PG_VER }}/bin",
+                  "ppas": ""
+                }
+              }
+            ],
+            "server_update_data": [
+              {
+                "comment": "This is test update comment"
+              }
+            ]
+          }
+          EOF
+
+      - name: Run server-group data isolation tests
+        run: |
+          . venv/bin/activate
+          python web/regression/runtests.py --pkg browser.server_groups.tests --modules test_sg_data_isolation
+
+      - name: Run server data isolation tests
+        run: |
+          . venv/bin/activate
+          python web/regression/runtests.py --pkg browser.server_groups.servers.tests --modules test_server_data_isolation
+
+      - name: Run SQL Editor unauth-pickle regression test
+        # Regression guard for the CSRF-only-no-auth chain on
+        # /sqleditor/close and /sqleditor/.../update_connection: both
+        # endpoints reach pickle.loads via close_sqleditor_session() /
+        # check_transaction_status(), so they must require an
+        # authenticated session. This test is a no-op in DESKTOP mode
+        # (auto-re-authentication) so it can only run here.
+        run: |
+          . venv/bin/activate
+          python web/regression/runtests.py --pkg tools.sqleditor --modules test_close_requires_auth
+
+      - name: Archive server log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: server-log-server-mode
+          path: var/pgadmin4.log
+
+      - name: Archive regression log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: regression-log-server-mode
+          path: web/regression/regression.log

.github/workflows/sonarqube-scan.yml

@@ -43,7 +43,7 @@ jobs:
           sonar.test.inclusions=**/tests/**, web/regression
           
           # Python compatibility
-          sonar.python.version=3.7, 3.8, 3.9, 3.10, 3.11
+          sonar.python.version=3.9, 3.10, 3.11, 3.12, 3.13, 3.14
           EOF
           
           APP_RELEASE=`grep "^APP_RELEASE" web/config.py | cut -d"=" -f2 | sed 's/ //g'`
@@ -52,7 +52,7 @@ jobs:
           sed -i "s/%VERSION%/${APP_LONG_VERSION}/g" sonar-project.properties
 
       - name: SonarQube Scan
-        uses: sonarsource/sonarqube-scan-action@master
+        uses: sonarsource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         env:
           SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
           SONAR_HOST_URL: ${{ secrets.SONARQUBE_HOST }}

.gitignore

@@ -59,5 +59,6 @@ auditpy.txt
 web/coverage/
 web/.coverage
 web/regression/.coverage
+.worktree/
 web/regression/covhtml/
 web/regression/htmlcov/

CONTRIBUTING.md

@@ -0,0 +1,341 @@
+# Contributing to pgAdmin 4
+
+Thank you for your interest in contributing to pgAdmin 4.
+
+## Contents
+
+- Getting Started
+- Reporting Issues
+- Making Changes
+- Pull Requests
+- AI-assisted Contributions
+- Development Setup
+- Database Migrations
+- Security Issues
+- Community and Support
+- License
+
+## Getting Started
+
+Before starting work, please review the project documentation and familiarize yourself with the architecture and development workflow.
+
+### Architecture
+
+pgAdmin 4 is written as a web application with Python (Flask) on the server side and ReactJS, HTML5 with CSS for the client side processing and UI.
+
+Although developed using web technologies, pgAdmin 4 can be deployed either on a web server using a browser, or standalone on a workstation. The [runtime/](runtime/) subdirectory contains an Electron-based runtime application intended to allow this, which will fork a Python server process and display the UI.
+
+For a fuller introduction to the codebase, see the [code overview](docs/en_US/code_overview.rst).
+
+If you are new to the codebase, consider starting with smaller bug fixes or documentation improvements before working on larger changes.
+
+The Sphinx documentation also includes contributor guidance for [coding standards](docs/en_US/coding_standards.rst), [submitting pull requests](docs/en_US/submitting_pull_requests.rst), [code review](docs/en_US/code_review.rst), and [translations](docs/en_US/translations.rst).
+
+## Reporting Issues
+
+When reporting a bug:
+
+- Search existing issues first.
+- If a similar issue exists, add any additional information or context you have. Do not create a duplicate issue.
+- Provide clear steps to reproduce the issue.
+- Include relevant environment and version information.
+- Attach screenshots, logs, or error messages when appropriate.
+
+For feature requests, describe the problem being solved and the expected behavior. 
+
+
+## Making Changes
+
+When working on a contribution:
+
+- Keep changes focused and easy to review.
+- Follow existing coding patterns and conventions, including the [coding standards](docs/en_US/coding_standards.rst).
+- Avoid unrelated refactoring and changes in the same commit.
+- Keep commit messages clear and descriptive.
+- Update tests or documentation when necessary.
+
+## Pull Requests
+
+Before opening a pull request:
+
+- Ensure your changes build successfully.
+- Test your changes locally.
+- Review your code before submission.
+- Update your branch with the latest changes from `master` upstream when appropriate.
+
+When opening a pull request:
+
+- Clearly describe the change.
+- Explain the reason for the change.
+- Include screenshots or recordings for UI-related changes when applicable.
+- Submit any changes as Pull Requests against the `master` branch of the [pgadmin-org/pgadmin4](https://github.com/pgadmin-org/pgadmin4) repository.
+
+Use a clear pull request title that describes the change. Short prefixes such as `feat:`, `fix:`, `docs:`, `test:`, `refactor:`, and `chore:` are useful when they match the change being made. Branch names are contributor-local and do not need to follow a project-specific naming convention.
+
+For more detail, see the [pull request submission guide](docs/en_US/submitting_pull_requests.rst) and [code review guide](docs/en_US/code_review.rst).
+
+## AI-assisted Contributions
+
+Contributors are responsible for understanding, testing, and standing behind everything they submit, whether or not AI tools were used. Please do not open large numbers of auto-generated issues or pull requests without first discussing that work with the maintainers.
+
+## Development Setup
+
+In the following documentation and examples, `$PGADMIN4_SRC` is used to denote the top-level directory of your copy of the pgAdmin source tree (either from a tarball or a git checkout).
+
+### Prerequisites
+
+1. Install Node.js 20 and above (https://nodejs.org/en/download)
+2. yarn (https://yarnpkg.com/getting-started/install)
+3. Python 3.9 and above (https://www.python.org/downloads/)
+4. PostgreSQL server (https://www.postgresql.org/download)
+
+Start by enabling Corepack, if it isn't already; this will add the yarn binary to your PATH:
+
+```bash
+corepack enable
+```
+
+### Building Web Assets
+
+pgAdmin is dependent on a number of third-party JavaScript libraries. These, along with its own JavaScript code, CSS code and images must be compiled into a "bundle" which is transferred to the browser for execution and rendering. This is far more efficient than simply requesting each asset as it is needed by the client.
+
+To create the bundle, you will need the 'yarn' package management tool to be installed. Then, you can run the following commands on a *nix system to download the required packages and build the bundle:
+
+```bash
+$ cd $PGADMIN4_SRC
+$ make install-node
+$ make bundle
+```
+
+On Windows systems (where "make" is not available), the following commands can be used:
+
+```bat
+C:\> cd $PGADMIN4_SRC\web
+C:\$PGADMIN4_SRC\web> yarn install
+C:\$PGADMIN4_SRC\web> yarn run bundle
+```
+
+### Python Environment
+
+In order to run the Python code, a suitable runtime environment is required. Python version 3.9 and later are currently supported. It is recommended that a Python virtual environment is set up for this purpose, rather than using the system Python environment. On Linux and Mac systems, the process is fairly simple - adapt as required for your distribution:
+
+1. Create a virtual environment in an appropriate directory. The last argument is the name of the environment; that can be changed as desired:
+
+   ```bash
+   $ python3 -m venv venv
+   ```
+
+2. Now activate the virtual environment:
+
+   ```bash
+   $ source venv/bin/activate
+   ```
+
+   On Windows:
+
+   ```bash
+   venv\Scripts\activate
+   ```
+
+3. Some of the components used by pgAdmin require a very recent version of *pip*, so update that to the latest:
+
+   ```bash
+   (venv) $ pip install --upgrade pip
+   ```
+
+4. Ensure that a PostgreSQL installation's bin/ directory is in the path (so pg_config can be found for building psycopg3), and install the required packages:
+
+   ```bash
+   (venv) $ PATH=$PATH:/usr/local/pgsql/bin pip install -r $PGADMIN4_SRC/requirements.txt
+   ```
+
+   If you are planning to run the regression tests, you also need to install additional requirements from `web/regression/requirements.txt`:
+
+   ```bash
+   (venv) $ pip install -r $PGADMIN4_SRC/web/regression/requirements.txt
+   ```
+
+### Configuration
+
+Create a local configuration file for pgAdmin. Edit `$PGADMIN4_SRC/web/config_local.py` and add any desired configuration options (use the `config.py` file as a reference - any settings duplicated in `config_local.py` will override those in `config.py`). A typical development configuration may look like:
+
+```python
+import os
+import logging
+
+# Change pgAdmin data directory
+DATA_DIR = '/Users/myuser/.pgadmin_dev'
+
+# Change pgAdmin server and port
+DEFAULT_SERVER = '127.0.0.1'
+DEFAULT_SERVER_PORT = 5051
+
+# Switch between server and desktop mode
+SERVER_MODE = True
+
+# Change pgAdmin config DB path in case an external DB is used.
+CONFIG_DATABASE_URI="postgresql://postgres:postgres@localhost:5436/pgadmin"
+
+# Set up SMTP
+MAIL_SERVER = 'smtp.gmail.com'
+MAIL_PORT = 465
+MAIL_USE_SSL = True
+MAIL_USERNAME = 'user@gmail.com'
+MAIL_PASSWORD = 'xxxxxxxxxx'
+
+# Change log level
+CONSOLE_LOG_LEVEL = logging.INFO
+FILE_LOG_LEVEL = logging.INFO
+
+# Use a different config DB for each server mode.
+if SERVER_MODE == False:
+  SQLITE_PATH = os.path.join(
+      DATA_DIR,
+      'pgadmin4-desktop.db'
+  )
+else:
+  SQLITE_PATH = os.path.join(
+      DATA_DIR,
+      'pgadmin4-server.db'
+  )
+```
+
+This configuration allows easy switching between server and desktop modes for testing.
+
+### Running pgAdmin
+
+The initial setup of the configuration database is interactive in server mode, and non-interactive in desktop mode. You can run it either by running:
+
+```bash
+(venv) $ python3 $PGADMIN4_SRC/web/setup.py
+```
+
+or by starting pgAdmin 4:
+
+```bash
+(venv) $ python3 $PGADMIN4_SRC/web/pgAdmin4.py
+```
+
+Whilst it is possible to automatically run setup in desktop mode by running the runtime, that will not work in server mode as the runtime doesn't allow command line interaction with the setup program.
+
+At this point you will be able to run pgAdmin 4 from the command line in either server or desktop mode, and access it from a web browser using the URL shown in the terminal once pgAdmin has started up.
+
+Setup of an environment on Windows is somewhat more complicated unfortunately, please see `pkg/win32/README.md` for complete details.
+
+### Building the documentation
+
+In order to build the docs, an additional Python package is required in the virtual environment. This can be installed with the pip package manager:
+
+```bash
+$ source venv/bin/activate
+(venv) $ pip install Sphinx
+(venv) $ pip install sphinxcontrib-youtube
+```
+
+The docs can then be built using the Makefile in `$PGADMIN4_SRC`, e.g.
+
+```bash
+(venv) $ make docs
+```
+
+The output can be found in `$PGADMIN4_SRC/docs/en_US/_build/html/index.html`
+
+### Runtime Development
+
+For Electron runtime development:
+
+1. Navigate to the `runtime` directory.
+2. Install dependencies:
+
+```bash
+yarn install
+```
+
+3. Copy:
+
+```text
+dev_config.json.in
+```
+
+to:
+
+```text
+dev_config.json
+```
+
+4. Update the paths to your Python executable and `pgAdmin4.py`.
+
+Start the runtime:
+
+```bash
+yarn run start
+```
+
+### Building packages
+
+Most packages can be built using the Makefile in `$PGADMIN4_SRC`, provided all the setup and configuration above has been completed.
+
+To build a source tarball:
+
+```bash
+(venv) $ make src
+```
+
+To build a PIP Wheel, activate either a Python 3 virtual environment, configured with all the required packages, and then run:
+
+```bash
+(venv) $ make pip
+```
+
+To build the macOS AppBundle, please see `pkg/mac/README.md`.
+
+To build the Windows installer, please see `pkg/win32/README.md`.
+
+## Database Migrations
+
+In order to make changes to the SQLite DB, navigate to the 'web' directory:
+
+```bash
+(venv) $ cd $PGADMIN4_SRC/web
+```
+
+Create a migration file with the following command:
+
+```bash
+(venv) $ FLASK_APP=pgAdmin4.py flask db revision
+```
+
+This will create a file in `$PGADMIN4_SRC/web/migrations/versions/`. Add any changes to the `upgrade` function.
+
+When making schema changes, update the `SCHEMA_VERSION` value in:
+
+```text
+web/pgadmin/model/__init__.py
+```
+
+There is no need to increment the `SETTINGS_SCHEMA_VERSION`.
+
+## Security Issues
+
+**Do not report security vulnerabilities through GitHub issues.**
+
+Potential security issues should be reported to: 
+`security@pgadmin.org`.
+
+Note that this **address should only be used for reporting security issues** that you believe you've found in the design or code of pgAdmin, pgAgent, and the pgAdmin website. It **should not be used to ask security questions**.
+
+If you are unsure whether an issue is a security vulnerability, please lean on the side of caution and report it to the above address. The pgAdmin team will review the report and respond as appropriate.
+
+## Community and Support
+
+For development discussions, use:
+
+`pgadmin-hackers@postgresql.org`
+
+For support options, visit the [pgAdmin support page](https://www.pgadmin.org/support/).
+
+Use the [GitHub issue tracker](https://github.com/pgadmin-org/pgadmin4/issues) for reporting bugs and requesting features, but please follow the guidelines outlined in the "Reporting Issues" section above.
+
+## License
+
+By contributing to pgAdmin 4, you agree that your contributions will be licensed under the project's existing and future license terms.

Dockerfile

@@ -2,7 +2,7 @@
 #
 # pgAdmin 4 - PostgreSQL Tools
 #
-# Copyright (C) 2013 - 2025, The pgAdmin Development Team
+# Copyright (C) 2013 - 2026, The pgAdmin Development Team
 # This software is released under the PostgreSQL Licence
 #
 #########################################################################
@@ -31,51 +31,36 @@ RUN apk add --no-cache \
     yarn \
     zlib-dev
 
-COPY .git .git
-# Create the /pgadmin4 directory and copy the source into it. Explicitly
-# remove the node_modules directory as we'll recreate a clean version, as well
-# as various other files we don't want
+# Create the /pgadmin4 directory and copy the source into it
 COPY web /pgadmin4/web
-RUN rm -rf /pgadmin4/web/*.log \
-           /pgadmin4/web/config_*.py \
-           /pgadmin4/web/node_modules \
-           /pgadmin4/web/regression \
-           `find /pgadmin4/web -type d -name tests` \
-           `find /pgadmin4/web -type f -name .DS_Store`
-
 WORKDIR /pgadmin4/web
 
 # Build the JS vendor code in the app-builder, and then remove the vendor source.
-RUN export CPPFLAGS="-DPNG_ARM_NEON_OPT=0" && \
+RUN --mount=type=bind,source=.git,target=/pgadmin4/.git \
+    --mount=type=tmpfs,target=node_modules \
+    --mount=type=tmpfs,target=pgadmin/static/js/generated/.cache \
+    export CPPFLAGS="-DPNG_ARM_NEON_OPT=0" && \
     npm install -g corepack && \
     corepack enable && \
-    yarn set version berry && \
-    yarn set version 4 && \
     yarn install && \
     yarn run bundle && \
-    rm -rf node_modules \
-           yarn.lock \
+    rm -rf yarn.lock \
            package.json \
            .[^.]* \
            babel.cfg \
            webpack.* \
            jest.config.js \
-           babel.* \
-           ./pgadmin/static/js/generated/.cache \
-           /pgadmin4/.git
+           babel.*
 
 #########################################################################
 # Next, create the base environment for Python
 #########################################################################
 
-FROM alpine:latest AS env-builder
+FROM python:3-alpine AS env-builder
 
 # Install dependencies
-COPY requirements.txt /
 RUN apk add --no-cache \
-        make \
-        python3 \
-        py3-pip && \
+        make && \
     apk add --no-cache --virtual build-deps \
         build-base \
         openssl-dev \
@@ -86,9 +71,9 @@ RUN apk add --no-cache \
         cargo \
         zlib-dev \
         libjpeg-turbo-dev \
-        libpng-dev \
-        python3-dev && \
-    python3 -m venv --system-site-packages --without-pip /venv && \
+        libpng-dev
+COPY requirements.txt /
+RUN python3 -m venv --system-site-packages --without-pip /venv && \
     /venv/bin/python3 -m pip install --no-cache-dir -r requirements.txt && \
     apk del --no-cache build-deps
 
@@ -120,21 +105,16 @@ RUN rm -rf /pgadmin4/docs/en_US/_build/html/_static/*.png
 # Create additional builders to get all of the PostgreSQL utilities
 #########################################################################
 
-FROM postgres:12-alpine AS pg12-builder
 FROM postgres:13-alpine AS pg13-builder
 FROM postgres:14-alpine AS pg14-builder
 FROM postgres:15-alpine AS pg15-builder
 FROM postgres:16-alpine AS pg16-builder
 FROM postgres:17-alpine AS pg17-builder
+FROM postgres:18-alpine AS pg18-builder
 
 FROM alpine:latest AS tool-builder
 
 # Copy the PG binaries
-COPY --from=pg12-builder /usr/local/bin/pg_dump /usr/local/pgsql/pgsql-12/
-COPY --from=pg12-builder /usr/local/bin/pg_dumpall /usr/local/pgsql/pgsql-12/
-COPY --from=pg12-builder /usr/local/bin/pg_restore /usr/local/pgsql/pgsql-12/
-COPY --from=pg12-builder /usr/local/bin/psql /usr/local/pgsql/pgsql-12/
-
 COPY --from=pg13-builder /usr/local/bin/pg_dump /usr/local/pgsql/pgsql-13/
 COPY --from=pg13-builder /usr/local/bin/pg_dumpall /usr/local/pgsql/pgsql-13/
 COPY --from=pg13-builder /usr/local/bin/pg_restore /usr/local/pgsql/pgsql-13/
@@ -160,24 +140,43 @@ COPY --from=pg17-builder /usr/local/bin/pg_dumpall /usr/local/pgsql/pgsql-17/
 COPY --from=pg17-builder /usr/local/bin/pg_restore /usr/local/pgsql/pgsql-17/
 COPY --from=pg17-builder /usr/local/bin/psql /usr/local/pgsql/pgsql-17/
 
+COPY --from=pg18-builder /usr/local/bin/pg_dump /usr/local/pgsql/pgsql-18/
+COPY --from=pg18-builder /usr/local/bin/pg_dumpall /usr/local/pgsql/pgsql-18/
+COPY --from=pg18-builder /usr/local/bin/pg_restore /usr/local/pgsql/pgsql-18/
+COPY --from=pg18-builder /usr/local/bin/psql /usr/local/pgsql/pgsql-18/
+
 #########################################################################
 # Assemble everything into the final container.
 #########################################################################
 
-FROM alpine:latest
+FROM python:3-alpine
+
+# Install runtime dependencies
+RUN apk update && apk upgrade && \
+    apk add \
+        bash \
+        postfix \
+        krb5-libs \
+        libcurl \
+        libjpeg-turbo \
+        shadow \
+        sudo \
+        tzdata \
+        libedit \
+        libldap \
+        libcap \
+        su-exec && \
+    rm -rf /var/cache/apk/*
 
 # Copy in the Python packages
 COPY --from=env-builder /venv /venv
 
 # Copy in the tools
 COPY --from=tool-builder /usr/local/pgsql /usr/local/
-COPY --from=pg17-builder /usr/local/lib/libpq.so.5.17 /usr/lib/
-COPY --from=pg17-builder /usr/lib/libzstd.so.1.5.7 /usr/lib/
-COPY --from=pg17-builder /usr/lib/liblz4.so.1.10.0 /usr/lib/
+COPY --from=pg18-builder /usr/local/lib/libpq.so.5.18 /usr/local/lib/libpq-oauth-18.so /usr/lib/liblz4.so.1.10.0 /usr/lib/
 
-RUN ln -s libpq.so.5.17 /usr/lib/libpq.so.5 && \
-    ln -s libpq.so.5.17 /usr/lib/libpq.so && \
-    ln -s libzstd.so.1.5.7 /usr/lib/libzstd.so.1 && \
+RUN ln -s libpq.so.5.18 /usr/lib/libpq.so.5 && \
+    ln -s libpq.so.5.18 /usr/lib/libpq.so && \
     ln -s liblz4.so.1.10.0 /usr/lib/liblz4.so.1
 
 WORKDIR /pgadmin4
@@ -186,38 +185,27 @@ ENV PYTHONPATH=/pgadmin4
 # Copy in the code and docs
 COPY --from=app-builder /pgadmin4/web /pgadmin4
 COPY --from=docs-builder /pgadmin4/docs/en_US/_build/html/ /pgadmin4/docs
-COPY pkg/docker/run_pgadmin.py /pgadmin4
-COPY pkg/docker/gunicorn_config.py /pgadmin4
+COPY pkg/docker/run_pgadmin.py pkg/docker/gunicorn_config.py /pgadmin4/
 COPY pkg/docker/entrypoint.sh /entrypoint.sh
 
 # License files
 COPY LICENSE /pgadmin4/LICENSE
 
-# Install runtime dependencies and configure everything in one RUN step
-RUN apk add --no-cache \
-        python3 \
-        bash \
-        py3-pip \
-        postfix \
-        krb5-libs \
-        libjpeg-turbo \
-        shadow \
-        sudo \
-        tzdata \
-        libedit \
-        libldap \
-        libcap && \
-    /venv/bin/python3 -m pip install --no-cache-dir gunicorn==23.0.0 && \
+# Configure everything in one RUN step
+RUN /venv/bin/python3 -m pip install --no-cache-dir gunicorn==23.0.0 && \
     find / -type d -name '__pycache__' -exec rm -rf {} + && \
     useradd -r -u 5050 -g root -s /sbin/nologin pgadmin && \
     mkdir -p /run/pgadmin /var/lib/pgadmin && \
     chown pgadmin:root /run/pgadmin /var/lib/pgadmin && \
-    chmod g=u /var/lib/pgadmin && \
+    chmod g=u /run/pgadmin /var/lib/pgadmin && \
     touch /pgadmin4/config_distro.py && \
     chown pgadmin:root /pgadmin4/config_distro.py && \
     chmod g=u /pgadmin4/config_distro.py && \
     chmod g=u /etc/passwd && \
-    setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/python3.12 && \
+    PYBIN="$(ls /usr/local/bin/python3.[0-9][0-9] 2>/dev/null | head -n1)" && \
+    cp "$PYBIN" /usr/local/bin/python3-cap && \
+    setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/python3-cap && \
+    ln -s /usr/local/bin/python3-cap /venv/bin/python3-cap && \
     echo "pgadmin ALL = NOPASSWD: /usr/sbin/postfix start" > /etc/sudoers.d/postfix && \
     echo "pgadminr ALL = NOPASSWD: /usr/sbin/postfix start" >> /etc/sudoers.d/postfix
 

LICENSE

@@ -4,7 +4,7 @@ pgAdmin 4
 This software is released under the PostgreSQL licence.
 
 -------------------------------------------------------------------------------
-Copyright (C) 2013 - 2025, The pgAdmin Development Team
+Copyright (C) 2013 - 2026, The pgAdmin Development Team
 
 Permission to use, copy, modify, and distribute this software and its
 documentation for any purpose, without fee, and without a written agreement is

Make.bat

@@ -52,13 +52,14 @@ REM Main build sequence Ends
 
 :SET_ENVIRONMENT
     ECHO Configuring the environment...
-    IF "%PGADMIN_PYTHON_DIR%" == ""   SET "PGADMIN_PYTHON_DIR=C:\Python313"
+    IF "%PGADMIN_PYTHON_DIR%" == ""   SET "PGADMIN_PYTHON_DIR=C:\Python314"
     IF "%PGADMIN_KRB5_DIR%" == ""     SET "PGADMIN_KRB5_DIR=C:\Program Files\MIT\Kerberos"
     IF "%PGADMIN_POSTGRES_DIR%" == "" SET "PGADMIN_POSTGRES_DIR=C:\Program Files\PostgreSQL\17"
     IF "%PGADMIN_INNOTOOL_DIR%" == "" SET "PGADMIN_INNOTOOL_DIR=C:\Program Files (x86)\Inno Setup 6"
     IF "%PGADMIN_VCREDIST_DIR%" == "" SET "PGADMIN_VCREDIST_DIR=C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Redist\MSVC\14.40.33807"
     IF "%PGADMIN_VCREDIST_FILE%" == "" SET "PGADMIN_VCREDIST_FILE=vc_redist.x64.exe"
     IF "%PGADMIN_SIGNTOOL_DIR%" == "" SET "PGADMIN_SIGNTOOL_DIR=C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64"
+    IF "%PGADMIN_WINDOWS_CSC%" == "" SET "PGADMIN_WINDOWS_CSC="
 
     REM Set additional variables we need
     FOR /F "tokens=3" %%a IN ('findstr /C:"APP_RELEASE =" %WD%\web\version.py')  DO SET APP_MAJOR=%%a
@@ -99,6 +100,11 @@ REM Main build sequence Ends
     ECHO VC++ redist file:          %PGADMIN_VCREDIST_FILE%
     ECHO InnoTool directory:        %PGADMIN_INNOTOOL_DIR%
     ECHO signtool directory:        %PGADMIN_SIGNTOOL_DIR%
+    IF "%PGADMIN_WINDOWS_CSC%" == "" (
+        ECHO Code signing certificate:  [NONE - Signing disabled]
+    ) ELSE (
+        ECHO Code signing certificate:  %PGADMIN_WINDOWS_CSC%
+    )
     ECHO.
     ECHO App version:               %APP_VERSION%
     ECHO App version suffix:        %APP_VERSION_SUFFIX%
@@ -155,10 +161,14 @@ REM Main build sequence Ends
     CD "%TMPDIR%"
 
     REM Note that we must use virtualenv.exe here, as the venv module doesn't allow python.exe to relocate.
-    "%PGADMIN_PYTHON_DIR%\Scripts\virtualenv.exe" venv
+    "%PGADMIN_PYTHON_DIR%\Scripts\virtualenv.exe" venv || EXIT /B 1
 
     XCOPY /S /I /E /H /Y "%PGADMIN_PYTHON_DIR%\DLLs" "%TMPDIR%\venv\DLLs" > nul || EXIT /B 1
-    XCOPY /S /I /E /H /Y "%PGADMIN_PYTHON_DIR%\Lib" "%TMPDIR%\venv\Lib" > nul || EXIT /B 1
+    REM Copy the standard library, but NOT site-packages: the venv already has its
+    REM own seeded pip there, and overwriting only the files the system Python also
+    REM has leaves a mix of two pip versions behind.
+    ROBOCOPY /E /R:3 /W:5 /NFL /NDL /NP "%PGADMIN_PYTHON_DIR%\Lib" "%TMPDIR%\venv\Lib" /XD site-packages
+    CALL :CHECK_ROBOCOPY_ERROR || EXIT /B 1
 
     ECHO Activating virtual environment -  %TMPDIR%\venv...
     CALL "%TMPDIR%\venv\Scripts\activate" || EXIT /B 1
@@ -210,13 +220,18 @@ REM Main build sequence Ends
     RD /Q /S "%WD%\web\pgadmin\static\js\generated\.cache" 1> nul 2>&1
 
     ECHO Copying web directory...
-    ROBOCOPY /S "%WD%\web" "%BUILDROOT%\web" > nul
-    CALL :CHECK_ROBOCOPY_ERROR
+    ROBOCOPY /S /NFL /NDL /NP "%WD%\web" "%BUILDROOT%\web"
+    CALL :CHECK_ROBOCOPY_ERROR || EXIT /B 1
 
     ECHO Installing javascript dependencies...
     CD "%BUILDROOT%\web"
-    CALL yarn set version berry || EXIT /B 1
-    CALL yarn set version 4 || EXIT /B 1
+    SET "YARN_VERSION="
+    FOR /f "delims=" %%v IN ('node -p "require('./package.json').packageManager.split('@')[1]"') DO SET "YARN_VERSION=%%v"
+    IF "%YARN_VERSION%"=="" (
+        ECHO ERROR: Could not determine Yarn version from package.json packageManager field.
+        EXIT /B 1
+    )
+    CALL yarn set version %YARN_VERSION% || EXIT /B 1
     CALL yarn install || EXIT /B 1
     CALL npm rebuild || EXIT /B 1
 
@@ -231,8 +246,18 @@ REM Main build sequence Ends
     RD /Q /S "%BUILDROOT%\web\regression" 1> nul 2>&1
     ECHO Removing tools...
     RD /Q /S "%BUILDROOT%\web\tools" 1> nul 2>&1
-    ECHO Removing yarn cache...
+    ECHO Removing the JavaScript build configuration...
     RD /Q /S "%BUILDROOT%\web\.yarn" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\yarn.lock" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\.yarnrc.yml" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\package.json" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\jest.config.js" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\babel.cfg" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\babel.config.json" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\webpack.config.js" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\webpack.shim.js" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\.eslintrc.js" 1> nul 2>&1
+    DEL /q "%BUILDROOT%\web\.editorconfig" 1> nul 2>&1
     ECHO Removing any existing configurations...
     DEL /q "%BUILDROOT%\web\pgadmin4.db" 1> nul 2>&1
     DEL /q "%BUILDROOT%\web\config_local.py" 1> nul 2>&1
@@ -270,8 +295,13 @@ REM Main build sequence Ends
 
     CD "%BUILDROOT%\runtime\resources\app\"
 
-    CALL yarn set version berry || EXIT /B 1
-    CALL yarn set version 4 || EXIT /B 1
+    SET "YARN_VERSION="
+    FOR /f "delims=" %%v IN ('node -p "require('./package.json').packageManager.split('@')[1]"') DO SET "YARN_VERSION=%%v"
+    IF "%YARN_VERSION%"=="" (
+        ECHO ERROR: Could not determine Yarn version from package.json packageManager field.
+        EXIT /B 1
+    )
+    CALL yarn set version %YARN_VERSION% || EXIT /B 1
     CALL yarn workspaces focus --production || EXIT /B 1
 
     ECHO Removing yarn cache...
@@ -282,7 +312,7 @@ REM Main build sequence Ends
 
     REM WGET
     FOR /f "tokens=*" %%i IN ('npm info electron version') DO SET "ELECTRON_VERSION=%%i"
-    SET ELECTRON_VERSION="35.4.0"
+
     :GET_NW
         wget https://github.com/electron/electron/releases/download/v%ELECTRON_VERSION%/electron-v%ELECTRON_VERSION%-win32-x64.zip -O "%TMPDIR%\electron-v%ELECTRON_VERSION%-win32-x64.zip"
         IF %ERRORLEVEL% NEQ 0 GOTO GET_NW
@@ -304,16 +334,20 @@ REM Main build sequence Ends
     %TMPDIR%\rcedit-x64.exe "%BUILDROOT%\runtime\pgAdmin4.exe" --set-icon "%WD%\pkg\win32\Resources\pgAdmin4.ico"
     %TMPDIR%\rcedit-x64.exe "%BUILDROOT%\runtime\pgAdmin4.exe" --set-version-string "FileDescription" "%APP_NAME%"
     %TMPDIR%\rcedit-x64.exe "%BUILDROOT%\runtime\pgAdmin4.exe" --set-version-string "ProductName" "%APP_NAME%"
-    %TMPDIR%\rcedit-x64.exe "%BUILDROOT%\runtime\pgAdmin4.exe" --set-product-version "%APP_VERSION%""
+    %TMPDIR%\rcedit-x64.exe "%BUILDROOT%\runtime\pgAdmin4.exe" --set-product-version "%APP_VERSION%"
 
-    ECHO Attempting to sign the pgAdmin4.exe...
-    CALL "%PGADMIN_SIGNTOOL_DIR%\signtool.exe" sign /fd certHash /tr http://timestamp.digicert.com /td SHA256 "%BUILDROOT%\runtime\pgAdmin4.exe"
-    IF %ERRORLEVEL% NEQ 0 (
-        ECHO.
-        ECHO ************************************************************
-        ECHO * Failed to sign the pgAdmin4.exe
-        ECHO ************************************************************
-        PAUSE
+    IF NOT "%PGADMIN_WINDOWS_CSC%" == "" (
+        ECHO Attempting to sign the pgAdmin4.exe...
+        CALL "%PGADMIN_SIGNTOOL_DIR%\signtool.exe" sign /sm /n "%PGADMIN_WINDOWS_CSC%" /tr http://timestamp.digicert.com /td sha256 /fd sha1 /v "%BUILDROOT%\runtime\pgAdmin4.exe"
+        IF %ERRORLEVEL% NEQ 0 (
+            ECHO.
+            ECHO ************************************************************
+            ECHO * Failed to sign the pgAdmin4.exe
+            ECHO ************************************************************
+            PAUSE
+        )
+    ) ELSE (
+        ECHO Skipping code signing ^(PGADMIN_WINDOWS_CSC is not set^)...
     )
 
     ECHO Staging PostgreSQL components...
@@ -356,7 +390,11 @@ REM Main build sequence Ends
     DEL /s "%WD%\pkg\win32\installer.iss.in_stage*" > nul
 
     ECHO Creating windows installer using INNO tool...
-    CALL "%PGADMIN_INNOTOOL_DIR%\ISCC.exe" "%WD%\pkg\win32\installer.iss" "/SpgAdminSigntool=%PGADMIN_SIGNTOOL_DIR%\signtool.exe sign /fd certHash /tr http://timestamp.digicert.com /td SHA256 $f" || EXIT /B 1
+    IF NOT "%PGADMIN_WINDOWS_CSC%" == "" (
+        CALL "%PGADMIN_INNOTOOL_DIR%\ISCC.exe" "%WD%\pkg\win32\installer.iss" "/SpgAdminSigntool=%PGADMIN_SIGNTOOL_DIR%\signtool.exe sign /sm /n $q%PGADMIN_WINDOWS_CSC%$q /tr http://timestamp.digicert.com /td sha256 /fd sha1 /v $f" || EXIT /B 1
+    ) ELSE (
+        CALL "%PGADMIN_INNOTOOL_DIR%\ISCC.exe" "%WD%\pkg\win32\installer.iss" || EXIT /B 1
+    )
 
     ECHO Renaming installer...
     MOVE "%WD%\pkg\win32\Output\pgadmin4-setup.exe" "%DISTROOT%\%INSTALLERNAME%" > nul || EXIT /B 1
@@ -374,6 +412,11 @@ REM Main build sequence Ends
     EXIT /B 0
 
 :VERIFY_SIGNATURE
+    IF "%PGADMIN_WINDOWS_CSC%" == "" (
+        ECHO Skipping signature verification ^(PGADMIN_WINDOWS_CSC is not set^)...
+        EXIT /B 0
+    )
+
     ECHO Verifying the installer signature...
 
     CALL "%PGADMIN_SIGNTOOL_DIR%\signtool.exe" verify /pa /v "%DISTROOT%\%INSTALLERNAME%"

Makefile

@@ -2,7 +2,7 @@
 #
 # pgAdmin 4 - PostgreSQL Tools
 #
-# Copyright (C) 2013 - 2025, The pgAdmin Development Team
+# Copyright (C) 2013 - 2026, The pgAdmin Development Team
 # This software is released under the PostgreSQL Licence
 #
 #########################################################################

README.md

@@ -9,12 +9,12 @@ tarball or a git checkout.
 
 ## Architecture
 
-pgAdmin 4 is written as a web application with Python(Flask) on the server side
+pgAdmin 4 is written as a web application with Python (Flask) on the server side
 and ReactJS, HTML5 with CSS for the client side processing and UI.
 
 Although developed using web technologies, pgAdmin 4 can be deployed either on
 a web server using a browser, or standalone on a workstation. The runtime/
-subdirectory contains an Electron based runtime application intended to allow this,
+subdirectory contains an Electron-based runtime application intended to allow this,
 which will fork a Python server process and display the UI.
 
 ## Prerequisites
@@ -31,11 +31,11 @@ corepack enable
 
 # Building the Web Assets
 
-pgAdmin is dependent on a number of third party Javascript libraries. These,
-along with it's own Javascript code, CSS code and images must be
+pgAdmin is dependent on a number of third-party JavaScript libraries. These,
+along with its own JavaScript code, CSS code and images must be
 compiled into a "bundle" which is transferred to the browser for execution
 and rendering. This is far more efficient than simply requesting each
-asset as it's needed by the client.
+asset as it is needed by the client.
 
 To create the bundle, you will need the 'yarn' package management tool to be
 installed. Then, you can run the following commands on a *nix system to
@@ -60,7 +60,7 @@ C:\$PGADMIN4_SRC\web> yarn run bundle
 
 In order to run the Python code, a suitable runtime environment is required.
 Python version 3.9 and later are currently supported. It is recommended that a
-Python Virtual Environment is setup for this purpose, rather than using the
+Python virtual environment is set up for this purpose, rather than using the
 system Python environment. On Linux and Mac systems, the process is fairly
 simple - adapt as required for your distribution:
 
@@ -112,17 +112,17 @@ simple - adapt as required for your distribution:
    # Change pgAdmin data directory
    DATA_DIR = '/Users/myuser/.pgadmin_dev'
 
-   #Change pgAdmin server and port
+   # Change pgAdmin server and port
    DEFAULT_SERVER = '127.0.0.1'
    DEFAULT_SERVER_PORT = 5051
 
    # Switch between server and desktop mode
    SERVER_MODE = True
 
-   #Change pgAdmin config DB path in case external DB is used.
+   # Change pgAdmin config DB path in case an external DB is used.
    CONFIG_DATABASE_URI="postgresql://postgres:postgres@localhost:5436/pgadmin"
 
-   #Setup SMTP
+   # Set up SMTP
    MAIL_SERVER = 'smtp.gmail.com'
    MAIL_PORT = 465
    MAIL_USE_SSL = True
@@ -172,7 +172,7 @@ server or desktop mode, and access it from a web browser using the URL shown in
 the terminal once pgAdmin has started up.
 
 Setup of an environment on Windows is somewhat more complicated unfortunately,
-please see *pkg/win32/README.txt* for complete details.
+please see *pkg/win32/README.md* for complete details.
 
 # Building the documentation
 
@@ -226,9 +226,9 @@ with all the required packages, and then run:
 (venv) $ make pip
 ```
 
-To build the macOS AppBundle, please see *pkg/mac/README*.
+To build the macOS AppBundle, please see *pkg/mac/README.md*.
 
-To build the Windows installer, please see *pkg/win32/README.txt*.
+To build the Windows installer, please see *pkg/win32/README.md*.
 # Create Database Migrations
 
 In order to make changes to the SQLite DB, navigate to the 'web' directory:

docs/en_US/ai_tools.rst

@@ -0,0 +1,281 @@
+.. _ai_tools:
+
+*******************
+`AI Reports`:index:
+*******************
+
+**AI Reports** is a feature that provides AI-powered database analysis and insights
+using Large Language Models (LLMs). Use the *Tools → AI Reports* menu to access
+the various AI-powered reports.
+
+The AI Reports feature allows you to:
+
+ * Generate security reports to identify potential security vulnerabilities and configuration issues.
+
+ * Create performance reports with optimization recommendations for queries and configurations.
+
+ * Perform design reviews to analyze database schema structure and suggest improvements.
+
+**Prerequisites:**
+
+Before using AI Reports, you must:
+
+ 1. Ensure AI features are enabled in the server configuration (set ``LLM_ENABLED`` to ``True`` in ``config.py``).
+
+ 2. Configure an LLM provider in :ref:`Preferences → AI <preferences>`.
+
+**Note:**
+
+ * AI Reports using cloud providers (Anthropic, OpenAI) require an active internet connection.
+   Local providers (Ollama, Docker Model Runner) do not require internet access.
+
+ * API usage may incur costs depending on your LLM provider's pricing model.
+   Local providers (Ollama, Docker Model Runner) are free to use.
+
+ * The quality and accuracy of reports depend on the LLM provider and model configured.
+
+
+Configuring AI Reports
+**********************
+
+To configure AI Reports, navigate to *File → Preferences → AI* (or click the *Settings*
+button and select *AI*).
+
+.. image:: images/preferences_ai.png
+    :alt: AI preferences
+    :align: center
+
+Select your preferred LLM provider from the dropdown:
+
+**Anthropic**
+  Use Claude models from Anthropic, or any Anthropic-compatible API provider.
+
+  * **API URL**: Custom API endpoint URL (leave empty for default: https://api.anthropic.com/v1).
+  * **API Key File**: Path to a file containing your Anthropic API key (obtain from https://console.anthropic.com/). This path refers to the filesystem where the pgAdmin server is running (e.g., inside the container if using Docker). The ``~`` prefix is expanded to the home directory of the user running the pgAdmin server process. Optional when using a custom URL with a provider that does not require authentication.
+  * **Model**: Select from available Claude models (e.g., claude-sonnet-4-20250514).
+
+**OpenAI**
+  Use GPT models from OpenAI, or any OpenAI-compatible API provider (e.g.,
+  LiteLLM, LM Studio, EXO, or other local inference servers).
+
+  * **API URL**: Custom API endpoint URL (leave empty for default: https://api.openai.com/v1). Include the ``/v1`` path prefix if required by your provider.
+  * **API Key File**: Path to a file containing your OpenAI API key (obtain from https://platform.openai.com/). This path refers to the filesystem where the pgAdmin server is running (e.g., inside the container if using Docker). The ``~`` prefix is expanded to the home directory of the user running the pgAdmin server process. Optional when using a custom URL with a provider that does not require authentication.
+  * **Model**: Select from available GPT models (e.g., gpt-4).
+
+**Ollama**
+  Use locally-hosted open-source models via Ollama. Requires a running Ollama instance.
+
+  * **API URL**: The URL of your Ollama server (default: http://localhost:11434).
+  * **Model**: Enter the name of the Ollama model to use (e.g., llama2, mistral).
+
+**Docker Model Runner**
+  Use models running in Docker Desktop's built-in model runner (available in Docker Desktop 4.40+).
+  No API key is required.
+
+  * **API URL**: The URL of the Docker Model Runner API (default: http://localhost:12434).
+  * **Model**: Select from available models or enter a custom model name.
+
+.. note:: You can also use the *OpenAI* provider with a custom API URL for any
+   OpenAI-compatible endpoint, including Docker Model Runner and other local
+   inference servers.
+
+After configuring your provider, click *Save* to apply the changes.
+
+
+.. _ai_data_handling:
+
+Data Handling and Provider Selection
+************************************
+
+When a cloud LLM provider is configured, pgAdmin transmits information about
+your database to that provider's API. Depending on the feature in use, this may
+include schema definitions such as table, column, index and constraint names
+and data types; server and database configuration settings read from
+``pg_settings``; query text; and EXPLAIN plan output. The *AI Assistant* in the
+Query Tool is also able to run queries against your database, within a read-only
+transaction and limited to 1000 rows, so row data may be included where the
+assistant determines it is needed to answer a question.
+
+None of this is transmitted unless you invoke an AI feature, and none of it is
+transmitted at all when no provider has been configured, which is the default;
+when AI features have been disabled by the administrator through the
+``LLM_ENABLED`` setting; or when a locally hosted provider such as Ollama or
+Docker Model Runner is configured.
+
+Each provider processes this data under its own terms of service, privacy policy
+and legal jurisdiction, and operates its infrastructure in locations of its own
+choosing. If you work in an environment subject to data residency requirements,
+procurement policies, or sector-specific rules governing the handling of
+database metadata, review both the provider's terms and your own organisation's
+policies before enabling a cloud provider.
+
+The providers listed in pgAdmin reflect the APIs that pgAdmin is able to
+communicate with. Their inclusion is not a recommendation, and no provider is
+enabled by default.
+
+
+Security Reports
+****************
+
+Security Reports analyze your PostgreSQL server, database, or schema for potential
+security vulnerabilities and configuration issues.
+
+To generate a security report:
+
+1. In the *Browser* tree, select a server, database, or schema.
+
+2. Choose *Tools → AI Reports → Security* from the menu, or right-click the
+   object and select *Security* from the context menu.
+
+3. The report will be generated and displayed in a new tab.
+
+.. image:: images/ai_security_report.png
+    :alt: AI security report
+    :align: center
+
+**Security Report Scope:**
+
+* **Server Level**: Analyzes server configuration, authentication settings, roles, and permissions.
+
+* **Database Level**: Reviews database-specific security settings, roles with database access, and object permissions.
+
+* **Schema Level**: Examines schema permissions, object ownership, and access controls.
+
+Each report includes:
+
+* **Security Findings**: Identified vulnerabilities or security concerns.
+
+* **Risk Assessment**: Severity levels for each finding (Critical, High, Medium, Low).
+
+* **Recommendations**: Specific actions to remediate security issues.
+
+* **Best Practices**: General security recommendations for PostgreSQL.
+
+
+Performance Reports
+*******************
+
+Performance Reports analyze query performance, configuration settings, and provide
+optimization recommendations.
+
+To generate a performance report:
+
+1. In the *Browser* tree, select a server or database.
+
+2. Choose *Tools → AI Reports → Performance* from the menu, or right-click the
+   object and select *Performance* from the context menu.
+
+3. The report will be generated and displayed in a new tab.
+
+**Performance Report Scope:**
+
+* **Server Level**: Analyzes server configuration parameters, resource utilization, and overall server performance metrics.
+
+* **Database Level**: Reviews database-specific configuration, query performance, index usage, and table statistics.
+
+Each report includes:
+
+* **Performance Metrics**: Key performance indicators and statistics.
+
+* **Configuration Analysis**: Review of relevant configuration parameters.
+
+* **Query Optimization**: Recommendations for improving slow queries.
+
+* **Index Recommendations**: Suggestions for adding, removing, or modifying indexes.
+
+* **Capacity Planning**: Resource utilization trends and recommendations.
+
+
+Design Review Reports
+*********************
+
+Design Review Reports analyze your database schema structure and suggest
+improvements for normalization, naming conventions, and best practices.
+
+To generate a design review report:
+
+1. In the *Browser* tree, select a database or schema.
+
+2. Choose *Tools → AI Reports → Design* from the menu, or right-click the
+   object and select *Design* from the context menu.
+
+3. The report will be generated and displayed in a new tab.
+
+**Design Review Scope:**
+
+* **Database Level**: Reviews overall database structure, schema organization, and cross-schema dependencies.
+
+* **Schema Level**: Analyzes tables, views, functions, and other objects within the schema.
+
+Each report includes:
+
+* **Schema Structure Analysis**: Review of table structures, relationships, and constraints.
+
+* **Normalization Review**: Recommendations for database normalization (1NF, 2NF, 3NF, etc.).
+
+* **Naming Conventions**: Suggestions for consistent naming patterns.
+
+* **Data Type Usage**: Review of data type choices and recommendations.
+
+* **Index Design**: Analysis of indexing strategy.
+
+* **Best Practices**: General PostgreSQL schema design recommendations.
+
+
+Working with Reports
+********************
+
+All AI reports are displayed in a dedicated panel with the following features:
+
+**Report Display**
+  Reports are formatted as Markdown and rendered with syntax highlighting for SQL code.
+
+**Toolbar Actions**
+
+  * **Stop** - Cancel the current report generation. This is useful if the report
+    is taking too long or if you want to change parameters.
+
+  * **Regenerate** - Generate a new report for the same object. Useful when you
+    want to get a fresh analysis or if data has changed.
+
+  * **Download** - Download the report as a Markdown (.md) file. The filename
+    includes the report type, object name, and date for easy identification.
+
+**Multiple Reports**
+  You can generate and view multiple reports simultaneously. Each report opens in
+  a new tab, allowing you to compare reports across different servers, databases,
+  or schemas.
+
+**Report Management**
+  Each report tab can be closed individually by clicking the *X* in the tab.
+  Panel titles show the object name and report type for easy identification.
+
+**Copying Content**
+  You can select and copy text from reports to use in documentation or share with
+  your team.
+
+
+Troubleshooting
+***************
+
+**"AI features are disabled in the server configuration"**
+  The administrator has disabled AI features on the server. Contact your
+  pgAdmin administrator to enable the ``LLM_ENABLED`` configuration option.
+
+**"Please configure an LLM provider in Preferences"**
+  You need to configure an LLM provider before using AI Reports. See *Configuring AI Reports* above.
+
+**"Please connect to the server/database first"**
+  You must establish a connection to the server or database before generating reports.
+
+**API Connection Errors**
+  * Verify your API key is correct (for Anthropic and OpenAI).
+  * Check your internet connection (for cloud providers).
+  * For Ollama, ensure the Ollama server is running and accessible.
+  * For Docker Model Runner, ensure Docker Desktop 4.40+ is running with the model runner enabled.
+  * Check that your firewall allows connections to the LLM provider's API.
+
+**Report Generation Fails**
+  * Check the pgAdmin logs for detailed error messages.
+  * Verify the database connection is still active.
+  * Ensure the selected model is available for your account/subscription.

docs/en_US/backup_dialog.rst

@@ -77,13 +77,13 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 * Move switches in the **Sections** field box to select a portion of the object
   that will be backed up.
 
-   * Move the switch next to *Pre-data* towards right position to include all
+   * Move the switch next to *Pre-data* to the *Yes* position to include all
      data definition items not included in the data or post-data item lists.
 
-   * Move the switch next to *Data* towards right position to backup actual table
+   * Move the switch next to *Data* to the *Yes* position to backup actual table
      data, large-object contents, and sequence values.
 
-   * Move the switch next to *Post-data* towards right position to include
+   * Move the switch next to *Post-data* to the *Yes* position to include
      definitions of indexes, triggers, rules, and constraints other than
      validated check constraints.
 
@@ -94,13 +94,13 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 * Move switches in the **Type of objects** field box to specify details about
   the type of objects that will be backed up.
 
-   * Move the switch next to *Only data* towards right position to limit the back
+   * Move the switch next to *Only data* to the *Yes* position to limit the back
      up to data.
 
    * Move the switch next to *Only schemas* to limit the back up to schema-level
      database objects.
 
-   * Move the switch next to *Blobs* towards left position to exclude large
+   * Move the switch next to *Blobs* to the *No* position to exclude large
      objects in the backup.
 
 .. image:: images/backup_do_not_save.png
@@ -110,36 +110,36 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 * Move switches in the **Do not save** field box to select the objects that will
   not be included in the backup.
 
-   * Move the switch next to *Owner* towards right position to exclude commands
+   * Move the switch next to *Owner* to the *Yes* position to exclude commands
      that set object ownership.
 
-   * Move the switch next to *Privileges* towards right position to exclude
+   * Move the switch next to *Privileges* to the *Yes* position to exclude
      commands that create access privileges.
 
-   * Move the switch next to *Tablespaces* towards right position to exclude
+   * Move the switch next to *Tablespaces* to the *Yes* position to exclude
      tablespaces.
 
-   * Move the switch next to *Unlogged table data* towards right position to
+   * Move the switch next to *Unlogged table data* to the *Yes* position to
      exclude the contents of unlogged tables.
 
-   * Move the switch next to *Comments* towards right position to exclude
+   * Move the switch next to *Comments* to the *Yes* position to exclude
      commands that set the comments. **Note:** This option is visible only for
      database server greater than or equal to 11.
 
-   * Move the switch next to *Publications* towards right position to exclude
+   * Move the switch next to *Publications* to the *Yes* position to exclude
      publications.
 
-   * Move the switch next to *Subscriptions* towards right position to exclude
+   * Move the switch next to *Subscriptions* to the *Yes* position to exclude
      subscriptions.
 
-   * Move the switch next to *Security labels* towards right position to exclude
+   * Move the switch next to *Security labels* to the *Yes* position to exclude
      Security labels.
 
-   * Move the switch next to *Toast compressions* towards right position to exclude
+   * Move the switch next to *Toast compressions* to the *Yes* position to exclude
      Toast compressions. **Note:** This option is visible only for
      database server greater than or equal to 14.
 
-   * Move the switch next to *Table access methods* towards right position to exclude
+   * Move the switch next to *Table access methods* to the *Yes* position to exclude
      Table access methods. **Note:** This option is visible only for
      database server greater than or equal to 15.
 
@@ -150,7 +150,7 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 Click the *Query Options* tab to continue. Use these additional fields to specify
 the type of statements that should be included in the backup.
 
-   * Move the switch next to *Use INSERT commands* towards right position to
+   * Move the switch next to *Use INSERT commands* to the *Yes* position to
      dump the data in the form of INSERT statements rather than using a COPY
      command.  Please note: this may make restoration from backup slow.
 
@@ -165,16 +165,16 @@ the type of statements that should be included in the backup.
      **Note:** This option is visible only for database server greater than or
      equal to 12.
 
-   * Move the switch next to *Include CREATE DATABASE statement* towards right
+   * Move the switch next to *Include CREATE DATABASE statement* to the *Yes*
      position to include a command in the backup that creates a new database
      when restoring the backup.
 
-   * Move the switch next to *Include DROP DATABASE statement* towards right
+   * Move the switch next to *Include DROP DATABASE statement* to the *Yes*
      position to include a command in the backup that will drop any existing
      database object with the same name before recreating the object during a
      backup.
 
-   * Move the switch next to *Include IF EXISTS clause* towards right
+   * Move the switch next to *Include IF EXISTS clause* to the *Yes*
      position to add an IF EXISTS clause to drop databases and other objects.
      This option is not valid unless *Include DROP DATABASE statement* is also set.
 
@@ -185,17 +185,17 @@ the type of statements that should be included in the backup.
 Click the *Table Options* tab to continue. Use the fields in the *Table Options*
 tab related to tables that should be included in the backup.
 
-   * Move the switch next to *Use Column INSERTS* towards right position to dump
+   * Move the switch next to *Use Column INSERTS* to the *Yes* position to dump
      the data in the form of INSERT statements and include explicit column
      names. Please note: this may make restoration from backup slow.
 
-   * Move the switch next to *Load via partition root* towards right position,
+   * Move the switch next to *Load via partition root* to the *Yes* position,
      so when dumping a COPY or INSERT statement for a partitioned table, target
      the root of the partitioning hierarchy which contains it rather than the
      partition itself. **Note:** This option is visible only for database server
      greater than or equal to 11.
 
-   * Move the switch next to *Enable row security* towards right position to
+   * Move the switch next to *Enable row security* to the *Yes* position to
      set row_security to on instead, allowing the user to dump the parts of the
      contents of the table that they have access to. This option is relevant
      only when dumping the contents of a table which has row security.
@@ -235,10 +235,10 @@ tab to provide other backup options.
   that should be excluded from the backup.
 
    * Move the switch next to *Triggers* (active when creating a data-only backup)
-     towards right position to include commands that will disable triggers on the
+     to the *Yes* position to include commands that will disable triggers on the
      target table while the data is being loaded.
 
-   * Move the switch next to *$ quoting* towards right position to enable dollar
+   * Move the switch next to *$ quoting* to the *Yes* position to enable dollar
      quoting within function bodies; if disabled, the function body will be
      quoted using SQL standard string syntax.
 
@@ -249,13 +249,13 @@ tab to provide other backup options.
 * Move switches in the **Miscellaneous** field box to specify miscellaneous
   backup options.
 
-   * Move the switch next to *Verbose messages* towards left position to instruct
+   * Move the switch next to *Verbose messages* to the *No* position to instruct
      *pg_dump* to exclude verbose messages.
 
-   * Move the switch next to *Force double quotes on identifiers* towards right
+   * Move the switch next to *Force double quotes on identifiers* to the *Yes*
      position to force the quoting of all identifiers.
 
-   * Move the switch next to *Use SET SESSION AUTHORIZATION* towards right
+   * Move the switch next to *Use SET SESSION AUTHORIZATION* to the *Yes*
      position to include a statement that will use a SET SESSION AUTHORIZATION
      command to determine object ownership (instead of an ALTER OWNER command).
 
@@ -265,9 +265,9 @@ tab to provide other backup options.
    * Use the *Extra float digits* field to use the specified value when dumping
      floating-point data, instead of the maximum available precision.
 
-   * Use the *Lock wait timeout* field to do not wait forever to acquire shared
-     table locks at the beginning of the dump. Instead, fail if unable to lock a
-     table within the specified timeout.
+   * Use the *Lock wait timeout* field to specify a timeout rather than waiting
+     indefinitely to acquire shared table locks at the beginning of the dump.
+     If unable to lock a table within the specified timeout, the operation will fail.
 
 Click the *Objects* tab to continue.
 
@@ -287,6 +287,6 @@ command:
 
 * Click the *Cancel* button to exit without saving work.
 
-pgAdmin will run the backup process in background. You can view all the background
-process with there running status and logs on the :ref:`Processes <processes>`
-tab
+pgAdmin will run the backup process in the background. You can view all the background
+processes with their running status and logs on the :ref:`Processes <processes>`
+tab.

docs/en_US/backup_globals_dialog.rst

@@ -34,6 +34,6 @@ statements that should be included in the backup.
 Click the *Backup* button to build and execute a command based on your
 selections; click the *Cancel* button to exit without saving work.
 
-pgAdmin will run the backup process in background. You can view all the background
-process with there running status and logs on the :ref:`Processes <processes>`
-tab
+pgAdmin will run the backup process in the background. You can view all the background
+processes with their running status and logs on the :ref:`Processes <processes>`
+tab.

docs/en_US/backup_server_dialog.rst

@@ -34,7 +34,7 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 * Move switches in the **Type of objects** field box to specify details about
   the type of objects that will be backed up.
 
-   * Move the switch next to *Only data* towards right position to limit the back
+   * Move the switch next to *Only data* to the *Yes* position to limit the back
      up to data.
 
    * Move the switch next to *Only schemas* to limit the back up to schema-level
@@ -52,39 +52,39 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 * Move switches in the **Do not save** field box to select the objects that will
   not be included in the backup.
 
-   * Move the switch next to *Owner* towards right position to exclude commands
+   * Move the switch next to *Owner* to the *Yes* position to exclude commands
      that set object ownership.
 
-   * Move the switch next to *Role passwords* towards right position to exclude
+   * Move the switch next to *Role passwords* to the *Yes* position to exclude
      passwords for roles.
 
-   * Move the switch next to *Privileges* towards right position to exclude
+   * Move the switch next to *Privileges* to the *Yes* position to exclude
      commands that create access privileges.
 
-   * Move the switch next to *Tablespaces* towards right position to exclude
+   * Move the switch next to *Tablespaces* to the *Yes* position to exclude
      tablespaces.
 
-   * Move the switch next to *Unlogged table data* towards right position to
+   * Move the switch next to *Unlogged table data* to the *Yes* position to
      exclude the contents of unlogged tables.
 
-   * Move the switch next to *Comments* towards right position to exclude
+   * Move the switch next to *Comments* to the *Yes* position to exclude
      commands that set the comments. **Note:** This option is visible only for
      database server greater than or equal to 11.
 
-   * Move the switch next to *Publications* towards right position to exclude
+   * Move the switch next to *Publications* to the *Yes* position to exclude
      publications.
 
-   * Move the switch next to *Subscriptions* towards right position to exclude
+   * Move the switch next to *Subscriptions* to the *Yes* position to exclude
      subscriptions.
 
-   * Move the switch next to *Security labels* towards right position to exclude
+   * Move the switch next to *Security labels* to the *Yes* position to exclude
      Security labels.
 
-   * Move the switch next to *Toast compressions* towards right position to exclude
+   * Move the switch next to *Toast compressions* to the *Yes* position to exclude
      Toast compressions. **Note:** This option is visible only for
      database server greater than or equal to 14.
 
-   * Move the switch next to *Table access methods* towards right position to exclude
+   * Move the switch next to *Table access methods* to the *Yes* position to exclude
      Table access methods. **Note:** This option is visible only for
      database server greater than or equal to 15.
 
@@ -95,7 +95,7 @@ tab to provide options related to data or pgAdmin objects that correspond to *pg
 Click the *Query Options* tab to continue. Use these additional fields to specify
 the type of statements that should be included in the backup.
 
-   * Move the switch next to *Use INSERT commands* towards right position to
+   * Move the switch next to *Use INSERT commands* to the *Yes* position to
      dump the data in the form of INSERT statements rather than using a COPY
      command.  Please note: this may make restoration from backup slow.
 
@@ -110,12 +110,12 @@ the type of statements that should be included in the backup.
      **Note:** This option is visible only for database server greater than or
      equal to 12.
 
-   * Move the switch next to *Include DROP DATABASE statement* towards right
+   * Move the switch next to *Include DROP DATABASE statement* to the *Yes*
      position to include a command in the backup that will drop any existing
      database object with the same name before recreating the object during a
      backup.
 
-   * Move the switch next to *Include IF EXISTS clause* towards right
+   * Move the switch next to *Include IF EXISTS clause* to the *Yes*
      position to add an IF EXISTS clause to drop databases and other objects.
      This option is not valid unless *Include DROP DATABASE statement* is also set.
 
@@ -126,11 +126,11 @@ the type of statements that should be included in the backup.
 Click the *Table Options* tab to continue. Use the fields in the *Table Options*
 tab related to tables that should be included in the backup.
 
-   * Move the switch next to *Use Column INSERTS* towards right position to dump
+   * Move the switch next to *Use Column INSERTS* to the *Yes* position to dump
      the data in the form of INSERT statements and include explicit column
      names. Please note: this may make restoration from backup slow.
 
-   * Move the switch next to *Load via partition root* towards right position,
+   * Move the switch next to *Load via partition root* to the *Yes* position,
      so when dumping a COPY or INSERT statement for a partitioned table, target
      the root of the partitioning hierarchy which contains it rather than the
      partition itself. **Note:** This option is visible only for database server
@@ -147,10 +147,10 @@ tab to provide other backup options.
   that should be excluded from the backup.
 
    * Move the switch next to *Triggers* (active when creating a data-only backup)
-     towards right position to include commands that will disable triggers on the
+     to the *Yes* position to include commands that will disable triggers on the
      target table while the data is being loaded.
 
-   * Move the switch next to *$ quoting* towards right position to enable dollar
+   * Move the switch next to *$ quoting* to the *Yes* position to enable dollar
      quoting within function bodies; if disabled, the function body will be
      quoted using SQL standard string syntax.
 
@@ -161,13 +161,13 @@ tab to provide other backup options.
 * Move switches in the **Miscellaneous** field box to specify miscellaneous
   backup options.
 
-   * Move the switch next to *Verbose messages* towards left position to instruct
+   * Move the switch next to *Verbose messages* to the *No* position to instruct
      *pg_dumpall* to exclude verbose messages.
 
-   * Move the switch next to *Force double quotes on identifiers* towards right
+   * Move the switch next to *Force double quotes on identifiers* to the *Yes*
      position to force the quoting of all identifiers.
 
-   * Move the switch next to *Use SET SESSION AUTHORIZATION* towards right
+   * Move the switch next to *Use SET SESSION AUTHORIZATION* to the *Yes*
      position to include a statement that will use a SET SESSION AUTHORIZATION
      command to determine object ownership (instead of an ALTER OWNER command).
 
@@ -177,9 +177,9 @@ tab to provide other backup options.
    * Use the *Extra float digits* field to use the specified value when dumping
      floating-point data, instead of the maximum available precision.
 
-   * Use the *Lock wait timeout* field to do not wait forever to acquire shared
-     table locks at the beginning of the dump. Instead, fail if unable to lock a
-     table within the specified timeout.
+   * Use the *Lock wait timeout* field to specify a timeout rather than waiting
+     indefinitely to acquire shared table locks at the beginning of the dump.
+     If unable to lock a table within the specified timeout, the operation will fail.
 
 When you’ve specified the details that will be incorporated into the pg_dumpall
 command:
@@ -189,6 +189,6 @@ command:
 
 * Click the *Cancel* button to exit without saving work.
 
-pgAdmin will run the backup process in background. You can view all the background
-process with there running status and logs on the :ref:`Processes <processes>`
-tab
+pgAdmin will run the backup process in the background. You can view all the background
+processes with their running status and logs on the :ref:`Processes <processes>`
+tab.

docs/en_US/cloud_aws_rds.rst

@@ -91,8 +91,8 @@ button to deploy the instance on Amazon RDS.
 
 Once you click on the finish, one background process will start which will
 deploy the instance in the cloud and monitor the progress of the deployment.
-You can view all the background process with there running status and logs
-on the :ref:`Processes <processes>` tab
+You can view all the background processes with their running status and logs
+on the :ref:`Processes <processes>` tab.
 
 The Server will be added to the tree with the cloud deployment icon. Once the
 deployment is done, the server details will be updated.

docs/en_US/cloud_azure_database.rst

@@ -107,8 +107,8 @@ button to deploy the instance on Azure Database.
 
 Once you click on the finish, one background process will start which will
 deploy the instance in the cloud and monitor the progress of the deployment.
-You can view all the background process with there running status and logs
-on the :ref:`Processes <processes>` tab
+You can view all the background processes with their running status and logs
+on the :ref:`Processes <processes>` tab.
 
 .. image:: images/cloud_azure_bg_process_watcher.png
     :alt: Cloud Deployment

docs/en_US/cloud_deployment.rst

@@ -4,9 +4,9 @@
 `PostgreSQL Cloud Deployment`:index:
 *************************************
 
-A PostgreSQL server can be deployed on the Amazon, EDB BigAnimal, Azure,
-Google cloud using this module. In future more cloud provider options will
-be available.
+A PostgreSQL server can be deployed on the Amazon, Azure, Google cloud
+using this module. In future more cloud provider options will be
+available.
 
 To launch the *Cloud Deployment...* tool, right click on the *Server Group* or
 *Server* of the tree control, and select *Deploy a Cloud Instance* from the
@@ -16,6 +16,5 @@ To launch the *Cloud Deployment...* tool, right click on the *Server Group* or
    :maxdepth: 2
 
    cloud_aws_rds
-   cloud_edb_biganimal
    cloud_azure_database
    cloud_google_cloud_sql

docs/en_US/cloud_edb_biganimal.rst

@@ -1,110 +0,0 @@
-.. _cloud_edb_biganimal:
-
-******************************************
-`EDB BigAnimal Cloud Deployment`:index:
-******************************************
-
-To deploy a PostgreSQL server on the EDB BigAnimal cloud, follow the below steps.
-
-.. image:: images/cloud_provider_for_postgresql.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-Once you launch the tool, select the EDB BigAnimal option.
-Click on the *Next* button to proceed further.
-
-.. image:: images/cloud_biganimal_credentials.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-The next steps is to authenticate the user to EDB BigAninal.
-Click the given button to authenticate, by clicking the button, the user
-will be redirected to the new tab for the verification.
-Once you confirm the one time code, the pgAdmin will automatically detect it
-and the next button will be enabled. To proceed further, click on the next button.
-
-.. image:: images/cloud_biganimal_cluster.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-* Use the *Project* field to choose a project in your Biganimal account.
-
-* Use the *Cluster type* field to choose a cluster type.
-
-* Use the *No. of Standby Replicas* field to specify the replicas if you have selected the High Availability cluster.
-
-* Use the *Cluster provider* field to choose the provider.
-
-
-.. image:: images/cloud_biganimal_instance.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-Use the fields from the Instance Specification tab to specify the Instance
-details.
-
-* Use the *Cluster name* field to add a cluster name for the PostgreSQL
-  server; the name specified will be displayed in the *Object Explorer* too.
-
-* Use the *Region* field to select the region.
-
-* Use the *Public IP range* field to specify the IP Address range for permitting the
-  inbound traffic. Leave it blank for 0.0.0.0/0
-
-* Use the *Instance type* field to select the instance type.
-
-* Use the *Instance series* field to select the instance series.
-
-* Use the *Instance size* field to allocate the computational, network, and
-  memory capacity required by planned workload of this DB instance.
-
-* Use the *Volume type* field to select the instance storage type.
-
-* Use the *Volume properties* field to specify the storage capacity. This field is specific to Azure.
-
-* Use the *Volume size* field to specify the storage size. This field is specific to AWS.
-
-* Use the *Volume IOPS* field to specify the storage IOPS. This field is specific to AWS.
-
-* Use the *Disk throughput* field to specify the disk throughput. This field is specific to AWS.
-
-
-.. image:: images/cloud_biganimal_database.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-Use the fields from the Database Details tab to specify the Instance details.
-
-* Use the drop-down list box in the *Server group* field to select the parent
-  node for the server; the server will be displayed in the *Object Explorer*
-  within the specified group.
-
-* Use the *Database type* field to specify the PostgreSQL
-  type, EnterpriseDB PostgreSQL Advanced Server or PostgreSQL.
-
-* Use the *PostgreSQL version* field to select the database version.
-
-* Use the *Database Password* field to provide a password that will be supplied when
-  authenticating with the server.
-
-* Use the *Confirm password* field to repeat the password.
-
-
-.. image:: images/cloud_biganimal_review.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-At the end, review the Cluster details that you provided. Click on Finish
-button to deploy the instance on EDB BigAnimal.
-
-.. image:: images/cloud_deployment_tree.png
-    :alt: Cloud Deployment Provider
-    :align: center
-
-Once you click on the finish, one background process will start which will
-deploy the instance in the cloud and monitor the progress of the deployment.
-You can view all the background process with there running status and logs
-on the :ref:`Processes <processes>` tab
-
-The Server will be added to the tree with the cloud deployment icon. Once the
-deployment is done, the server details will be updated.

docs/en_US/cloud_google_cloud_sql.rst

@@ -105,8 +105,8 @@ button to deploy the instance on Azure PostgreSQL.
 
 Once you click on the finish, one background process will start which will
 deploy the instance in the cloud and monitor the progress of the deployment.
-You can view all the background process with there running status and logs
-on the :ref:`Processes <processes>` tab
+You can view all the background processes with their running status and logs
+on the :ref:`Processes <processes>` tab.
 
 
 The Server will be added to the tree with the cloud deployment icon. Once the

docs/en_US/code_review.rst

@@ -16,7 +16,7 @@ review process for any changes submitted for inclusion in pgAdmin.
   bulk updates every year). The start date should always be 2013, and the end year
   the current year, e.g.
 
-    Copyright (C) 2013 - 2025, The pgAdmin Development Team
+    Copyright (C) 2013 - 2026, The pgAdmin Development Team
 
 * Ensure there's a blank line immediately following any copyright headers.
 

docs/en_US/coding_standards.rst

@@ -120,7 +120,7 @@ with the required file header is shown below::
     #
     # pgAdmin 4 - PostgreSQL Tools
     #
-    # Copyright (C) 2013 - 2025, The pgAdmin Development Team
+    # Copyright (C) 2013 - 2026, The pgAdmin Development Team
     # This software is released under the PostgreSQL Licence
     #
     ##########################################################################

docs/en_US/collation_dialog.rst

@@ -57,7 +57,7 @@ settings:
   deterministic comparisons. By default, this option is set to true. In a
   deterministic comparison, strings that are not byte-wise equal are considered
   unequal, even if they are considered logically equal in the comparison.
-* Use the *Rules* field to specify a rules for customizing the behavior of the collation.
+* Use the *Rules* field to specify rules for customizing the behavior of the collation.
   It includes considerations such as character ordering, case sensitivity, and accent
   sensitivity.
 * Use the *Version* field to specify version string to store with the collation object.
@@ -65,8 +65,8 @@ settings:
 
 Click the *SQL* tab to continue.
 
-Your entries in the *Collation* dialog generate a SQL command (see an example b
-elow). Use the *SQL* tab for review; revisit or switch tabs to make any changes
+Your entries in the *Collation* dialog generate a SQL command (see an example
+below). Use the *SQL* tab for review; revisit or switch tabs to make any changes
 to the SQL command.
 
 Example
@@ -80,7 +80,7 @@ the *Collation* dialog:
     :align: center
 
 The example shown demonstrates creating a collation named *french* that uses the
-rules specified for the locale, *fr-BI-x-icu.  The collation is owned by
+rules specified for the locale, *fr-BI-x-icu*.  The collation is owned by
 *postgres*.
 
 * Click the *Info* button (i) to access online help. For more information about

docs/en_US/column_dialog.rst

@@ -144,7 +144,7 @@ the *Add* icon (+) to add each security label selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.

docs/en_US/conf.py

@@ -239,6 +239,14 @@ latex_documents = [
 # https://groups.google.com/forum/#!topic/sphinx-users/ZlQ95_QikXo
 latex_elements = {
     'fncychap': r'\usepackage[Sonny]{fncychap}',
+    # pdflatex's default utf8 inputenc covers Latin-1/Latin-Extended-A but
+    # not the Vietnamese precomposed code points that appear in CVE
+    # reporter names. Declare the specific characters we use rather than
+    # switching engines.
+    'preamble': r'''
+\DeclareUnicodeCharacter{1EA1}{\d{a}}
+\DeclareUnicodeCharacter{1EC1}{\`{\^e}}
+''',
 }
 
 

docs/en_US/container_deployment.rst

@@ -53,6 +53,7 @@ The default binary paths set in the container are as follows:
 .. code-block:: bash
 
     DEFAULT_BINARY_PATHS = {
+        'pg-18': '/usr/local/pgsql-18',
         'pg-17': '/usr/local/pgsql-17',
         'pg-16': '/usr/local/pgsql-16',
         'pg-15': '/usr/local/pgsql-15',
@@ -162,8 +163,9 @@ suffix will be ignored.
 **PGPASS_FILE**
 
 *Default: <null>*
-This varible should be set to if you want to pass password using pgpass
-file for the servers added in pgadmin.
+Set this variable to the path of a pgpass file if you want to supply passwords
+for the servers added in pgAdmin. On startup, the file is copied into the
+container and used as the ``.pgpass`` file.
 
 **GUNICORN_ACCESS_LOGFILE**
 
@@ -319,6 +321,44 @@ Run a TLS secured container using a shared config/storage directory in
         -e 'PGADMIN_ENABLE_TLS=True' \
         -d dpage/pgadmin4
 
+Restricted Security Contexts (OpenShift, ``--cap-drop=ALL``)
+************************************************************
+
+Some platforms refuse to honor Linux file capabilities. The two situations
+the pgAdmin container handles automatically are:
+
+- ``--cap-drop=ALL`` (or an equivalent restricted Kubernetes SecurityContext
+  such as OpenShift's ``restricted-v2`` SCC), which zeros the bounding set
+  and removes ``CAP_NET_BIND_SERVICE``. Exec of a capability-tagged binary
+  then fails with ``Operation not permitted``.
+
+- ``--security-opt=no-new-privileges`` (or
+  ``allowPrivilegeEscalation: false``), which causes the kernel to silently
+  strip file capabilities on exec. The binary runs, but a subsequent
+  ``bind()`` to a port below 1024 fails with ``EPERM``.
+
+The container's entrypoint reads ``/proc/self/status`` at startup, detects
+either condition, switches gunicorn to the non-capability python
+interpreter, and (when *PGADMIN_LISTEN_PORT* is not set) defaults the
+listen port to **8080** for plain HTTP and **8443** for TLS instead of
+80/443. A message is logged so the choice is visible.
+
+In practice this means a typical OpenShift deployment requires no special
+build, no setcap, and no custom configuration — only a Service / Route
+that targets the chosen non-privileged port:
+
+.. code-block:: bash
+
+    docker run --rm -p 8080:8080 \
+        --security-opt=no-new-privileges \
+        --cap-drop=ALL \
+        -e 'PGADMIN_DEFAULT_EMAIL=user@domain.com' \
+        -e 'PGADMIN_DEFAULT_PASSWORD=SuperSecret' \
+        dpage/pgadmin4
+
+If you explicitly set *PGADMIN_LISTEN_PORT*, that value is honored in both
+the restricted and unrestricted paths.
+
 Reverse Proxying
 ****************
 
@@ -525,3 +565,84 @@ the container is typically launched per the example below:
         -e "SCRIPT_NAME=/pgadmin4" \
         -l "traefik.frontend.pgadmin4.rule=Host(`host.example.com`) && PathPrefix(`/pgadmin4`)" \
         -d dpage/pgadmin4
+
+Sharing the data volume across containers (Kubernetes init containers)
+----------------------------------------------------------------------
+
+A common Kubernetes pattern is to bootstrap a pgAdmin deployment with one or
+more init containers that share the ``/var/lib/pgadmin`` volume with the main
+pgAdmin container — for example, an init container that runs
+``setup.py load-servers`` to import a ``servers.json`` definition file at
+each rollout.
+
+**The image tag of any such sidecar/init container must NOT be newer than
+the main pgAdmin container's tag.** pgAdmin's configuration database
+(``pgadmin4.db``) is migrated forward only — destructive operations such as
+dropping a column are part of normal upgrades. If an init container running
+``pgadmin4:latest`` (or any newer tag) executes ``setup.py`` against a
+``pgadmin4.db`` that the main, older pgAdmin will then read, the init
+container's migrations will advance the schema past what the main container's
+ORM understands, and the main container will fail at runtime with errors
+like ``no such column: <table>.<column>``.
+
+The safe configuration is to pin **both** the main container and every
+sidecar/init container that touches the data volume to the **same**
+explicit version tag, and upgrade them together:
+
+.. code-block:: yaml
+
+    # Deployment manifest (spec.template.spec): pin every container that
+    # touches the data volume to the same explicit tag. Do NOT use :latest.
+    spec:
+      template:
+        spec:
+          initContainers:
+            - name: import-servers-json
+              image: docker.io/dpage/pgadmin4:9.14   # match the main container
+              # ... rest of the init container spec ...
+          containers:
+            - name: pgadmin
+              image: docker.io/dpage/pgadmin4:9.14   # main pgAdmin container
+
+If you deploy pgAdmin with a Helm chart, set the equivalent image-tag values
+for both the main container and every init/sidecar container rather than the
+raw fields shown above. When upgrading pgAdmin, change every reference to the
+image tag at the same time so that the main container and any sidecar/init
+containers move forward together.
+
+Use ``strategy: Recreate``, not ``RollingUpdate``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Even when every container's image tag is pinned correctly, **a rolling
+upgrade across pgAdmin versions is unsafe** when the old and new pods share
+a data volume. Kubernetes' default ``RollingUpdate`` strategy starts the
+new pod, waits for it to become healthy, and only *then* terminates the
+old pod. During that overlap window:
+
+1. The new pod's startup runs ``db_upgrade()`` and applies any pending
+   migrations to the shared ``pgadmin4.db`` — including destructive ones
+   (column drops, table renames, type changes).
+2. The new pod becomes healthy. The old pod is still alive and still has
+   ``pgadmin4.db`` open with its older ORM schema metadata.
+3. Until Kubernetes terminates the old pod, requests routed to it
+   generate queries that reference the pre-migration schema. Those
+   queries now fail at runtime against the migrated database — for
+   example, ``no such column: <table>.<column>`` when a column was
+   dropped in this release.
+
+Because pgAdmin's migrations are forward-only with single-step destructive
+operations (a column dropped in release N+1 is gone immediately, not after
+a deprecation cycle), there is no safe way for an N-version pod to keep
+serving against a migrated N+1 schema. Set the deployment strategy to
+``Recreate``, which terminates the old pod *before* starting the new one:
+
+.. code-block:: yaml
+
+    spec:
+      strategy:
+        type: Recreate   # not RollingUpdate
+
+The trade-off is a few seconds of downtime during each upgrade, in
+exchange for not serving traffic from a pod whose ORM is misaligned with
+the database schema underneath it. This is the supported upgrade
+strategy for pgAdmin K8s deployments today.

docs/en_US/database_dialog.rst

@@ -63,7 +63,7 @@ Use the *Definition* tab to set properties for the database:
 * Specify a connection limit in the *Connection Limit* field to configure the
   maximum number of connection requests. The default value (*-1*) allows
   unlimited connections to the database.
-* If the *templates?* is set to true, then database will be a template database.
+* If *Template?* is set to *Yes*, the database will be a template database.
 
 Click the *Security* tab to continue.
 
@@ -89,7 +89,7 @@ database. Click the *Add* icon (+) to add each security label selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.
@@ -125,8 +125,8 @@ Use the *Advanced* tab to set advanced parameters for the database.
 
 * Use *Schema restriction* field to provide a SQL restriction that will be used
   against the pg_namespace table to limit the schemas that you see.
-  For example, you might enter: *public* so that only *public* are shown in
-  the pgAdmin browser.Separate entries with a comma or tab as you type.
+  For example, you might enter: *public* so that only *public* is shown in
+  the pgAdmin browser. Separate entries with a comma or tab as you type.
 
 Click the *SQL* tab to continue.
 

docs/en_US/developer_tools.rst

@@ -17,3 +17,4 @@ PL/SQL code.
    schema_diff
    erd_tool
    psql_tool
+   ai_tools

docs/en_US/domain_dialog.rst

@@ -89,7 +89,7 @@ Use the *Security Labels* panel to assign security labels. Click the *Add* icon
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.

docs/en_US/editgrid.rst

@@ -49,7 +49,7 @@ To modify the displayed data:
 * To change a numeric value within the grid, double-click the value to select
   the field.  Modify the content in the square in which it is displayed.
 * To change a non-numeric value within the grid, double-click the content to
-  access the edit bubble.  After modifying the contentof the edit bubble, click
+  access the edit bubble.  After modifying the content of the edit bubble, click
   the *Ok* button to display your changes in the data grid, or *Cancel* to
   exit the edit bubble without saving.
 
@@ -62,7 +62,7 @@ table. As soon as you store the data, the row is assigned a row number, and a
 fresh empty line is added to the data grid.
 
 To write a SQL NULL to the table, simply leave the field empty. When you store
-the new row, the will server fill in the default value for that column. If you
+the new row, the server will fill in the default value for that column. If you
 store a change to an existing row, the value NULL will explicitly be written.
 
 To write an empty string to the table, enter the special string '' (two single
@@ -101,6 +101,11 @@ properties of the geometries directly in map, just click the specific geometry:
       viewer will render geometries with the same SRID in the map. If SRID=4326 the
       OSM tile layer will be added into the map.
 
+    - *Custom tile provider:* A custom map tile provider ({z}/{x}/{y} URL template,
+      in EPSG:3857, EPSG:4326 or EPSG:3395) can be configured as a base layer via
+      *Preferences > Query Tool > Geometry Viewer*. When configured, it is
+      selected as the default base layer.
+
     - *Data size:* For performance reasons, the viewer will render no more than
       100000 geometries, totaling up to 20MB.
 
@@ -110,9 +115,9 @@ properties of the geometries directly in map, just click the specific geometry:
 
 **JSON Data Editor**
 
-A built in json editor is provided for *JSON/JSONB Data*.Double clicking on json/jsonb
-data type cell in data grid will open JSON Editor.Editor provides different mode to
-view and edit json data.
+A built-in JSON editor is provided for *JSON/JSONB Data*. Double-clicking on a JSON/JSONB
+data type cell in the data grid will open the JSON Editor. The editor provides different modes to
+view and edit JSON data.
 
 
 .. image:: images/json_editor_modes.png
@@ -120,21 +125,21 @@ view and edit json data.
     :align: center
 
 *Code Mode*:
-Provides way to format & compact json data.Also provides ability to repair json data
-by fixing quotes and escape characters, removing comments and JSONP notation and
-turn JavaScript objects into JSON.
+Provides a way to format and compact JSON data. Also provides the ability to repair JSON data
+by fixing quotes and escape characters, removing comments and JSONP notation, and
+turning JavaScript objects into JSON.
 
 *Tree Mode*:
-Enabled to change, add, move, remove, and duplicate fields and values.Provides ability
-to searh & hilight data.
+Enables changing, adding, moving, removing, and duplicating fields and values. Provides the ability
+to search and highlight data.
 
 *Form Mode*:
-Allows only to edit values in json data there by providing ability to keep data structure
+Allows editing only the values in JSON data, thereby providing the ability to keep the data structure
 unchanged while editing.
 
 *Preview Mode*:
-Provides ability to check data before saving and also shows size of current json data.
-Format and compact json data as well.
+Provides the ability to check data before saving and also shows the size of the current JSON data.
+Allows formatting and compacting JSON data as well.
 
 
 *Editor Toolbar*
@@ -170,18 +175,18 @@ Tree/Form mode:
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
    | *Transform*          | Click to *Transform*  to filter data  using JSME query language.                       | Code, Preview, Tree       |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
-   | *Undo*               | Click to *Undo* to undo last action performed on data .                                | Code, Preview, Tree, From |
+   | *Undo*               | Click to *Undo* to undo last action performed on data.                                 | Code, Preview, Tree, Form |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
-   | *Redo*               | Click to *Redo* to repat last action performed on data .                               | Code, Preview, Tree, From |
+   | *Redo*               | Click to *Redo* to repeat last action performed on data.                               | Code, Preview, Tree, Form |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
-   | *Mode*               | Click to *Mode* dropdown to change dipaly mode of editor.Different modes avaialble     | Code, Tree, From, Preview |
-   |                      | are Code, Preview, Tree, From.                                                         |                           |
+   | *Mode*               | Click the *Mode* dropdown to change the display mode of the editor. Different modes    | Code, Tree, Form, Preview |
+   |                      | available are Code, Preview, Tree, and Form.                                           |                           |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
-   | *Expand All*         | Click to *Expand All* to expand json data.                                             | Tree, From                |
+   | *Expand All*         | Click *Expand All* to expand JSON data.                                                | Tree, Form                |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
-   | *Collapse All*       | Click to *Redo* to collapse json data.                                                 | Tree, From                |
+   | *Collapse All*       | Click *Collapse All* to collapse JSON data.                                            | Tree, Form                |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
-   | *Search Box*         | Enter partial/complete string to search in data.                                       | Tree, From                |
+   | *Search Box*         | Enter partial/complete string to search in data.                                       | Tree, Form                |
    +----------------------+----------------------------------------------------------------------------------------+---------------------------+
 
 
@@ -235,6 +240,6 @@ A View/Edit Data tab can be converted to a Query Tool Tab just by editing the qu
     :alt: Promote View/Edit Data tab to Query Tool tab warning
     :align: center
 
-You can disable the dialog by selecting the "Don't Ask again" checkbox. If you wish to resume the confirmation dialog, you can do it from "Prefrences -> Query Tool -> Editor -> Show View/Edit Data Promotion Warning?"
+You can disable the dialog by selecting the "Don't Ask again" checkbox. If you wish to resume the confirmation dialog, you can do it from "Preferences -> Query Tool -> Editor -> Show View/Edit Data Promotion Warning?"
 
 Once you chose to continue, you won't be able to use the features of View/Edit mode like the filter and sorting options, limit, etc. It is a one-way conversion. It will be a query tool now.

docs/en_US/erd_tool.rst

@@ -72,7 +72,7 @@ Export Options
    |                      | You can select the option *With DROP Table* if you wish to have DROP Table DDL statements before  |                |
    |                      | each CREATE Table DDL. You can see the option by clicking the down arrow beside the SQL button.   |                |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
-   | *Download image*     | Click the *Download image* icon to save the ERD diagram in a image formate                        | Option/Alt +   |
+   | *Download image*     | Click the *Download image* icon to save the ERD diagram in an image format.                       | Option/Alt +   |
    |                      |                                                                                                   | Ctrl + I       |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
 
@@ -86,6 +86,9 @@ Editing Options
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
    | Icon                 | Behavior                                                                                          | Shortcut       |
    +======================+===================================================================================================+================+
+   | *Search table*       | Click to search for a table in the diagram. Selecting a table from the search results will bring  | Option/Alt +   |
+   |                      | it into view and highlight it.                                                                    | Ctrl + F       |
+   +----------------------+---------------------------------------------------------------------------------------------------+----------------+
    | *Add table*          | Click this button to add a new table to the diagram. On clicking, this will open a table dialog   | Option/Alt +   |
    |                      | where you can put the table details.                                                              | Ctrl + A       |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
@@ -109,11 +112,14 @@ Table Relationship Options
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
    | Icon                 | Behavior                                                                                          | Shortcut       |
    +======================+===================================================================================================+================+
-   | *1M*                 | Click this button to open a one-to-many relationship dialog to add a relationship between the     | Option/Alt +   |
+   | *1-1*                | Click this button to open a one-to-one relationship dialog to add a relationship between the      | Option/Alt +   |
+   |                      | two tables. The selected table becomes the referencing table.                                     | Ctrl + B       |
+   +----------------------+---------------------------------------------------------------------------------------------------+----------------+
+   | *1-M*                | Click this button to open a one-to-many relationship dialog to add a relationship between the     | Option/Alt +   |
    |                      | two tables. The selected table becomes the referencing table and will have the *many* endpoint of | Ctrl + O       |
    |                      | the link.                                                                                         |                |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
-   | *MM*                 | Click this button to open a many-to-many relationship dialog to add a relationship between the    | Option/Alt +   |
+   | *M-M*                | Click this button to open a many-to-many relationship dialog to add a relationship between the    | Option/Alt +   |
    |                      | two tables. This option will create a new table based on the selected columns for the two relating| Ctrl + M       |
    |                      | tables and link them.                                                                             |                |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
@@ -129,7 +135,7 @@ Node Color Options
    | Icon                 | Behavior                                                                                                 |
    +======================+==========================================================================================================+
    | *Fill Color*         | Use Fill Color to change the background color of a table node. This is helpful if you want to            |
-   |                      | identify a of group tables. Once set, all the newly added tables will take the same color.               |
+   |                      | identify a group of tables. Once set, all the newly added tables will take the same color.               |
    +----------------------+----------------------------------------------------------------------------------------------------------+
    | *Text Color*         | Use Text Color to change the text color of a table node based on the fill color to make text             |
    |                      | easily readable.                                                                                         |
@@ -148,7 +154,7 @@ Utility Options
    | *Add/Edit note*         | Click this button to make notes on tables nodes while designing the database.                  | Option/Alt +   |
    |                         |                                                                                                | Ctrl + N       |
    +-------------------------+------------------------------------------------------------------------------------------------+----------------+
-   | *Auto align*            | Click this button to auto align all tables and links to make it look more cleaner.             | Option/Alt +   |
+   | *Auto align*            | Click this button to auto-align all tables and links to make them look cleaner.                | Option/Alt +   |
    |                         |                                                                                                | Ctrl + L       |
    +-------------------------+------------------------------------------------------------------------------------------------+----------------+
    | *Show details*          | Click this button to toggle the column details visibility. It allows you to show few or more   | Option/Alt +   |
@@ -188,7 +194,7 @@ Table Dialog
 The table dialog allows you to:
 
 * Change the table structure details.
-* It can be used edit an existing table or add a new one.
+* It can be used to edit an existing table or add a new one.
 * Refer :ref:`table dialog <table_dialog>` for information on different fields.
 
 Table Node
@@ -200,11 +206,11 @@ Table Node
 
 The table node shows table details in a graphical representation:
 
-* The top bar has a *details toggle button* that is used to toggle column details visibility. There is also a *note button* that is visible only if there is some note added. you can click on this button to quickly change the note.
+* The top bar has a *details toggle button* that is used to toggle column details visibility. There is also a *note button* that is visible only if there is some note added. You can click on this button to quickly change the note.
 * The first row shows the schema name of the table. Eg. *public* in above image.
 * The second row shows the table name. Eg. *users* in above image.
 * All other rows below the table name are the columns of the table along with data type. If the column is a primary key then it will have lock key icon eg. id is the primary key in above image. Otherwise, it will have column icon.
-* you can click on the node and drag to move on the canvas.
+* You can click on the node and drag to move on the canvas.
 * Upon double click on the table node or by clicking the edit button from the toolbar, the table dialog opens where you can change the table details. Refer :ref:`table dialog <table_dialog>` for information on different fields.
 
 The One to One Link Dialog
@@ -219,7 +225,7 @@ The one to one link dialog allows you to:
 * Add a one to one relationship between two tables.
 * *Local Table* is the table that references a table and has the *one* end point.
 * *Local Column* the column that references.
-* *Select Constraint* To implement one to one relationship, the *Local Column* must have primaty key or unique constraint. The default is a unique constraint. Please note that this field is visible only when the selected *Local Column* does not have either of the mentioned constraints.
+* *Select Constraint* To implement a one-to-one relationship, the *Local Column* must have a primary key or unique constraint. The default is a unique constraint. Please note that this field is visible only when the selected *Local Column* does not have either of the mentioned constraints.
 * *Referenced Table* is the table that is being referred and has the *one* end point.
 * *Referenced Column* the column that is being referred.
 
@@ -266,7 +272,7 @@ The table link shows relationship between tables:
 * The single line endpoint of the link shows the column that is being referred.
 * The three line endpoint of the link shows the column that refers.
 * If one of the columns that is being referred or that refers is removed from the table then the link will get dropped.
-* you can click on the link and drag to move on the canvas.
+* You can click on the link and drag to move on the canvas.
 
 
 The Table Notes

docs/en_US/event_trigger_dialog.rst

@@ -67,7 +67,7 @@ in the *Delete Row* popup.
 
 Click the *SQL* tab to continue.
 
-Your entries in the *Event Trigger* dialog generate a generate a SQL command.
+Your entries in the *Event Trigger* dialog generate a SQL command.
 Use the *SQL* tab for review; revisit or switch tabs to make any changes to the
 SQL command.
 

docs/en_US/export_data_using_query.rst

@@ -58,8 +58,8 @@ Click the *Query* tab to continue.
 
 Use the fields in the *Query* tab to write the query that will be exported:
 
-* Use the *Export Data Query* field to specifies A SELECT, VALUES, INSERT, UPDATE,
-  DELETE, or MERGE command whose results are to be copied .
+* Use the *Export Data Query* field to specify a SELECT, VALUES, INSERT, UPDATE,
+  DELETE, or MERGE command whose results are to be copied.
 
 * Use *Force Quote columns* field to forces quoting to be used for all non-NULL
   values in each specified column. NULL output is never quoted. This is a creatable

docs/en_US/extension_dialog.rst

@@ -23,7 +23,7 @@ Use the fields in the *General* tab to identify an extension:
 
 * Use the drop-down listbox in the *Name* field to select the extension. Each
   extension must have a unique name.
-* Move the switch next to *Cascade?* towards right position to automatically
+* Move the switch next to *Cascade?* to the *Yes* position to automatically
   install any extensions that this extension depends on that are not already
   installed.
 * Store notes about the extension in the *Comment* field.

docs/en_US/foreign_table_dialog.rst

@@ -131,7 +131,7 @@ function. Click the *Add* icon (+) to add each security label selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.

docs/en_US/function_dialog.rst

@@ -41,6 +41,9 @@ Use the fields in the *Definition* tab to define the function:
   will change to an input text field.
 * Use the drop-down listbox next to *Language* to select the implementation
   language. The default is *sql*.
+* Use the drop-down listbox next to *Depends on extensions* to select the extension that this function
+  depends on (for example, plpgsql). If set, dropping the extension will automatically drop the
+  function as well.
 * Use the fields in the *Arguments* to define an argument. Click the *Add*
   icon (+) to set parameters and values for the argument:
 
@@ -153,7 +156,7 @@ function. Click the *Add* icon (+) to add each security label selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.
@@ -164,7 +167,7 @@ in the *Delete Row* popup.
 
 Click the *SQL* tab to continue.
 
-Your entries in the *Function* dialog generate a generate a SQL command (see an
+Your entries in the *Function* dialog generate a SQL command (see an
 example below). Use the *SQL* tab for review; revisit or switch tabs to make any
 changes to the SQL command.
 
@@ -178,8 +181,8 @@ the *Function* dialog:
     :alt: Function dialog sql tab
     :align: center
 
-The example demonstrates creating an *plpgsql* function named *hire_salesmen*. The
-function have three columns (p_ename, p_sal and p_comm).
+The example demonstrates creating a *plpgsql* function named *hire_salesmen*. The
+function has three columns (p_ename, p_sal and p_comm).
 
 * Click the *Info* button (i) to access online help.
 * Click the *Save* button to save work.

docs/en_US/grant_wizard.rst

@@ -46,7 +46,7 @@ Use the fields in the *Privileges Selection* window to grant
 privileges. If you grant a privilege WITH GRANT OPTION, the Grantee will have
 the right to grant privileges on the object to others. If WITH GRANT OPTION is
 subsequently revoked, any role who received access to that object from that
-Grantee (directly or through a chain of grants) will lose thier privileges on
+Grantee (directly or through a chain of grants) will lose their privileges on
 the object.
 
 * Click the *Add* icon (+) to assign a set of privileges.

docs/en_US/import_export_servers.rst

@@ -132,7 +132,9 @@ The JSON file format used when importing or exporting servers is quite
 straightforward and simply contains a list of servers, with a number of
 attributes. The following attributes are required to be present in every server
 definition: Name, Group, Port, Username, SSLMode, MaintenanceDB and one of Host,
-HostAddr or Service.
+HostAddr or Service. A shared server may supply SharedUsername in place of
+Username, in which case the shared username is also used as the username of the
+imported server.
 
 Password fields cannot be imported or exported.
 
@@ -196,4 +198,4 @@ The following example shows both a minimally defined and a fully defined server:
         }
     }
 
-.. note:: If you're running pgAdmin in Server Mode, the values for parameters that require file paths should be specified relative to the user's home directory which is /<DATA_DIR>/storage/<user_id>/. If DATA_DIR is not specified, then it will /var/libe/pgadmin/storage/<user_id>/
+.. note:: If you're running pgAdmin in Server Mode, the values for parameters that require file paths should be specified relative to the user's home directory which is /<DATA_DIR>/storage/<user_id>/. If DATA_DIR is not specified, then it will be /var/lib/pgadmin/storage/<user_id>/

docs/en_US/index_dialog.rst

@@ -48,6 +48,31 @@ Use the fields in the *Definition* tab to define the index:
     * Select *brin* to create a BRIN index.  A BRIN index may improve
       performance when managing minimum and maximum values and ranges.
 
+* Use the drop-down listbox next to *Depends on extensions* to select the extension 
+  that this index depends on (for example, edbspl). If set, dropping the extension 
+  will automatically drop the index as well.
+* Move the switch next to *Only Table?* to the *Yes* position to create the index
+  only on the parent table without recursing to its partitions. This button will be
+  enabled for partition tables only. The default is *No*.
+* Move the switch next to *Unique?* to the *Yes* position to check for duplicate values
+  in the table when the index is created and when data is added. The default is *No*.
+* Move the switch next to *NULLs not distinct?* to the *Yes* position to treat null values as not distinct. 
+  The default is *No*. This option is available only on PostgreSQL 15 and above.
+* Move the *Clustered?* switch to the *Yes* position to instruct the server to
+  cluster the table.
+* Move the *Concurrent build?* switch to the *Yes* position to build the index
+  without taking any locks that prevent concurrent inserts, updates, or deletes
+  on the table.
+* Use the *Constraint* field to provide a constraint expression; a constraint
+  expression limits the entries in the index to those rows that satisfy the
+  constraint.
+
+Click the *With* tab to continue.
+
+.. image:: images/index_with.png
+    :alt: Index dialog with tab
+    :align: center
+
 * Use the *Fill Factor* field to specify a fill factor for the index. The fill
   factor specifies how full the selected method will try to fill each index
   page.
@@ -57,24 +82,12 @@ Use the fields in the *Definition* tab to define the index:
   for each entry of a BRIN index.
 * Select *Buffering* to specify whether the buffering build technique is used to build the index. The default is
   *Auto*
-* Move the switch next to *Deduplicate items?* towards the *right position* to control usage of the B-tree 
+* Move the switch next to *Deduplicate items?* to the *Yes* position to control usage of the B-tree 
   deduplication technique. The default is *Yes*. This option is available only on PostgreSQL 13 and above.
-* Move the switch next to *Fast update?* towards the *right position* to control usage of the fast update technique. 
+* Move the switch next to *Fast update?* to the *Yes* position to control usage of the fast update technique. 
   The default is *Yes*.
-* Move the switch next to *Autosummarize* towards the *right position* to define whether a summarization run is 
+* Move the switch next to *Autosummarize* to the *Yes* position to define whether a summarization run is 
   queued for the previous page range whenever an insertion is detected on the next one. The default is *No*
-* Move the switch next to *Unique?* towards the *right position* to check for duplicate values
-  in the table when the index is created and when data is added. The default is *No*.
-* Move the switch next to *NULLs not distinct?* towards the *right position* to treat null values as not distinct. 
-  The default is*No*. This option is available only on PostgreSQL 15 and above.
-* Move the *Clustered?* switch to the *Yes* position to instruct the server to
-  cluster the table.
-* Move the *Concurrent build?* switch to the *Yes* position to build the index
-  without taking any locks that prevent concurrent inserts, updates, or deletes
-  on the table.
-* Use the *Constraint* field to provide a constraint expression; a constraint
-  expression limits the entries in the index to those rows that satisfy the
-  constraint.
 
 Click the *Columns* tab to continue.
 

docs/en_US/keyboard_shortcuts.rst

@@ -22,6 +22,8 @@ When using main browser window, the following keyboard shortcuts are available:
    +----------------------------+--------------------+------------------------------------+
    | Shift + Alt + b            | Shift + Option + b | Object explorer                    |
    +----------------------------+--------------------+------------------------------------+
+   | Ctrl + Alt + b             | Ctrl + Option + b  | Toggle Object Explorer             |
+   +----------------------------+--------------------+------------------------------------+
    | Shift + Alt + n            | Shift + Option + n | Create object                      |
    +----------------------------+--------------------+------------------------------------+
    | Shift + Alt + d            | Shift + Option + d | Delete object                      |

docs/en_US/language_dialog.rst

@@ -64,7 +64,7 @@ function. Click the *Add* icon (+) to add each security label selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.

docs/en_US/ldap.rst

@@ -87,6 +87,8 @@ There are 3 ways to configure LDAP:
    "LDAP_KEY_FILE","Specifies the path to the server private key file. This parameter
    is applicable only if you are using *ldaps* as connection protocol or you have
    set *LDAP_USE_STARTTLS* parameter to *True*."
+   "LDAP_CERT_VALIDATE", "Set this parameter to *False* if you want to bypass
+   the TLS certificate validation. By default it is set to True."
    "LDAP_IGNORE_MALFORMED_SCHEMA", "Some flaky LDAP servers returns malformed schema.
    If this parameter set to *True*, no exception will be raised and schema is thrown away
    but authentication will be done. This parameter should remain False, as recommended."
@@ -108,3 +110,28 @@ There are 3 ways to configure LDAP:
    "LDAP_BIND_PASSWORD", "Password for simple bind.
    Specify the value if you have set the LDAP_BIND_USER parameter."
 
+
+Brute-force protection
+**********************
+
+pgAdmin's built-in account-lockout setting (``MAX_LOGIN_ATTEMPTS``) applies
+only to accounts using the ``INTERNAL`` authentication source. It does
+**not** rate-limit or lock LDAP-authenticated logins.
+
+When LDAP authentication is enabled, brute-force protection for LDAP
+credentials is the responsibility of:
+
+- **The directory.** Configure account-lockout policy on the LDAP server
+  itself (for example, OpenLDAP's ``ppolicy`` overlay, Active Directory's
+  account-lockout GPO, or the equivalent on FreeIPA / 389 Directory
+  Server). The directory is the credential authority and is the correct
+  place to enforce per-account lockout.
+- **The reverse proxy or WAF in front of pgAdmin.** Configure
+  request-rate limiting on the login endpoint (for example, ``limit_req``
+  in nginx, ``stick-table`` rules in HAProxy, or the equivalent in your
+  WAF) to bound login-attempt volume per source IP. This is independent
+  of pgAdmin and protects against attackers who would otherwise reach the
+  LDAP server through pgAdmin.
+
+See :ref:`Avoiding a bruteforce attack <login>` for the equivalent note
+on the login page.

docs/en_US/licence.rst

@@ -13,7 +13,7 @@ documentation is attributed to the
 
 .. topic:: pgAdmin 4
 
-    Copyright (C) 2013 - 2025, The pgAdmin Development Team
+    Copyright (C) 2013 - 2026, The pgAdmin Development Team
 
     Permission to use, copy, modify, and distribute this software and its
     documentation for any purpose, without fee, and without a written agreement is

docs/en_US/login.rst

@@ -60,6 +60,18 @@ asking you to contact the LDAP administrator to recover your LDAP password.
 Avoiding a bruteforce attack
 ****************************
 
-You have the possibility to lock an account by setting ``MAX_LOGIN_ATTEMPTS``
-once it has reached the maximum number of login attempts.
-You can disable this feature by setting the value to zero.
+For accounts using the ``INTERNAL`` authentication source, pgAdmin locks
+the account after ``MAX_LOGIN_ATTEMPTS`` consecutive failed logins. The
+default is 3; set it to zero to disable.
+
+For accounts authenticated against an external identity provider
+(``LDAP``, ``OAUTH2``, ``KERBEROS``, ``WEBSERVER``), brute-force protection
+is **not** handled by pgAdmin and ``MAX_LOGIN_ATTEMPTS`` does not apply.
+Operators using these sources should:
+
+- Configure account-lockout policy on the upstream provider (for example,
+  Active Directory's account-lockout GPO, OpenLDAP's ``ppolicy`` overlay,
+  or the OAuth2 provider's rate limits).
+- Configure request rate-limiting (for example, ``limit_req`` in nginx)
+  on the reverse proxy in front of pgAdmin to bound login-attempt volume
+  per source IP.

docs/en_US/maintenance_dialog.rst

@@ -29,31 +29,31 @@ maintenance:
    * Move the *ANALYZE* switch to the *Yes* position to issue ANALYZE commands
      whenever the content of a table has changed sufficiently.
 
-   * Move the *DISABLE PAGE SKIPPING* switch to the *Yes* position to disables
+   * Move the *DISABLE PAGE SKIPPING* switch to the *Yes* position to disable
      all page-skipping behavior.
 
-   * Move the *SKIP LOCKED* switch to the *Yes* position to specifies that
+   * Move the *SKIP LOCKED* switch to the *Yes* position to specify that
      VACUUM should not wait for any conflicting locks to be released when
      beginning work on a relation. This option is available from v12 onwards.
 
-   * Move the *TRUNCATE* switch to the *Yes* position to specifies that VACUUM
+   * Move the *TRUNCATE* switch to the *Yes* position to specify that VACUUM
      should attempt to truncate off any empty pages at the end of the table and
      allow the disk space for the truncated pages to be returned to the operating
      system. This option is available from v12 onwards.
 
-   * Move the *PROCESS TOAST* switch to the *Yes* position to specifies that
+   * Move the *PROCESS TOAST* switch to the *Yes* position to specify that
      VACUUM should attempt to process the corresponding TOAST table for each
      relation, if one exists. This option is available from v14 onwards.
 
-   * Move the *PROCESS MAIN* switch to the *Yes* position to specifies that
+   * Move the *PROCESS MAIN* switch to the *Yes* position to specify that
      VACUUM should attempt to process the main relation. This option is available
      from v16 onwards.
 
-   * Move the *SKIP DATABASE STATS* switch to the *Yes* position to specifies
+   * Move the *SKIP DATABASE STATS* switch to the *Yes* position to specify
      that VACUUM should skip updating the database-wide statistics about oldest
      unfrozen XIDs. This option is available from v16 onwards.
 
-   * Move the *ONLY DATABASE STATS* switch to the *Yes* position to specifies
+   * Move the *ONLY DATABASE STATS* switch to the *Yes* position to specify
      that VACUUM should do nothing except update the database-wide statistics
      about oldest unfrozen XIDs . This option is available from v16 onwards.
 
@@ -64,7 +64,7 @@ maintenance:
      of VACUUM in parallel using integer background workers. This option is
      available from v13 onwards.
 
-   * Use the *BUFFER USAGE LIMIT* field to specifies the Buffer Access Strategy
+   * Use the *BUFFER USAGE LIMIT* field to specify the Buffer Access Strategy
      ring buffer size for VACUUM. This size is used to calculate the number of
      shared buffers which will be reused as part of this strategy. This option
      is available from v16 onwards
@@ -78,11 +78,11 @@ maintenance:
   This enables the query optimizer to select the fastest query plan for optimal
   performance.
 
-   * Move the *SKIP LOCKED* switch to the *Yes* position to specifies that
+   * Move the *SKIP LOCKED* switch to the *Yes* position to specify that
      ANALYZE should not wait for any conflicting locks to be released when
      beginning work on a relation. This option is available from v12 onwards.
 
-   * Use the *BUFFER USAGE LIMIT* field to specifies the Buffer Access Strategy
+   * Use the *BUFFER USAGE LIMIT* field to specify the Buffer Access Strategy
      ring buffer size for ANALYZE. This size is used to calculate the number of
      shared buffers which will be reused as part of this strategy. This option
      is available from v16 onwards
@@ -103,7 +103,7 @@ maintenance:
      without taking any locks that prevent concurrent inserts, updates, or
      deletes on the table. This option is available from v12 onwards.
 
-   * Use the *TABLESPACE* field to specifies that indexes will be rebuilt on
+   * Use the *TABLESPACE* field to specify that indexes will be rebuilt on
      a new tablespace. This option is available from v14 onwards.
 
 .. image:: images/maintenance_cluster.png
@@ -118,6 +118,6 @@ switch to the *No* position; by default, status messages are included.
 When you've completed the dialog, click *OK* to start the background process;
 to exit the dialog without performing maintenance operations, click *Cancel*.
 
-pgAdmin will run the maintenance process in background. You can view all the background
-process with there running status and logs on the :ref:`Processes <processes>`
+pgAdmin will run the maintenance process in the background. You can view all the background
+processes with their running status and logs on the :ref:`Processes <processes>`
 tab.

docs/en_US/materialized_view_dialog.rst

@@ -10,7 +10,7 @@ the REFRESH MATERIALIZED VIEW command to update the content of a materialized
 view.
 
 The *Materialized View* dialog organizes the development of a materialized_view
-through the following dialog tabs: *General*, *Definition*, *Storage*,
+through the following dialog tabs: *General*, *Definition*, *Code*,
 *Parameter*, and *Security*. The *SQL* tab displays the SQL code generated by
 dialog selections.
 
@@ -31,10 +31,10 @@ Use the fields in the *General* tab to identify the materialized view:
 Click the *Definition* tab to continue.
 
 .. image:: images/materialized_view_definition.png
-    :alt: Materialized view dialog storage tab
+    :alt: Materialized view dialog definition tab
     :align: center
 
-Use the fields in the *Storage* tab to maintain the materialized view:
+Use the fields in the *Definition* tab to maintain the materialized view:
 
 * Move the *With Data* switch to the *Yes* position to specify the materialized
   view should be populated at creation time. If not, the materialized view
@@ -47,11 +47,14 @@ Use the fields in the *Storage* tab to maintain the materialized view:
 * Use the *Fill Factor* field to specify a fill factor for the materialized
   view. The fill factor for a table is a percentage between 10 and 100. 100
   (complete packing) is the default.
+* Use the drop-down listbox next to *Depends on extensions* to select the extension that this materialized view
+  depends on (for example, edbspl). If set, dropping the extension will automatically drop the
+  materialized view as well.
 
 Click the *Code* tab to continue.
 
 .. image:: images/materialized_view_code.png
-    :alt: Materialized view dialog definition tab
+    :alt: Materialized view dialog code tab
     :align: center
 
 Use the text editor field in the *Code* tab to provide the query that will
@@ -101,7 +104,7 @@ selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.

docs/en_US/menu_bar.rst

@@ -5,8 +5,10 @@
 *****************
 
 The pgAdmin menu bar provides drop-down menus for access to options, commands,
-and utilities. The menu bar displays the following selections: *File*, *Object*,
-Tools*, and *Help*. Selections may be grayed out which indicates they are
+and utilities. Its layout adapts based on your deployment: in Web mode,
+you will see *File*, *Object*, *Tools*, and *Help* menus. In Desktop mode,
+the *pgAdmin4* application menu replaces the standard *File* menu.
+Selections may be grayed out which indicates they are
 disabled for the object currently selected in the *pgAdmin* tree control.
 
 The File Menu
@@ -16,7 +18,7 @@ The File Menu
     :alt: pgAdmin file menu bar
     :align: center
 
-Use the *File* menu to access the following options:
+Use the *File* menu available in web mode to access the following options:
 
 +-------------------------+---------------------------------------------------------------------------------------------------------+
 | Option                  | Action                                                                                                  |
@@ -25,8 +27,30 @@ Use the *File* menu to access the following options:
 +-------------------------+---------------------------------------------------------------------------------------------------------+
 | *Reset Layout*          | If you have modified the workspace, click to restore the default layout.                                |
 +-------------------------+---------------------------------------------------------------------------------------------------------+
-| *Runtime*               | Click to open a submenu to Configure, View Log and Zoom settings. Only visible when pgAdmin4 runs in    |
-|                         | desktop mode. To know more about runtime menu :ref:`click here <desktop_deployment>`                    |
+
+
+The pgAdmin4 Menu
+*****************
+
+.. image:: /images/pgadmin4_menu.png
+    :alt: pgAdmin pgadmin4 menu bar
+    :align: center
+
+Use the *pgAdmin4* menu available in desktop mode to access the following options:
+
++-------------------------+---------------------------------------------------------------------------------------------------------+
+| Option                  | Action                                                                                                  |
++=========================+=========================================================================================================+
+| *About pgAdmin 4*       | Provide pgadmin4 configuration information like version, mode etc.                                      |
++-------------------------+---------------------------------------------------------------------------------------------------------+
+| *Preferences/settings*  | Click to open the :ref:`Preferences <preferences>` dialog to customize your pgAdmin settings.           |
++-------------------------+---------------------------------------------------------------------------------------------------------+
+| *Reset Layout*          | If you have modified the workspace, click to restore the default layout.                                |
++-------------------------+---------------------------------------------------------------------------------------------------------+
+| *View Logs*             | This will show current pgadmin4 logs.                                                                   |
++-------------------------+---------------------------------------------------------------------------------------------------------+
+| *Configure runtime*     | Click to open a  window that allows to configure application port, connection timeout to launch the     |
+|                         | application. To know more about runtime menu :ref:`click here <desktop_deployment>`                     |
 +-------------------------+---------------------------------------------------------------------------------------------------------+
 
 The Object Menu
@@ -81,9 +105,9 @@ following options (in alphabetical order):
 +-----------------------------+--------------------------------------------------------------------------------------------------------------------------+
 | *Trigger(s)*                | Click to *Disable* or *Enable* trigger(s) for the currently selected table. Options are displayed on the flyout menu.    |
 +-----------------------------+--------------------------------------------------------------------------------------------------------------------------+
-| *Truncate*                  | Click to remove all rows from a table (*Truncate*), to remove all rows from a table and its child tables                 |
-|                             | (*Truncate Cascade*) or to remove all rows from a table and automatically restart sequences owned by columns             |
-|                             | (*Truncate Restart Identity*). Options are displayed on the flyout menu.                                                 |
+| *Truncate*                  | Click to remove all rows from a table/foreign tables (*Truncate*), to remove all rows from a table/foreign tables and    |
+|                             | its child tables (*Truncate Cascade*) or to remove all rows from a table/foreign tables and automatically restart        |
+|                             | sequences owned by columns (*Truncate Restart Identity*). Options are displayed on the flyout menu.                      |
 +-----------------------------+--------------------------------------------------------------------------------------------------------------------------+
 | *View Data*                 | Click to access a context menu that provides several options for viewing data (see below).                               |
 +-----------------------------+--------------------------------------------------------------------------------------------------------------------------+
@@ -132,6 +156,12 @@ Use the *Tools* menu to access the following options (in alphabetical order):
 +------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------+
 | *Search Objects...*          | Click to open the :ref:`Search Objects... <search_objects>` and start searching any kind of objects in a database.                        |
 +------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------+
+| *AI Reports*                 | Click to access a submenu with AI-powered analysis options (requires :ref:`AI configuration <ai_tools>`):                                 |
+|                              |                                                                                                                                           |
+|                              | - *Security Report* - Generate an AI-powered security analysis for the selected server, database, or schema.                              |
+|                              | - *Performance Report* - Generate an AI-powered performance analysis for the selected server or database.                                 |
+|                              | - *Design Report* - Generate an AI-powered design review for the selected database or schema.                                             |
++------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------+
 | *Add named restore point*    | Click to open the :ref:`Add named restore point... <add_restore_point_dialog>` dialog to take a point-in-time snapshot of the current     |
 |                              | server state.                                                                                                                             |
 +------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------+

docs/en_US/oauth2.rst

@@ -1,15 +1,59 @@
 .. _oauth2:
 
-*****************************************
-`Enabling OAUTH2 Authentication`:index:
-*****************************************
+*******************************************************
+`Enabling OAUTH2 and OIDC Authentication`:index:
+*******************************************************
 
 
-To enable OAUTH2 authentication for pgAdmin, you must configure the OAUTH2
-settings in the *config_local.py* or *config_system.py* file (see the
-:ref:`config.py <config_py>` documentation) on the system where pgAdmin is
-installed in Server mode. You can copy these settings from *config.py* file
-and modify the values for the following parameters:
+To enable OAUTH2 or OpenID Connect (OIDC) authentication for pgAdmin, you must
+configure the OAUTH2 settings in the *config_local.py* or *config_system.py*
+file (see the :ref:`config.py <config_py>` documentation) on the system where
+pgAdmin is installed in Server mode. You can copy these settings from *config.py*
+file and modify the values for the following parameters.
+
+.. warning::
+   pgAdmin reads OAuth2 provider settings **only** from the ``OAUTH2_CONFIG``
+   list; each provider is a single dictionary entry within that list. Settings
+   such as ``OAUTH2_CLIENT_ID`` or ``OAUTH2_SSL_CERT_VERIFICATION`` defined at
+   the top level of the configuration are ignored.
+
+   This matters in container deployments. Although most options can be set with
+   an individual ``PGADMIN_CONFIG_<KEY>`` environment variable, OAuth2 is the
+   exception: individual variables such as ``PGADMIN_CONFIG_OAUTH2_CLIENT_ID``
+   or ``PGADMIN_CONFIG_OAUTH2_SSL_CERT_VERIFICATION`` will **not** configure a
+   provider. Instead, configure the whole provider list through a single
+   ``PGADMIN_CONFIG_OAUTH2_CONFIG`` variable, for example::
+
+       PGADMIN_CONFIG_OAUTH2_CONFIG="[{'OAUTH2_NAME': 'my-provider', 'OAUTH2_DISPLAY_NAME': 'My Provider', 'OAUTH2_CLIENT_ID': '...', 'OAUTH2_CLIENT_SECRET': '...', 'OAUTH2_SERVER_METADATA_URL': 'https://provider.example.com/.well-known/openid-configuration', 'OAUTH2_SCOPE': 'openid email profile', 'OAUTH2_SSL_CERT_VERIFICATION': False}]"
+
+   If pgAdmin detects per-provider OAuth2 settings at the top level while no
+   provider is configured in ``OAUTH2_CONFIG``, it logs a warning at startup
+   to highlight the misconfiguration.
+
+OAuth2 vs OpenID Connect (OIDC)
+================================
+
+pgAdmin supports both OAuth2 and OIDC authentication protocols:
+
+**OAuth2** is an authorization framework that allows third-party applications to
+obtain limited access to user accounts. When using OAuth2, pgAdmin must explicitly
+call the provider's userinfo endpoint to retrieve user profile information.
+
+**OpenID Connect (OIDC)** is an identity layer built on top of OAuth2 that provides
+standardized user authentication and profile information. When using OIDC, user
+identity information is included directly in the ID token, which is more efficient
+and secure.
+
+.. note::
+   When **OAUTH2_SERVER_METADATA_URL** is configured, pgAdmin treats the provider
+   as an OIDC provider and will:
+
+   - Use ID token claims for user identity (sub, email, preferred_username)
+   - Skip the userinfo endpoint call when ID token contains sufficient information
+   - Validate the ID token automatically using the provider's public keys
+
+   This is the **recommended approach** for modern identity providers like
+   Microsoft Entra ID (Azure AD), Google, Keycloak, Auth0, and Okta.
 
 
 .. _AzureAD: https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles
@@ -23,29 +67,28 @@ and modify the values for the following parameters:
 
    "AUTHENTICATION_SOURCES", "The default value for this parameter is *internal*.
    To enable OAUTH2 authentication, you must include *oauth2* in the list of values
-   for this parameter. you can modify the value as follows:
+   for this parameter. You can modify the value as follows:
 
    * [‘oauth2’, ‘internal’]: pgAdmin will display an additional button for authenticating with oauth2"
     "OAUTH2_NAME", "The name of the Oauth2 provider, ex: Google, Github"
     "OAUTH2_DISPLAY_NAME", "Oauth2 display name in pgAdmin"
     "OAUTH2_CLIENT_ID", "Oauth2 Client ID"
-    "OAUTH2_CLIENT_SECRET", "Oauth2 Client Secret"
+    "OAUTH2_CLIENT_SECRET", "Oauth2 Client Secret. **Optional for public clients using Authorization Code + PKCE**. For confidential clients (server-side apps), keep this set. For public clients (no secret), pgAdmin will enforce PKCE and perform an unauthenticated token exchange."
+    "OAUTH2_CLIENT_AUTH_METHOD", "Client authentication method for the token endpoint. Default behavior uses *OAUTH2_CLIENT_SECRET* (confidential client), or PKCE when no secret is provided (public client). Set to *workload_identity* to authenticate using an Azure Entra ID workload identity (federated credential) without a client secret."
+    "OAUTH2_WORKLOAD_IDENTITY_TOKEN_FILE", "When **OAUTH2_CLIENT_AUTH_METHOD** is *workload_identity*, path to the projected OIDC token file (Kubernetes service account JWT). This file must exist at pgAdmin startup."
     "OAUTH2_TOKEN_URL", "Oauth2 Access Token endpoint"
     "OAUTH2_AUTHORIZATION_URL", "Endpoint for user authorization"
-    "OAUTH2_SERVER_METADATA_URL", "Server metadata url for your OAuth2 provider"
+    "OAUTH2_SERVER_METADATA_URL", "**OIDC Discovery URL** (recommended for OIDC providers). When set, pgAdmin will use OIDC flow with automatic ID token validation and user claims from the ID token. Example: *https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration*. When using this parameter, OAUTH2_TOKEN_URL and OAUTH2_AUTHORIZATION_URL are optional as they will be discovered automatically."
     "OAUTH2_API_BASE_URL", "Oauth2 base URL endpoint to make requests simple, ex: *https://api.github.com/*"
-    "OAUTH2_USERINFO_ENDPOINT", "User Endpoint, ex: *user* (for github, or *user/emails* if the user's email address is private) and *userinfo* (for google),"
-    "OAUTH2_SCOPE", "Oauth scope, ex: 'openid email profile'. Note that an 'email' claim is required in the resulting profile."
-    "OAUTH2_ICON", "The Font-awesome icon to be placed on the oauth2 button,  ex: fa-github"
+    "OAUTH2_USERINFO_ENDPOINT", "User Endpoint, ex: *user* (for github, or *user/emails* if the user's email address is private) and *userinfo* (for google). **For OIDC providers**, this is optional if the ID token contains sufficient claims (email, preferred_username, or sub)."
+    "OAUTH2_SCOPE", "Oauth scope, ex: 'openid email profile'. **For OIDC providers**, include 'openid' scope to receive an ID token."
+    "OAUTH2_ICON", "The Font Awesome icon to be placed on the oauth2 button. A brand icon name (e.g. fa-github) uses the brands style by default; to use another style, include the style class explicitly (e.g. 'fas fa-key')."
     "OAUTH2_BUTTON_COLOR", "Oauth2 button color"
-    "OAUTH2_USERNAME_CLAIM", "The claim which is used for the username. If the value is empty
-    the email is used as username, but if a value is provided, the claim has to exist. Ex: *oid* (for AzureAD), *email* (for Github)"
+    "OAUTH2_USERNAME_CLAIM", "The claim which is used for the username. If the value is empty, **for OIDC providers** pgAdmin will use: 1) email, 2) preferred_username, or 3) sub (in that order). **For OAuth2 providers** without OIDC, email is required. Ex: *oid* (for AzureAD), *email* (for Github), *preferred_username* (for Keycloak)"
     "OAUTH2_AUTO_CREATE_USER", "Set the value to *True* if you want to automatically
     create a pgAdmin user corresponding to a successfully authenticated Oauth2 user.
     Please note that password is not stored in the pgAdmin database."
-    "OAUTH2_ADDITIONAL_CLAIMS", "If a dictionary is provided, pgAdmin will check for a matching key and value on the userinfo endpoint 
-    and in the Id Token. In case there is no match with the provided config, the user will receive an authorization error.
-    Useful for checking AzureAD_ *wids* or *groups*, GitLab_ *owner*, *maintainer* and *reporter* claims."
+    "OAUTH2_ADDITIONAL_CLAIMS", "If a dictionary is provided, pgAdmin will check for a matching key and value on the **ID token first** (for OIDC providers), then fall back to the userinfo endpoint response. In case there is no match with the provided config, the user will receive an authorization error. Useful for checking AzureAD_ *wids* or *groups*, GitLab_ *owner*, *maintainer* and *reporter* claims."
     "OAUTH2_SSL_CERT_VERIFICATION", "Set this variable to False to disable SSL certificate verification for OAuth2 provider.
     This may need to set False, in case of self-signed certificates."
     "OAUTH2_CHALLENGE_METHOD", "Enable PKCE workflow. PKCE method name, only *S256* is supported"
@@ -83,3 +126,240 @@ Ref: https://oauth.net/2/pkce
 
 To enable PKCE workflow, set the configuration parameters OAUTH2_CHALLENGE_METHOD to *S256* and OAUTH2_RESPONSE_TYPE to *code*.
 Both parameters are mandatory to enable PKCE workflow.
+
+Public vs Confidential OAuth Clients
+====================================
+
+OAuth providers support two common client types:
+
+- **Confidential clients** have a client secret and can authenticate to the token endpoint.
+- **Public clients** do not have a client secret (or the secret cannot be safely stored).
+
+pgAdmin supports interactive user login for both client types:
+
+- If **OAUTH2_CLIENT_SECRET** is set, pgAdmin treats the provider as a confidential client.
+- If **OAUTH2_CLIENT_SECRET** is missing, empty, or set to *None*, pgAdmin treats the provider as a public client and **requires PKCE**.
+
+.. note::
+    For public clients, pgAdmin uses Authlib's native behavior to perform an **unauthenticated token exchange**
+    (token endpoint client authentication method: ``none``). This is required for Authorization Code + PKCE
+    flows where no client secret is available.
+
+Azure Entra ID Workload Identity (AKS) (No Client Secret)
+=========================================================
+
+pgAdmin can authenticate to Microsoft Entra ID (Azure AD) **without a client secret** using an
+AKS Workload Identity projected service account token (OIDC federated credential).
+
+This is a **confidential client** scenario (server-side app), but client authentication to the token
+endpoint is performed using a **JWT client assertion**.
+
+Enable workload identity mode
+-----------------------------
+
+Set the following parameters in your provider configuration:
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        'OAUTH2_NAME': 'entra-workload-identity',
+        'OAUTH2_DISPLAY_NAME': 'Microsoft Entra ID',
+        'OAUTH2_CLIENT_ID': '<Application (client) ID>',
+        'OAUTH2_CLIENT_SECRET': None,  # not required
+        'OAUTH2_CLIENT_AUTH_METHOD': 'workload_identity',
+        'OAUTH2_WORKLOAD_IDENTITY_TOKEN_FILE':
+            '/var/run/secrets/azure/tokens/azure-identity-token',
+        'OAUTH2_SERVER_METADATA_URL':
+            'https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration',
+        'OAUTH2_SCOPE': 'openid email profile',
+    }]
+
+With this configuration:
+
+- pgAdmin will **not** require **OAUTH2_CLIENT_SECRET**.
+- pgAdmin will **not** use PKCE for this provider.
+- During the token exchange, pgAdmin will send:
+
+    - ``client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer``
+    - ``client_assertion=<projected service account JWT>``
+
+Azure App Registration setup
+----------------------------
+
+In Microsoft Entra ID:
+
+- Create an **App registration** for pgAdmin.
+- Configure a **Redirect URI** to ``<http/https>://<pgAdmin Server URL>/oauth2/authorize``.
+- In **Certificates & secrets**, you do **not** need to create a client secret for workload identity.
+
+Federated credential (workload identity) configuration
+------------------------------------------------------
+
+Add a **Federated credential** to the App registration:
+
+- **Issuer**: your AKS cluster OIDC issuer URL.
+- **Subject**: ``system:serviceaccount:<namespace>:<serviceaccount-name>``
+- **Audience**: typically ``api://AzureADTokenExchange``
+
+AKS ServiceAccount example
+--------------------------
+
+Example ServiceAccount for AKS Workload Identity:
+
+.. code-block:: yaml
+
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: pgadmin
+      namespace: pgadmin
+      annotations:
+        azure.workload.identity/client-id: "<Application (client) ID>"
+    ---
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: pgadmin
+      namespace: pgadmin
+    spec:
+      template:
+        metadata:
+          labels:
+            azure.workload.identity/use: "true"
+        spec:
+          serviceAccountName: pgadmin
+
+.. note::
+    The projected token file path can vary by cluster configuration.
+    In many AKS setups it is provided via the ``AZURE_FEDERATED_TOKEN_FILE`` environment
+    variable and mounted under ``/var/run/secrets/azure/tokens/``.
+
+OIDC Configuration Examples
+============================
+
+Using OIDC with Discovery Metadata (Recommended)
+-------------------------------------------------
+
+When using OIDC providers, configure the **OAUTH2_SERVER_METADATA_URL** parameter
+to enable automatic discovery and ID token validation:
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        'OAUTH2_NAME': 'my-oidc-provider',
+        'OAUTH2_DISPLAY_NAME': 'My OIDC Provider',
+        'OAUTH2_CLIENT_ID': 'your-client-id',
+        'OAUTH2_CLIENT_SECRET': 'your-client-secret',
+        'OAUTH2_SERVER_METADATA_URL': 'https://provider.example.com/.well-known/openid-configuration',
+        'OAUTH2_SCOPE': 'openid email profile',
+        # OAUTH2_USERINFO_ENDPOINT is optional when using OIDC
+        # Token and authorization URLs are discovered automatically
+    }]
+
+With this configuration:
+
+- pgAdmin will use the OIDC discovery endpoint to automatically find token and authorization URLs
+- User identity will be extracted from ID token claims (sub, email, preferred_username)
+- The userinfo endpoint will only be called as a fallback if ID token lacks required claims
+- ID token will be automatically validated using the provider's public keys
+
+Using OIDC as a Public Client (No Client Secret) with PKCE
+-----------------------------------------------------------
+
+If your OAuth/OIDC application is configured as a **public client** (no client secret), pgAdmin can still perform
+interactive user login using Authorization Code + PKCE.
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        'OAUTH2_NAME': 'my-oidc-public',
+        'OAUTH2_DISPLAY_NAME': 'My OIDC Provider (Public Client)',
+        'OAUTH2_CLIENT_ID': 'your-client-id',
+        # Public client: omit OAUTH2_CLIENT_SECRET or set it to None/empty.
+        'OAUTH2_CLIENT_SECRET': None,
+        'OAUTH2_SERVER_METADATA_URL': 'https://provider.example.com/.well-known/openid-configuration',
+        'OAUTH2_SCOPE': 'openid email profile',
+        # PKCE is mandatory for public clients
+        'OAUTH2_CHALLENGE_METHOD': 'S256',
+        'OAUTH2_RESPONSE_TYPE': 'code',
+    }]
+
+With this configuration:
+
+- pgAdmin enforces PKCE (challenge method + response type)
+- The token exchange is performed without a client secret
+
+Username Resolution for OIDC
+-----------------------------
+
+When **OAUTH2_SERVER_METADATA_URL** is configured (OIDC mode), pgAdmin will
+resolve the username in the following order:
+
+1. **OAUTH2_USERNAME_CLAIM** (if configured) - checks ID token first, then userinfo
+2. **email** claim from ID token or userinfo endpoint
+3. **preferred_username** claim from ID token (standard OIDC claim)
+4. **sub** claim from ID token (always present in OIDC, used as last resort)
+
+Example with custom username claim:
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        # ... other config ...
+        'OAUTH2_USERNAME_CLAIM': 'preferred_username',
+        # pgAdmin will use 'preferred_username' from ID token for the username
+    }]
+
+Example without custom claim (uses automatic fallback):
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        # ... other config ...
+        # No OAUTH2_USERNAME_CLAIM specified
+        # pgAdmin will try: email -> preferred_username -> sub
+    }]
+
+Additional Claims Authorization with OIDC
+------------------------------------------
+
+When using **OAUTH2_ADDITIONAL_CLAIMS** with OIDC providers, pgAdmin will:
+
+1. Check the ID token claims first (more secure, no additional network call)
+2. Fall back to userinfo endpoint response if needed
+
+Example:
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        # ... other config ...
+        'OAUTH2_ADDITIONAL_CLAIMS': {
+            'groups': ['admin-group', 'pgadmin-users'],
+            'roles': ['database-admin']
+        },
+        # pgAdmin will check these claims in ID token first,
+        # then userinfo endpoint if not found
+    }]
+
+Legacy OAuth2 Configuration (Without OIDC)
+-------------------------------------------
+
+For providers that don't support OIDC discovery, configure all endpoints manually:
+
+.. code-block:: python
+
+    OAUTH2_CONFIG = [{
+        'OAUTH2_NAME': 'github',
+        'OAUTH2_DISPLAY_NAME': 'GitHub',
+        'OAUTH2_CLIENT_ID': 'your-client-id',
+        'OAUTH2_CLIENT_SECRET': 'your-client-secret',
+        'OAUTH2_TOKEN_URL': 'https://github.com/login/oauth/access_token',
+        'OAUTH2_AUTHORIZATION_URL': 'https://github.com/login/oauth/authorize',
+        'OAUTH2_API_BASE_URL': 'https://api.github.com/',
+        'OAUTH2_USERINFO_ENDPOINT': 'user',
+        'OAUTH2_SCOPE': 'user:email',
+        # No OAUTH2_SERVER_METADATA_URL - pure OAuth2 mode
+    }]
+
+In this mode, user identity is retrieved only from the userinfo endpoint.

docs/en_US/preferences.rst

@@ -27,6 +27,83 @@ The left pane of the *Preferences* tab displays a tree control; each node of
 the tree control provides access to options that are related to the node under
 which they are displayed.
 
+The AI Node
+***********
+
+Use preferences found in the *AI* node of the tree control to configure
+AI-powered features and LLM (Large Language Model) providers.
+
+.. image:: images/preferences_ai.png
+    :alt: Preferences AI section
+    :align: center
+
+**Note:** AI features must be enabled in the server configuration (``LLM_ENABLED = True``
+in ``config.py``) for these preferences to be available.
+
+Use the fields on the *AI* panel to configure your LLM provider:
+
+* Use the *Default Provider* drop-down to select your LLM provider. Options include:
+  *Anthropic*, *OpenAI*, *Ollama*, or *Docker Model Runner*.
+
+**Anthropic Settings:**
+
+* Use the *API URL* field to set a custom API endpoint URL. Leave empty to use
+  the default Anthropic API (``https://api.anthropic.com/v1``). Set a custom URL
+  to use an Anthropic-compatible API provider.
+
+* Use the *API Key File* field to specify the path to a file containing your
+  Anthropic API key. This path refers to the filesystem where the pgAdmin
+  server is running (e.g., inside the container if using Docker). The ``~``
+  prefix is expanded to the home directory of the user running the pgAdmin
+  server process. The API key may be optional when using a custom API URL
+  with a provider that does not require authentication.
+
+* Use the *Model* field to select from the available Claude models. Click the
+  refresh button to fetch the latest available models from your configured
+  endpoint.
+
+**OpenAI Settings:**
+
+* Use the *API URL* field to set a custom API endpoint URL. Leave empty to use
+  the default OpenAI API (``https://api.openai.com/v1``). Set a custom URL to
+  use any OpenAI-compatible API provider (e.g., LiteLLM, LM Studio, EXO).
+  Include the ``/v1`` path prefix if required by your provider
+  (e.g., ``http://localhost:1234/v1``).
+
+* Use the *API Key File* field to specify the path to a file containing your
+  OpenAI API key. This path refers to the filesystem where the pgAdmin
+  server is running (e.g., inside the container if using Docker). The ``~``
+  prefix is expanded to the home directory of the user running the pgAdmin
+  server process. The API key may be optional when using a custom API URL
+  with a provider that does not require authentication.
+
+* Use the *Model* field to select from the available GPT models. Click the
+  refresh button to fetch the latest available models from your configured
+  endpoint.
+
+**Ollama Settings:**
+
+* Use the *API URL* field to specify the Ollama server URL
+  (default: ``http://localhost:11434``).
+
+* Use the *Model* field to select from the available models or enter a custom
+  model name (e.g., ``llama2``, ``mistral``). Click the refresh button to fetch
+  the latest available models from your Ollama server.
+
+**Docker Model Runner Settings:**
+
+* Use the *API URL* field to specify the Docker Model Runner API URL
+  (default: ``http://localhost:12434``). Available in Docker Desktop 4.40+.
+
+* Use the *Model* field to select from the available models or enter a custom
+  model name. Click the refresh button to fetch the latest available models
+  from your Docker Model Runner.
+
+.. note:: You can also use the *OpenAI* provider with a custom API URL for any
+   OpenAI-compatible endpoint, including Docker Model Runner, LM Studio, EXO,
+   and other local inference servers. This can be useful when you want to use
+   a provider that isn't explicitly listed but supports the OpenAI API format.
+
 The Browser Node
 ****************
 
@@ -60,6 +137,9 @@ Use the fields on the *Display* panel to specify general display preferences:
   all the shared servers from the object explorer. **Note:** This option is visible only when
   pgAdmin is running in server mode.
 
+* When the *Show column data type?* switch is turned off, then the data types 
+  of the columns will not be displayed alongside their column names.
+
 * When the *Show empty object collections?* switch is turned off, then all object
   collections which are empty will be hidden from browser tree.
 
@@ -101,7 +181,7 @@ related settings:
     :align: center
 
 * Use *Enable object breadcrumbs?* to enable or disable object breadcrumbs
-  displayed on on object mouse hover.
+  displayed on object mouse hover.
 
 * Use *Show comment with object breadcrumbs?* to enable or disable the
   comment visibility which comes displayed with object breadcrumbs.
@@ -139,11 +219,11 @@ Use field on *Tab settings* panel to specify the tab related properties.
 
 * Use *Debugger tab title placeholder* field to customize the Debugger tab title.
 
-* When the *Dynamic tab size* If set to True, the tabs will take full size as per the title, it will also applicable for already opened tabs
+* When the *Dynamic tab size* switch is set to *True*, the tabs will take full size as per the title. This will also apply to already opened tabs.
 
 * Use the *PSQL tool tab title placeholder* field to customize the PSQL tool tab title.
 
-* When the *Open in new browser tab* filed is selected for Query tool, Schema Diff or Debugger, it will
+* When the *Open in new browser tab* field is selected for Query tool, Schema Diff or Debugger, it will
   open in a new browser tab when invoked.
 
 * Use the *Query tool tab title placeholder* field to customize the query tool tab title.
@@ -172,7 +252,7 @@ Expand the *Dashboards* node to specify your dashboard display preferences.
     :alt: Preferences dashboard refresh options
     :align: center
 
-Use the fields on the *Refresh rates* panel to specify your refersh rates
+Use the fields on the *Refresh rates* panel to specify your refresh rate
 preferences for the graphs on the *Dashboard* tab:
 
 * Use the *Average load statistics refresh rate* field to specify the number of
@@ -254,6 +334,12 @@ Use the fields on the *Options* panel to manage ERD preferences.
 * Use *Cardinality Notation* to change the cardinality notation format
   used to present relationship links.
 
+* Use *Format ERD Project File?* if you want to format the .pgerd ERD
+  project file. It's a JSON file which will be formatted.
+
+* Use *Image Download Resolution* to change the ERD image download
+  resolution. Higher values will use higher memory and slower rendering.
+
 * When the *SQL With DROP Table* switch is set to *True*, the SQL
   generated by the ERD Tool will add DROP table DDL before each CREATE
   table DDL.
@@ -383,11 +469,17 @@ Use the fields on the *File Downloads* panel to manage file downloads related pr
 
 * When the *Automatically open downloaded files?* switch is set to *True*
   the downloaded file will automatically open in the system's default
-  application associated with that file type.
+  application associated with that file type. **Note:** This option is applicable and
+  visible only in desktop mode.
+
+* When the *Enable binary data download?* switch is set to *True*,
+  binary data can be downloaded from the result grid. Default is set to *False*
+  to prevent excessive memory usage on the server.
 
 * When the *Prompt for the download location?* switch is set to *True*
   a prompt will appear after clicking the download button, allowing you
-  to choose the download location.
+  to choose the download location. **Note:** This option is applicable and
+  visible only in desktop mode.
 
 **Note:** File Downloads related settings are applicable and visible only in desktop mode.
 
@@ -451,7 +543,7 @@ monitored databases:
   locations used by PostgreSQL.
 
 **Note:** Use the 'Validate path' button to check the existence of the utility
-programs (pg_dump, pg_dumpall, pg_restore and psql) and there respective versions.
+programs (pg_dump, pg_dumpall, pg_restore and psql) and their respective versions.
 
 .. image:: images/preferences_paths_help.png
     :alt: Preferences binary path help section
@@ -543,6 +635,39 @@ a graphical EXPLAIN.
 * When the *Verbose output?* switch is set to *True*, graphical explain details
   will include extended information about the query execution plan.
 
+Use the fields on the *Geometry Viewer* panel to configure a custom map tile
+provider used as a base layer when viewing geometry data.
+
+* Use the *Custom tile provider URL* field to specify the URL template of a
+  custom XYZ tile provider, e.g.
+  ``https://myserver.example.com/tiles/{z}/{x}/{y}.png``. The template must
+  contain the ``{x}``, ``{y}`` and ``{z}`` placeholders, and may contain
+  ``{s}`` for subdomains (a, b, c). Leave the field empty to disable the
+  custom tile provider.
+
+* Use the *Custom tile provider name* field to specify the display name of
+  the custom tile provider in the layer selector of the Geometry Viewer.
+
+* Use the *Custom tile provider CRS* field to specify the coordinate
+  reference system of the custom tile provider. If it is not EPSG:3857
+  (Web Mercator), the built-in tile layers will be hidden as they cannot be
+  mixed with other coordinate systems.
+
+* Use the *Custom tile provider attribution* field to specify the
+  attribution text shown on the map. It may contain HTML links.
+
+* Use the *Custom tile provider max zoom* field to specify the maximum zoom
+  level of the custom tile provider.
+
+When a custom tile provider is configured, it is selected as the default
+base layer of the Geometry Viewer.
+
+An administrator may set a system-wide default for these fields via the
+``DEFAULT_GEOMETRY_VIEWER_PROVIDER`` setting in :ref:`config_py`. It applies
+to any user who has not saved their own values for the fields above; a
+user's own preferences, once saved, always take precedence over the
+system-wide default.
+
 .. image:: images/preferences_graph_visualiser.png
     :alt: Preferences sqleditor graph visualiser section
     :align: center

docs/en_US/procedure_dialog.rst

@@ -36,6 +36,9 @@ Use the fields in the *Definition* tab to define the procedure:
 
 * Use the drop-down listbox next to *Language* to select a language. The default
   is *edbspl*.
+* Use the drop-down listbox next to *Depends on extensions* to select the extension that this procedure
+  depends on (for example, edbspl). If set, dropping the extension will automatically drop the
+  procedure as well.
 * Use the fields in the *Arguments* section to define an argument. Click *Add* to set
   parameters and values for the argument:
 * Use the drop-down listbox next to *Data type* to select a data type.
@@ -132,7 +135,7 @@ procedure. Click *Add* to add each security label selection:
 
 * Specify a security label provider in the *Provider* field. The named provider
   must be loaded and must consent to the proposed labeling operation.
-* Specify a a security label in the *Security Label* field. The meaning of a
+* Specify a security label in the *Security Label* field. The meaning of a
   given label is at the discretion of the label provider. PostgreSQL places no
   restrictions on whether or how a label provider must interpret security
   labels; it merely provides a mechanism for storing them.

docs/en_US/query_tool.rst

@@ -32,8 +32,9 @@ The Query Tool features two panels:
 
 * The upper panel displays the *SQL Editor*. You can use the panel to enter,
   edit, or execute a query or a script. It also shows the *History* tab which can be used
-  to view the queries that have been executed in the session, and a *Scratch Pad*
-  which can be used to hold text snippets during editing. If the Scratch Pad is
+  to view the queries that have been executed in the session, a *Scratch Pad*
+  which can be used to hold text snippets during editing, and an *AI Assistant*
+  tab for generating SQL from natural language (when AI is configured). If the Scratch Pad is
   closed, it can be re-opened (or additional ones opened) by right-clicking in
   the SQL Editor and other panels and adding a new panel.
 * The lower panel displays the *Data Output* panel. The tabbed panel displays
@@ -201,6 +202,51 @@ can be adjusted in ``config_local.py`` or ``config_system.py`` (see the
 `MAX_QUERY_HIST_STORED` value. See the :ref:`Deployment <deployment>` section
 for more information.
 
+AI Assistant Panel
+******************
+
+The *AI Assistant* tab provides a chat-style interface for generating SQL queries
+from natural language descriptions. This feature requires an AI provider to be
+configured in *Preferences > AI*. For configuration details, see the
+:ref:`preferences` documentation.
+
+.. image:: images/query_ai_assistant.png
+    :alt: Query tool AI Assistant panel
+    :align: center
+
+To use the AI Assistant:
+
+1. Click on the *AI Assistant* tab in the upper panel, or use the *AI Assistant*
+   toolbar button.
+2. Type a description of the SQL query you need in natural language.
+3. Press Enter or click the send button to submit your request.
+4. The AI will analyze your database schema and generate appropriate SQL.
+
+The AI Assistant displays conversations with your messages and AI responses. When
+the AI generates SQL, it appears in a syntax-highlighted code block with action
+buttons:
+
+* **Insert** - Insert the SQL at the current cursor position in the SQL Editor.
+* **Replace** - Replace all content in the SQL Editor with the generated SQL.
+* **Copy** - Copy the SQL to the clipboard.
+
+The AI Assistant maintains conversation context, allowing you to refine queries
+iteratively. For example, you can ask for a query and then follow up with
+"also add a filter for active users" to modify the previous result.
+
+**Tips for effective use:**
+
+* Be specific about table and column names if you know them.
+* Describe the desired output format (e.g., "show count by category").
+* For complex queries, break down requirements step by step.
+* Use the *Clear* button to start a fresh conversation.
+
+**Note:** The AI Assistant uses database schema inspection tools to understand
+your database structure. It supports SELECT, INSERT, UPDATE, DELETE, and DDL
+statements. All generated queries should be reviewed before execution. See
+:ref:`ai_data_handling` for details of the information that is transmitted to
+your configured LLM provider.
+
 The Data Output Panel
 *********************
 
@@ -275,6 +321,8 @@ the drop down on the right side of *Explain Analyze* button in the toolbar.
 
 Please note that pgAdmin generates the *Explain [Analyze]* plan in JSON format.
 
+**Note**: If multiple queries are present and none is selected, *Explain [Analyze]* runs the query located at the cursor position.
+
 On successful generation of *Explain* plan, it will create three tabs/panels
 under the Explain panel.
 
@@ -333,6 +381,44 @@ If planner mis-estimated number of rows (actual vs planned) by
     :alt: Query tool explain plan statistics
     :align: center
 
+* AI Insights
+
+The *AI Insights* tab provides AI-powered analysis of query execution plans,
+identifying performance bottlenecks and suggesting optimizations. This tab is
+only available when an AI provider is configured in *Preferences > AI*.
+
+.. image:: images/query_explain_ai_insights.png
+    :alt: Query tool explain plan AI insights
+    :align: center
+
+When you switch to the AI Insights tab, the AI analyzes the execution plan and
+provides:
+
+**Performance Bottlenecks** - Issues identified in the query plan, such as:
+
+* Sequential scans on large tables that could benefit from indexes
+* Significant differences between estimated and actual row counts
+* Expensive sort or hash operations
+* Nested loops with high iteration counts
+
+**Recommendations** - Concrete suggestions to improve query performance:
+
+* Index creation statements with appropriate columns
+* ANALYZE commands to update table statistics
+* Configuration parameter adjustments
+* Query restructuring suggestions
+
+Each recommendation that includes SQL (such as CREATE INDEX statements) has
+action buttons to *Copy* the SQL to the clipboard or *Insert* it into the
+Query Editor.
+
+Click the *Regenerate* button to request a fresh analysis of the current plan.
+
+**Note:** AI analysis is generated on-demand when you first click the AI Insights
+tab or when a new explain plan is generated while the tab is active. The analysis
+provides guidance but all suggested changes should be carefully evaluated before
+applying to production databases.
+
 Messages Panel
 **************
 

docs/en_US/query_tool_toolbar.rst

@@ -85,9 +85,7 @@ Query Editing Options
    |                      +---------------------------------------------------------------------------------------------------+-----------------------+
    |                      | Select *Find* to provide a search target, and search the SQL Editor contents.                     | Cmd/Ctrl + F          |
    |                      +---------------------------------------------------------------------------------------------------+-----------------------+
-   |                      | Select *Replace* to locate and replace (with prompting) individual occurrences of the target.     | Option + Cmd + F (MAC)|
-   |                      |                                                                                                   | Ctrl + Shift + F      |
-   |                      |                                                                                                   | (Others)              |
+   |                      | Select *Replace* to locate and replace (with prompting) individual occurrences of the target.     | Cmd/Ctrl + R          |
    |                      +---------------------------------------------------------------------------------------------------+-----------------------+
    |                      | Select *Go to Line/Column* to go to specified line number and column position                     | Cmd/Ctrl + L          |
    |                      +---------------------------------------------------------------------------------------------------+-----------------------+
@@ -241,6 +239,8 @@ Pagination Options
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
    | *Edit Range*         | Click to open the from and to rows range inputs to allow setting them.                            |                |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
+   | *Show Entire Range*  | Click to get all the rows and set the from and to rows range                                      |                |
+   +----------------------+---------------------------------------------------------------------------------------------------+----------------+
    | *Page No*            | Enter the page no you want to jump to out of total shown next to this input                       |                |
    +----------------------+---------------------------------------------------------------------------------------------------+----------------+
    | *First Page*         | Click to go to the first page.                                                                    |                |

docs/en_US/release_notes.rst

@@ -12,6 +12,17 @@ notes for it.
    :maxdepth: 1
 
 
+   release_notes_9_18
+   release_notes_9_17
+   release_notes_9_16
+   release_notes_9_15
+   release_notes_9_14
+   release_notes_9_13
+   release_notes_9_12
+   release_notes_9_11
+   release_notes_9_10
+   release_notes_9_9
+   release_notes_9_8
    release_notes_9_7
    release_notes_9_6
    release_notes_9_5

docs/en_US/release_notes_9_10.rst

@@ -0,0 +1,47 @@
+************
+Version 9.10
+************
+
+Release date: 2025-11-13
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.9.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 13, 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 13, 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.0
+
+
+New features
+************
+
+  | `Issue #4306 <https://github.com/pgadmin-org/pgadmin4/issues/4306>`_ -  Added the ability to search for tables and automatically bring them into view in the ERD tool.
+  | `Issue #6391 <https://github.com/pgadmin-org/pgadmin4/issues/6391>`_ -  Add support of DEPENDS/NO DEPENDS ON EXTENSION for PROCEDURE.
+  | `Issue #6698 <https://github.com/pgadmin-org/pgadmin4/issues/6698>`_ -  Add support for setting image download resolution in the ERD tool.
+  | `Issue #7885 <https://github.com/pgadmin-org/pgadmin4/issues/7885>`_ -  Add support for displaying detailed Citus query plans instead of 'Custom Scan' placeholder.
+  | `Issue #8912 <https://github.com/pgadmin-org/pgadmin4/issues/8912>`_ -  Add support for formatting .pgerd ERD project file.
+
+Housekeeping
+************
+
+  | `Issue #8676 <https://github.com/pgadmin-org/pgadmin4/issues/8676>`_ -  Migrate pgAdmin UI to use React 19.
+
+Bug fixes
+*********
+
+  | `Issue #8504 <https://github.com/pgadmin-org/pgadmin4/issues/8504>`_ -  Fixed an issue where data output column resize is not sticking in Safari.
+  | `Issue #9117 <https://github.com/pgadmin-org/pgadmin4/issues/9117>`_ -  Fixed an issue where Schema Diff does not ignore Tablespace for indexes.
+  | `Issue #9132 <https://github.com/pgadmin-org/pgadmin4/issues/9132>`_ -  Fixed an issue where the 2FA window redirected to the login page after session expiration.
+  | `Issue #9233 <https://github.com/pgadmin-org/pgadmin4/issues/9233>`_ -  Fixed an issue where the Select All option on the columns tab of import/export data was not working in languages other than English.
+  | `Issue #9240 <https://github.com/pgadmin-org/pgadmin4/issues/9240>`_ -  Fixed an issue where the Debian build process failed with a "Sphinx module not found" error when using a Python virtual environment.
+  | `Issue #9281 <https://github.com/pgadmin-org/pgadmin4/issues/9281>`_ -  Fixed an issue where the last used storage directory was reset to blank, leading to access denied errors during backup or restore operations.
+  | `Issue #9304 <https://github.com/pgadmin-org/pgadmin4/issues/9304>`_ -  Fixed an issue that prevented assigning multiple users to an RLS policy.
+  | `Issue #9320 <https://github.com/pgadmin-org/pgadmin4/issues/9320>`_ -  Fixed remote code execution vulnerability when restoring PLAIN-format SQL dumps in server mode (CVE-2025-12762).
+  | `Issue #9323 <https://github.com/pgadmin-org/pgadmin4/issues/9323>`_ -  Fixed Command injection vulnerability allowing arbitrary command execution on Windows (CVE-2025-12763).
+  | `Issue #9324 <https://github.com/pgadmin-org/pgadmin4/issues/9324>`_ -  Fixed LDAP authentication flow vulnerable to TLS certificate verification bypass (CVE-2025-12765).
+  | `Issue #9325 <https://github.com/pgadmin-org/pgadmin4/issues/9325>`_ -  Fixed LDAP injection vulnerability in LDAP authentication flow (CVE-2025-12764).

docs/en_US/release_notes_9_11.rst

@@ -0,0 +1,45 @@
+************
+Version 9.11
+************
+
+Release date: 2025-12-11
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.10.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 13, 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 13, 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.0
+
+
+New features
+************
+
+  | `Issue #6388 <https://github.com/pgadmin-org/pgadmin4/issues/6388>`_ -  Add support of DEPENDS/NO DEPENDS ON EXTENSION for INDEX.
+  | `Issue #6390 <https://github.com/pgadmin-org/pgadmin4/issues/6390>`_ -  Add support of DEPENDS/NO DEPENDS ON EXTENSION for MATERIALIZED VIEW.
+  | `Issue #8968 <https://github.com/pgadmin-org/pgadmin4/issues/8968>`_ -  Add support for showing the column data type beside column name in the object explorer.
+  | `Issue #9263 <https://github.com/pgadmin-org/pgadmin4/issues/9263>`_ -  Added Ubuntu 25.10 and Fedora 43
+  | `Issue #9345 <https://github.com/pgadmin-org/pgadmin4/issues/9345>`_ -  Add conditional TLS support for the Ingress in the Helm chart.
+
+Housekeeping
+************
+
+Bug fixes
+*********
+
+  | `Issue #9036 <https://github.com/pgadmin-org/pgadmin4/issues/9036>`_ -  Fixed an issue on type casting of default string function/procedure arguments in debugger tool.
+  | `Issue #9155 <https://github.com/pgadmin-org/pgadmin4/issues/9155>`_ -  Fix pkg_resources deprecation warning by migrating Docker base image to python:3-alpine from alpine:latest.
+  | `Issue #9297 <https://github.com/pgadmin-org/pgadmin4/issues/9297>`_ -  Fixed an issue where EXPLAIN should run on query under cursor if no text is selected.
+  | `Issue #9351 <https://github.com/pgadmin-org/pgadmin4/issues/9351>`_ -  Fixed an issue where opening file in Query Tool does not retain file name in tab.
+  | `Issue #9354 <https://github.com/pgadmin-org/pgadmin4/issues/9354>`_ -  Fixed an issue where connection is failing via Query Tool/PSQL Tool workspaces.
+  | `Issue #9368 <https://github.com/pgadmin-org/pgadmin4/issues/9368>`_ -  Plain SQL restore runs with '\restrict' option to prevent harmful psql meta-commands (CVE-2025-13780).
+  | `Issue #9372 <https://github.com/pgadmin-org/pgadmin4/issues/9372>`_ -  Fixed an issue where copying highlighted text in the query tool data output cell editor would copy the complete string.
+  | `Issue #9373 <https://github.com/pgadmin-org/pgadmin4/issues/9373>`_ -  Fixed an issue where copying a single cell should not add quoting.
+  | `Issue #9393 <https://github.com/pgadmin-org/pgadmin4/issues/9393>`_ -  Fix the Helm chart server definition and change the app version.
+  | `Issue #9399 <https://github.com/pgadmin-org/pgadmin4/issues/9399>`_ -  Specify the correct hostname placeholder for the Password Exec command.
+  | `Issue #9408 <https://github.com/pgadmin-org/pgadmin4/issues/9408>`_ -  Ensure the proper handling of extra volume mount configurations in the Helm deployment template by correcting the configuration value references.

docs/en_US/release_notes_9_12.rst

@@ -0,0 +1,60 @@
+************
+Version 9.12
+************
+
+Release date: 2026-02-05
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.11.
+
+.. warning:: Starting with this release, pgAdmin Windows installers are signed
+    with a new code signing certificate. When installing or running pgAdmin on
+    Windows, you should verify that the digital signature shows the certificate
+    name as **"Open Source Developer, David John Page"**. This certificate will
+    be used for this and future releases.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 13, 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 13, 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.0
+
+
+New features
+************
+
+  | `Issue #6451 <https://github.com/pgadmin-org/pgadmin4/issues/6451>`_ - Add new options like INHERIT and SET to the Role's membership tab.
+  | `Issue #8890 <https://github.com/pgadmin-org/pgadmin4/issues/8890>`_ - Add a new button in the query tool data output toolbar to get entire range of data.
+  | `Issue #9292 <https://github.com/pgadmin-org/pgadmin4/issues/9292>`_ - Enhance OAUTH2 and OIDC authentication support with improved claims handling and configuration options.
+
+Housekeeping
+************
+
+
+Bug fixes
+*********
+
+  | `Issue #8916 <https://github.com/pgadmin-org/pgadmin4/issues/8916>`_ - Warn user of unsaved data output edits before page navigation.
+  | `Issue #8987 <https://github.com/pgadmin-org/pgadmin4/issues/8987>`_ - Fix Query Tool state restoration for new connections and queries.
+  | `Issue #9074 <https://github.com/pgadmin-org/pgadmin4/issues/9074>`_ - Fix pg_restore logs to distinguish UI sync issues from actual failures.
+  | `Issue #9110 <https://github.com/pgadmin-org/pgadmin4/issues/9110>`_ - Optimize checkbox selection logic in backup dialog objects tree.
+  | `Issue #9196 <https://github.com/pgadmin-org/pgadmin4/issues/9196>`_ - Fixed an issue where double click to open a file in the file manager is not working.
+  | `Issue #9223 <https://github.com/pgadmin-org/pgadmin4/issues/9223>`_ - Upgrade ID column in the database table to BigInteger to support large OID values.
+  | `Issue #9235 <https://github.com/pgadmin-org/pgadmin4/issues/9235>`_ - Fixed an issue where "View/Edit Data" shortcut opened "First 100 rows" instead of "All Rows".
+  | `Issue #9258 <https://github.com/pgadmin-org/pgadmin4/issues/9258>`_ - Ensure saved shared server passwords are re-encrypted on password change.
+  | `Issue #9260 <https://github.com/pgadmin-org/pgadmin4/issues/9260>`_ - Fixed an issue where data filter dialog removes newline character when sending SQL to the query tool.
+  | `Issue #9285 <https://github.com/pgadmin-org/pgadmin4/issues/9285>`_ - Fixed an issue where the dashboard freezes on initial render when there is a high number of locks.
+  | `Issue #9293 <https://github.com/pgadmin-org/pgadmin4/issues/9293>`_ - Fixed the SSL certificate issue while checking for the upgrade.
+  | `Issue #9332 <https://github.com/pgadmin-org/pgadmin4/issues/9332>`_ - Fixed a sorting issue in the system stats memory usage table.
+  | `Issue #9350 <https://github.com/pgadmin-org/pgadmin4/issues/9350>`_ - Disable Parameters and Membership fields when object is not new for Login and group roles.
+  | `Issue #9380 <https://github.com/pgadmin-org/pgadmin4/issues/9380>`_ - Fixed an issue where the Query History panel would auto-scroll to the top and did not preserve the scroll bar position for the selected entry.
+  | `Issue #9402 <https://github.com/pgadmin-org/pgadmin4/issues/9402>`_ - Fixed an issue where pgAdmin4 app on macOS cannot auto-update while running on a read-only volume even if present in the Applications folder.
+  | `Issue #9500 <https://github.com/pgadmin-org/pgadmin4/issues/9500>`_ - Fixed an issue where connection parameters were using localized values instead of literal values, causing connection failures.
+  | `Issue #9518 <https://github.com/pgadmin-org/pgadmin4/issues/9518>`_ - Mask the secret key for restrict option in the process watcher when restoring plain SQL file (CVE-2026-1707).
+  | `Issue #9522 <https://github.com/pgadmin-org/pgadmin4/issues/9522>`_ - Ensure the container deployment supports boolean values in yaml format.
+  | `Issue #9552 <https://github.com/pgadmin-org/pgadmin4/issues/9552>`_ - Ensure that the tooltip for the password cell is not visible.
+  | `Issue #9553 <https://github.com/pgadmin-org/pgadmin4/issues/9553>`_ - Fix pgAdmin fails when performing Backup/Restore on a PostgreSQL connection defined exclusively via pg_service.conf.
+  | `Issue #9567 <https://github.com/pgadmin-org/pgadmin4/issues/9567>`_ - Update menu bar documentation.

docs/en_US/release_notes_9_13.rst

@@ -0,0 +1,44 @@
+************
+Version 9.13
+************
+
+Release date: 2026-03-05
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.12.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 13, 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 13, 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.0
+
+
+New features
+************
+
+  | `Issue #229 <https://github.com/pgadmin-org/pgadmin4/issues/229>`_   - Allow users to customize "OF TYPE" columns during table creation.
+  | `Issue #5578 <https://github.com/pgadmin-org/pgadmin4/issues/5578>`_ - No FK are shown in diagram created from existing tables in the ERD Tool.
+  | `Issue #6386 <https://github.com/pgadmin-org/pgadmin4/issues/6386>`_ - Add support for 'ONLY' in Index creation dialog.
+  | `Issue #8198 <https://github.com/pgadmin-org/pgadmin4/issues/8198>`_ - Allow "drag-n-drop" for only user chosen tables, and show relations between them.
+  | `Issue #9229 <https://github.com/pgadmin-org/pgadmin4/issues/9229>`_ - Load predefined users from a JSON file through command line.
+  | `Issue #9641 <https://github.com/pgadmin-org/pgadmin4/issues/9641>`_ - Core LLM integration infrastructure, AI reports for security, schema, and performance, AI chat for the Query Tool, and AI Insights for EXPLAIN.
+
+Housekeeping
+************
+
+Bug fixes
+*********
+
+  | `Issue #7578 <https://github.com/pgadmin-org/pgadmin4/issues/7578>`_ - Fixed an issue where the 'Quote strings only' configuration was ignored when downloading the result set.
+  | `Issue #8988 <https://github.com/pgadmin-org/pgadmin4/issues/8988>`_ - Fixed an issue where tools settings changed by the users were not restored on application relaunch.
+  | `Issue #9258 <https://github.com/pgadmin-org/pgadmin4/issues/9258>`_ - Fixed an issue where modifying a shared server incorrectly updated the original server details.
+  | `Issue #9484 <https://github.com/pgadmin-org/pgadmin4/issues/9484>`_ - Fixed an issue where a long name in ERD table node was not breaking into multiple lines.
+  | `Issue #9486 <https://github.com/pgadmin-org/pgadmin4/issues/9486>`_ - Fixed an issue where column comments were not displayed in the SQL tab for materialised views.
+  | `Issue #9572 <https://github.com/pgadmin-org/pgadmin4/issues/9572>`_ - Fix an issue where deployment of helm chart crashing with operation not permitted.
+  | `Issue #9583 <https://github.com/pgadmin-org/pgadmin4/issues/9583>`_ - Fix translation compilation.
+  | `Issue #9649 <https://github.com/pgadmin-org/pgadmin4/issues/9649>`_ - Fix broken checkbox selection in backup dialog objects tree.
+  | `Issue #9651 <https://github.com/pgadmin-org/pgadmin4/issues/9651>`_ - Fixed an issue in file dialog where rename was not working.

docs/en_US/release_notes_9_14.rst

@@ -0,0 +1,52 @@
+************
+Version 9.14
+************
+
+Release date: 2026-04-02
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.13.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 13, 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 13, 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.2
+
+
+New features
+************
+
+  | `Issue #4011 <https://github.com/pgadmin-org/pgadmin4/issues/4011>`_ -  Added support to download binary data from result grid.
+  | `Issue #9703 <https://github.com/pgadmin-org/pgadmin4/issues/9703>`_ -  Added support for custom LLM provider URLs for OpenAI and Anthropic, allowing use of OpenAI-compatible providers such as LM Studio, EXO, and LiteLLM.
+  | `Issue #9709 <https://github.com/pgadmin-org/pgadmin4/issues/9709>`_ -  Fixed an issue where AI features (AI Assistant tab, AI Reports menus, and AI Preferences) were visible in the UI even when LLM_ENABLED is set to False.
+  | `Issue #9738 <https://github.com/pgadmin-org/pgadmin4/issues/9738>`_ -  Allow copying of text from the AI Assistant chat panel.
+
+Housekeeping
+************
+
+Bug fixes
+*********
+
+  | `Issue #8992 <https://github.com/pgadmin-org/pgadmin4/issues/8992>`_ -  Fixed an issue where selecting all in the Query Tool's Messages tab would select the entire page content.
+  | `Issue #9279 <https://github.com/pgadmin-org/pgadmin4/issues/9279>`_ -  Fixed an issue where OAuth2 authentication fails with 'object has no attribute' if OAUTH2_AUTO_CREATE_USER is False.
+  | `Issue #9392 <https://github.com/pgadmin-org/pgadmin4/issues/9392>`_ -  Ensure that the Geometry Viewer refreshes when re-running queries or switching geometry columns, preventing stale data from being displayed.
+  | `Issue #9457 <https://github.com/pgadmin-org/pgadmin4/issues/9457>`_ -  Fixed Process Watcher garbled text on Windows with non-UTF-8 locales.
+  | `Issue #9570 <https://github.com/pgadmin-org/pgadmin4/issues/9570>`_ -  Fixed an issue where ALT+F5 for executing a query in the Query Tool shows a crosshair cursor icon for rectangular selection.
+  | `Issue #9648 <https://github.com/pgadmin-org/pgadmin4/issues/9648>`_ -  Fixed an issue where the default fillfactor value for B-tree indexes was incorrect.
+  | `Issue #9694 <https://github.com/pgadmin-org/pgadmin4/issues/9694>`_ -  Fixed an issue where AI Reports are grayed out after setting an API key by auto-selecting the default provider.
+  | `Issue #9696 <https://github.com/pgadmin-org/pgadmin4/issues/9696>`_ -  Fixed an issue where AI Assistant does not notify that No API Key or Provider is Set.
+  | `Issue #9702 <https://github.com/pgadmin-org/pgadmin4/issues/9702>`_ -  Fixed misleading AI activity messages that could be mistaken for actual database operations.
+  | `Issue #9719 <https://github.com/pgadmin-org/pgadmin4/issues/9719>`_ -  Fixed an issue where AI Reports fail with OpenAI models that do not support the temperature parameter.
+  | `Issue #9721 <https://github.com/pgadmin-org/pgadmin4/issues/9721>`_ -  Fixed an issue where permissions page is not completely accessible on full scroll.
+  | `Issue #9729 <https://github.com/pgadmin-org/pgadmin4/issues/9729>`_ -  Fixed an issue where some LLM models would not use database tools in the AI assistant, instead returning text descriptions of tool calls.
+  | `Issue #9732 <https://github.com/pgadmin-org/pgadmin4/issues/9732>`_ -  Improve the AI Assistant user prompt to be more descriptive of the actual functionality.
+  | `Issue #9734 <https://github.com/pgadmin-org/pgadmin4/issues/9734>`_ -  Fixed an issue where LLM responses are not streamed or rendered properly in the AI Assistant.
+  | `Issue #9736 <https://github.com/pgadmin-org/pgadmin4/issues/9736>`_ -  Fix an issue where the AI Assistant was not retaining conversation context between messages, with chat history compaction to manage token budgets.
+  | `Issue #9740 <https://github.com/pgadmin-org/pgadmin4/issues/9740>`_ -  Fixed an issue where the AI Assistant input textbox sometimes swallows the first character of input.
+  | `Issue #9758 <https://github.com/pgadmin-org/pgadmin4/issues/9758>`_ -  Clarify where the LLM API key files should be.
+  | `Issue #9789 <https://github.com/pgadmin-org/pgadmin4/issues/9789>`_ -  Fixed an issue where the Query tool kept prompting for a password when using a shared server.
+  | `Issue #9795 <https://github.com/pgadmin-org/pgadmin4/issues/9795>`_ -  Support /v1/responses for OpenAI models.

docs/en_US/release_notes_9_15.rst

@@ -0,0 +1,113 @@
+************
+Version 9.15
+************
+
+Release date: 2026-05-11
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.14.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 13, 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 13, 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.2
+
+
+New features
+************
+
+  | `Issue #9657 <https://github.com/pgadmin-org/pgadmin4/issues/9657>`_ -  Allow the container image to run as a non-default user via the PUID and PGID environment variables.
+
+Housekeeping
+************
+
+  | `Issue #9764 <https://github.com/pgadmin-org/pgadmin4/issues/9764>`_ -  Update the Swedish translation.
+  | `Issue #9827 <https://github.com/pgadmin-org/pgadmin4/issues/9827>`_ -  Bump Python and JavaScript dependencies.
+  | `Issue #9832 <https://github.com/pgadmin-org/pgadmin4/issues/9832>`_ -  Fix the Czech translation for 'Refresh'.
+  | `Issue #9834 <https://github.com/pgadmin-org/pgadmin4/issues/9834>`_ -  Bump runtime dependencies and upgrade ESLint to v10.
+  | `Issue #9839 <https://github.com/pgadmin-org/pgadmin4/issues/9839>`_ -  Update the Russian translation.
+  | `Issue #9870 <https://github.com/pgadmin-org/pgadmin4/issues/9870>`_ -  Bump runtime and development dependencies.
+  | `Issue #9873 <https://github.com/pgadmin-org/pgadmin4/issues/9873>`_ -  Use an ``<OWNER>`` placeholder in resql tests instead of a hardcoded 'postgres' role to support non-default superuser names.
+  | `Issue #9893 <https://github.com/pgadmin-org/pgadmin4/issues/9893>`_ -  Update the Spanish translation.
+  | `Issue #9906 <https://github.com/pgadmin-org/pgadmin4/issues/9906>`_ -  Update the Italian translation.
+
+Bug fixes
+*********
+
+  | `Issue #9656 <https://github.com/pgadmin-org/pgadmin4/issues/9656>`_ -  Use absolute paths for ``a2enmod`` and ``a2enconf`` in the Debian setup script so it works when ``/usr/sbin`` is not on PATH.
+  | `Issue #9830 <https://github.com/pgadmin-org/pgadmin4/issues/9830>`_ -  Fix cross-user data access and shared-server privilege escalation in server mode (CVE-2026-7813). Also applies the ``@with_object_filters`` access-control decorator to ``ServerNode.list``.
+  | `Issue #9835 <https://github.com/pgadmin-org/pgadmin4/issues/9835>`_ -  Tighten Shared Server feature parity, owner-only field handling, and write guards as a follow-up to the data-isolation hardening.
+  | `Issue #9865 <https://github.com/pgadmin-org/pgadmin4/issues/9865>`_ -  Fix stored cross-site scripting (XSS) via crafted PostgreSQL object names rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814). Reported by Fahar Abbas.
+  | `Issue #9898 <https://github.com/pgadmin-org/pgadmin4/issues/9898>`_ -  Fix SQL injection in Maintenance tool option values (CVE-2026-7815). Reported by j3seer.
+  | `Issue #9899 <https://github.com/pgadmin-org/pgadmin4/issues/9899>`_ -  Fix OS command injection in Import/Export query export (CVE-2026-7816). Reported by Chung Kim (chungkn), OneMount Group.
+  | `Issue #9900 <https://github.com/pgadmin-org/pgadmin4/issues/9900>`_ -  Fix local-file inclusion and server-side request forgery in LLM API configuration endpoints (CVE-2026-7817). Reported by j3seer.
+  | `Issue #9901 <https://github.com/pgadmin-org/pgadmin4/issues/9901>`_ -  Fix unsafe deserialization in the session manager that could lead to remote code execution (CVE-2026-7818). Also encrypts session files at rest using Fernet, restricts session-file permissions to 0o600, switches the session-digest default from SHA-1 to SHA-256, drops several non-roundtrippable live objects from the session (``AuthSourceManager`` and the Azure, RDS, Google Cloud, and BigAnimal cloud-provider instances), tightens DATA_DIR file and directory permissions at creation, creates ``pgadmin4.log`` with mode 0o600, hardens ``EnhancedRotatingFileHandler._open`` against rotation failures, and bounds the ``user_info_server`` prompt retry loop so a non-interactive caller cannot spin forever. Reported by Fernando Bortotti.
+  | `Issue #9902 <https://github.com/pgadmin-org/pgadmin4/issues/9902>`_ -  Fix symlink-based path traversal in the file manager (CVE-2026-7819). Reported by Fernando Bortotti.
+  | `Issue #9904 <https://github.com/pgadmin-org/pgadmin4/issues/9904>`_ -  Fix account-lockout bypass on Flask-Security's default ``/login`` view by overriding ``User.is_active`` and ``User.is_locked()`` so the ``locked`` field is honored on every authentication path (CVE-2026-7820). Reported by Fernando Bortotti.
+
+Additional changes (no associated issue)
+****************************************
+
+The commits below did not have a dedicated GitHub issue. They are listed here for transparency.
+
+Bug fixes
+---------
+
+  | ``1518b0828`` - Restore the SERVER_MODE python-test path and fix two endpoint regressions surfaced by it.
+  | ``d57acce35`` - Harden validation, preference, and connection-params paths against pre-existing edge cases.
+
+Test-suite stability
+--------------------
+
+  | ``a11d289bd`` - Harden ``click_modal`` backdrop wait and ``open_query_tool`` stale-element retry in feature tests.
+  | ``a50a553b0`` - Feature tests use ``sys.executable``; sync ``yarn.lock`` to ``package.json``.
+  | ``0fad04de8`` - PSQL socket tests use the authenticated tester; the role-dependencies test skips cleanly on auth failure.
+  | ``1f7194924`` - Harden six regression tests against environmental drift.
+  | ``dc61039e9`` - Quote the username in the views/mview test helper for dotted local roles.
+  | ``9b29bc203`` - Quote the username in the types/compound-triggers test helpers for dotted local roles.
+  | ``504775de8`` - Quote the username in the user-mappings test helper for dotted local roles.
+  | ``208541cc4`` - ``ImportExportServersTestCase`` uses ``sys.executable`` instead of a bare ``python`` and surfaces subprocess errors instead of swallowing them as a misleading JSON-parse failure.
+
+Refactoring
+-----------
+
+  | ``6f4f28def`` - Factor the WTForms-error-to-JSON conversion into a helper and drop a dead import.
+
+Documentation
+-------------
+
+  | ``9923eefca`` - Clarify in ``login.rst`` and ``ldap.rst`` that ``MAX_LOGIN_ATTEMPTS`` applies only to the ``INTERNAL`` authentication source. Operators using LDAP, OAuth2, Kerberos, or Webserver auth should rely on the upstream identity provider's lockout policy and reverse-proxy request rate-limiting.
+
+Dependencies
+------------
+
+Non-breaking ``dependabot`` updates aggregated for v9.15.
+
+Python:
+
+  | ``boto3`` 1.42 -> 1.43 (``python_version > '3.9'``; Python 3.9 stays on 1.42)
+  | ``cryptography`` 46.0 -> 47.0
+  | ``psycopg`` 3.3.3 -> 3.3.4 (``python_version >= '3.10'``)
+  | ``pycodestyle`` >=2.5.0 -> >=2.14.0
+  | ``requests`` >=2.21.0 -> >=2.33.1
+  | ``safety`` >=1.9.0 -> >=3.7.0
+  | ``testtools`` 2.8.7 -> 2.9.1
+  | ``typer`` 0.24 -> 0.25 (``python > '3.9'``)
+
+JavaScript (``web/``):
+
+  | ``@tanstack/react-query`` 5.90 -> 5.100.5
+  | ``axios`` 1.15.2 -> 1.16.0
+  | ``moment-timezone`` 0.6.0 -> 0.6.2
+  | ``postcss`` 8.5.6 -> 8.5.12
+
+JavaScript (``runtime/``):
+
+  | ``axios`` 1.15.2 -> 1.16.0
+  | ``electron`` 41.3.0 -> 41.5.0
+  | ``eslint`` 10.2.1 -> 10.3.0
+  | ``globals`` 17.5.0 -> 17.6.0

docs/en_US/release_notes_9_16.rst

@@ -0,0 +1,133 @@
+************
+Version 9.16
+************
+
+Release date: 2026-06-18
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.15.
+
+.. warning:: Starting with this release, when a server connection is configured
+    with both an external password-exec command and a passfile, pgAdmin now
+    uses the passfile and ignores the password-exec command. Previously the
+    password-exec command took precedence. A warning is written to the log when
+    the password-exec command is ignored in favour of the passfile.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.4
+
+
+New features
+************
+
+  | `Issue #2431 <https://github.com/pgadmin-org/pgadmin4/issues/2431>`_ -  Added an option to colourize panel and tab headers based on the connected server's colour, making it easier to tell which server a tab is connected to at a glance.
+  | `Issue #7641 <https://github.com/pgadmin-org/pgadmin4/issues/7641>`_ -  Allow the OAuth2 login button icon to use any Font Awesome style (e.g. ``fas fa-key``), not only brand icons.
+  | `Issue #9301 <https://github.com/pgadmin-org/pgadmin4/issues/9301>`_ -  Added a "Back to login" link to the Forgot Password and Reset Password pages.
+  | `Issue #9626 <https://github.com/pgadmin-org/pgadmin4/issues/9626>`_ -  Add support for the TOAST tuple target storage parameter in the Materialized View dialog.
+  | `Issue #9646 <https://github.com/pgadmin-org/pgadmin4/issues/9646>`_ -  Make the init container security context in the Helm chart configurable via containerSecurityContext, consistent with the main container.
+  | `Issue #9699 <https://github.com/pgadmin-org/pgadmin4/issues/9699>`_ -  Add support for closing a tab with a middle-click on its title.
+
+Housekeeping
+************
+
+  | `Issue #9817 <https://github.com/pgadmin-org/pgadmin4/issues/9817>`_ -  Correct the macOS Replace keyboard shortcut documented in the Query Tool toolbar reference.
+  | `Issue #9866 <https://github.com/pgadmin-org/pgadmin4/issues/9866>`_ -  Fix a typo in the PGPASS_FILE environment-variable documentation and clarify its behaviour.
+  | `Issue #9917 <https://github.com/pgadmin-org/pgadmin4/issues/9917>`_ -  Update the Italian translation.
+  | `Issue #9959 <https://github.com/pgadmin-org/pgadmin4/issues/9959>`_ -  Bump Electron in the desktop runtime from 41.5.0 to 42.1.0 and pin the packaged Electron version.
+  | `Issue #9981 <https://github.com/pgadmin-org/pgadmin4/issues/9981>`_ -  Clarify the SSH tunnel "Prompt for identity file password?" switch label and help text to indicate it applies only to identity-file authentication.
+  | `Issue #10014 <https://github.com/pgadmin-org/pgadmin4/issues/10014>`_ -  Document the Kubernetes init-container tag-mismatch and RollingUpdate hazards on shared data volumes.
+  | `Issue #10018 <https://github.com/pgadmin-org/pgadmin4/issues/10018>`_ -  Remove the EDB BigAnimal cloud deployment support.
+  | `Issue #10023 <https://github.com/pgadmin-org/pgadmin4/issues/10023>`_ -  Bump JavaScript and Python third-party dependencies, including cryptography, axios, shell-quote, and assorted dependabot lockfile updates.
+  | `Issue #10049 <https://github.com/pgadmin-org/pgadmin4/issues/10049>`_ -  Bump vulnerable transitive dependencies (tar, flatted) to clear security advisories.
+  | `Issue #10050 <https://github.com/pgadmin-org/pgadmin4/issues/10050>`_ -  Rebase the version-specific SQL templates so the default targets PostgreSQL 14, the oldest supported server version, dropping the obsolete sub-14 template buckets.
+  | `Issue #10063 <https://github.com/pgadmin-org/pgadmin4/issues/10063>`_ -  Strip the foreign-architecture slice from the macOS bundle so single-arch builds no longer ship the universal2 Python framework's unused arm64/x86_64 code.
+  | `Issue #10094 <https://github.com/pgadmin-org/pgadmin4/issues/10094>`_ -  Update the Italian translation for v9.16.
+
+Bug fixes
+*********
+
+  | `Issue #6308 <https://github.com/pgadmin-org/pgadmin4/issues/6308>`_ -  Fix the infinite loading spinner after an idle database connection is silently dropped, by detecting stale connections and offering a reconnect dialog.
+  | `Issue #7346 <https://github.com/pgadmin-org/pgadmin4/issues/7346>`_ -  Fixed an issue where preferences set via the CLI (setup.py set-prefs) were not validated, so invalid values were stored silently; CLI preference values are now validated against the preference type and rejected (and reported) if invalid.
+  | `Issue #7596 <https://github.com/pgadmin-org/pgadmin4/issues/7596>`_ -  Fix the Query Tool turning into a blank white screen when the runtime has a malformed default locale, by guarding the Query History date/time formatting against the resulting RangeError.
+  | `Issue #8318 <https://github.com/pgadmin-org/pgadmin4/issues/8318>`_ -  Fixed an error ("i.default.find(...) is undefined") that prevented deleting a table or relationship link in the ERD tool when a foreign key referenced a column that had been renamed.
+  | `Issue #9060 <https://github.com/pgadmin-org/pgadmin4/issues/9060>`_ -  Fixed an issue in the Create Table dialog where renaming a column did not update the column references in foreign key and unique constraint definitions for the new table.
+  | `Issue #9091 <https://github.com/pgadmin-org/pgadmin4/issues/9091>`_ -  Fix the Query Tool re-prompting for an unsaved password in a loop and rejecting the re-entered password, by caching the entered password on the server manager when the primary connection is already established.
+  | `Issue #9128 <https://github.com/pgadmin-org/pgadmin4/issues/9128>`_ -  Fixed an issue where the object breadcrumbs popup blocked clicks on the object explorer items beneath it.
+  | `Issue #9595 <https://github.com/pgadmin-org/pgadmin4/issues/9595>`_ -  Fix missing ALTER ... SET DEFAULT statements for inherited columns in the generated table SQL/EDIT script.
+  | `Issue #9677 <https://github.com/pgadmin-org/pgadmin4/issues/9677>`_ -  Fix the Unlogged table toggle in table properties not generating any ALTER TABLE ... SET LOGGED/UNLOGGED statement.
+  | `Issue #9701 <https://github.com/pgadmin-org/pgadmin4/issues/9701>`_ -  Ensure pgAdmin uses psycopg3 rather than psycopg2 when connecting to the configuration database via PGADMIN_CONFIG_CONFIG_DATABASE_URI.
+  | `Issue #9744 <https://github.com/pgadmin-org/pgadmin4/issues/9744>`_ -  Fix a View/Edit Data crash when the session contains a transaction object that is not filter-capable (e.g. left by the Query Tool or persisted by an older version), which could prevent the desktop application from loading after an upgrade.
+  | `Issue #9762 <https://github.com/pgadmin-org/pgadmin4/issues/9762>`_ -  Fix the "Cannot read properties of undefined (reading 'map')" crash in the desktop runtime when a menu refresh is triggered before the application menus have been received.
+  | `Issue #9766 <https://github.com/pgadmin-org/pgadmin4/issues/9766>`_ -  Fixed an issue where a server's custom foreground colour was not applied to the object counts (children count) and column type labels shown in the object explorer.
+  | `Issue #9782 <https://github.com/pgadmin-org/pgadmin4/issues/9782>`_ -  Optimise pgAdmin startup time by replacing the fixed server-ping interval with adaptive pinging that backs off when no servers are configured.
+  | `Issue #9806 <https://github.com/pgadmin-org/pgadmin4/issues/9806>`_ -  Fixed an issue where generated font and image filenames contained a double dot (e.g. ``Roboto-Bold..ttf``) due to the webpack asset filename template.
+  | `Issue #9828 <https://github.com/pgadmin-org/pgadmin4/issues/9828>`_ -  Fix tool calls failing against OpenAI-compatible providers that emit empty/null name, arguments, or id fields in streaming continuation deltas.
+  | `Issue #9829 <https://github.com/pgadmin-org/pgadmin4/issues/9829>`_ -  Fixed installation on Python 3.9 (e.g. RHEL/Rocky/AlmaLinux 8 and 9) failing with "No module named 'pkg_resources'" by pinning setuptools below the version that dropped pkg_resources for Python 3.9.
+  | `Issue #9854 <https://github.com/pgadmin-org/pgadmin4/issues/9854>`_ -  Fix the JSON editor stripping trailing fractional zeros (e.g. 10.00) and rewriting large integers in jsonb values, which corrupted unmodified numbers when saving.
+  | `Issue #9864 <https://github.com/pgadmin-org/pgadmin4/issues/9864>`_ -  Fixed a regression where the rectangular (block/column) text selection in the code editor stopped working; restored the default Alt+drag selection without re-introducing the crosshair cursor on Alt+F5 (#9570).
+  | `Issue #9868 <https://github.com/pgadmin-org/pgadmin4/issues/9868>`_ -  Warn before opening a very large JSON/JSONB value in the data grid cell editor, which could freeze pgAdmin, and let the user choose whether to proceed.
+  | `Issue #9875 <https://github.com/pgadmin-org/pgadmin4/issues/9875>`_ -  Fixed an issue where EXPLAIN and EXPLAIN ANALYZE failed to execute when blank lines separated clauses in the SQL query.
+  | `Issue #9810 <https://github.com/pgadmin-org/pgadmin4/issues/9810>`_ -  Use the ServerManager's passfile for the credential gate in connect() so the check matches the passfile actually used for the connection, and warn on conflicting passfile/passexec settings.
+  | `Issue #9892 <https://github.com/pgadmin-org/pgadmin4/issues/9892>`_ -  Fix blank difference counts on the top-level group rows in Schema Diff.
+  | `Issue #9896 <https://github.com/pgadmin-org/pgadmin4/issues/9896>`_ -  Fix invalid DDL reconstruction for SERIAL columns in Schema Diff and the generated SQL/CREATE Script so the output round-trips on a clean target.
+  | `Issue #9933 <https://github.com/pgadmin-org/pgadmin4/issues/9933>`_ -  Remove the administrator-role bypass from the server-access helpers so the access-control checks added in 9.15 (CVE-2026-7813) are enforced uniformly. The Administrator role manages pgAdmin itself, not other users' database connections.
+  | `Issue #9935 <https://github.com/pgadmin-org/pgadmin4/issues/9935>`_ -  Fix "Illegal instruction" crash on startup of the Linux DEB and RPM packages on older x86_64 CPUs by pinning the psycopg C extension build to the x86-64 baseline.
+  | `Issue #9936 <https://github.com/pgadmin-org/pgadmin4/issues/9936>`_ -  Fix the AI panel silently falling back to the default provider when a custom LLM API URL or key file was set, and allow self-hosted LLM endpoints on any loopback port.
+  | `Issue #9939 <https://github.com/pgadmin-org/pgadmin4/issues/9939>`_ -  Fix saving a newly-added row in the Query Tool failing when the result set includes expression or alias columns that are not real columns of the underlying table.
+  | `Issue #9952 <https://github.com/pgadmin-org/pgadmin4/issues/9952>`_ -  Ship libpq-oauth-18.so and libcurl in the Docker image so PostgreSQL 18 OAuth connections work out of the box.
+  | `Issue #9976 <https://github.com/pgadmin-org/pgadmin4/issues/9976>`_ -  Fix a startup migration crash (NoSuchTableError) when an old configuration database contains a stale foreign-key reference.
+  | `Issue #9984 <https://github.com/pgadmin-org/pgadmin4/issues/9984>`_ -  Fix the Docker entrypoint mishandling a quoted PGADMIN_CONFIG_CONFIG_DATABASE_URI, which caused a SQLAlchemy parse error and silently skipped PGADMIN_DEFAULT_EMAIL/PASSWORD setup.
+  | `Issue #9985 <https://github.com/pgadmin-org/pgadmin4/issues/9985>`_ -  Make CAP_NET_BIND_SERVICE optional in the Docker image so the container works on restricted runtimes that disable that capability.
+  | `Issue #9987 <https://github.com/pgadmin-org/pgadmin4/issues/9987>`_ -  Fix "AttributeError: 'PgAdmin' object has no attribute 'login_manager'" crash when running setup.py user-management commands (add-user, update-user) from the CLI.
+  | `Issue #9988 <https://github.com/pgadmin-org/pgadmin4/issues/9988>`_ -  Provide an actionable error when 'openid' is in OAUTH2_SCOPE but OAUTH2_SERVER_METADATA_URL is not set, instead of a cryptic Authlib failure.
+  | `Issue #10013 <https://github.com/pgadmin-org/pgadmin4/issues/10013>`_ -  Fix pg_attribute filtering by attname returning the wrong attnum when the same column name exists in multiple tables.
+  | `Issue #10022 <https://github.com/pgadmin-org/pgadmin4/issues/10022>`_ -  Fix AI Assistant read-only transaction bypass that allowed prompt-injected multi-statement payloads to commit out of the READ ONLY wrapper and execute arbitrary SQL, chaining to RCE via COPY ... TO PROGRAM on a superuser connection (CVE-2026-12045). Reported by Isaac Chen.
+  | `Issue #10026 <https://github.com/pgadmin-org/pgadmin4/issues/10026>`_ -  Fix SQL injection in the named restore point endpoint where the user-supplied restore point name was interpolated into SQL via str.format() instead of being passed as a bound parameter (CVE-2026-12050). Reported by Geo.
+  | `Issue #10027 <https://github.com/pgadmin-org/pgadmin4/issues/10027>`_ -  Fix the spurious "Crypt key is missing" error and logged traceback in the Query Tool new-connection endpoints after a backend restart, by surfacing it as the standard CRYPTKEY_MISSING response so the client recovers transparently.
+  | `Issue #10028 <https://github.com/pgadmin-org/pgadmin4/issues/10028>`_ -  Fix open redirect in the multi-factor authentication flow via an unvalidated 'next' parameter that allowed a crafted link to redirect an authenticated victim to an attacker-controlled host (CVE-2026-12049). Reported by Mai Phạm Hiền.
+  | `Issue #10029 <https://github.com/pgadmin-org/pgadmin4/issues/10029>`_ -  Fixed a regression where the rectangular (block/column) text selection in the code editor stopped working; restored the default Alt+drag selection without re-introducing the crosshair cursor on Alt+F5 (#9570).
+  | `Issue #10030 <https://github.com/pgadmin-org/pgadmin4/issues/10030>`_ -  Accept prepare and binary keyword arguments in DictCursor.execute() so callers using the modern psycopg API no longer raise TypeError.
+  | `Issue #10059 <https://github.com/pgadmin-org/pgadmin4/issues/10059>`_ -  Fix the generated SQL for editing a SQL-language function/procedure whose body contains the word "return" (e.g. a RETURNING clause), which was wrongly treated as a SQL-standard body and produced a statement without the AS $BODY$ wrapper.
+  | `Issue #10068 <https://github.com/pgadmin-org/pgadmin4/issues/10068>`_ -  Fix critical stored cross-site scripting where PostgreSQL server error text and Explain plan-node content passed through html-react-parser across notifier toasts, form errors, modal alerts, and the Explain visualiser. Because pgAdmin's default Content-Security-Policy allows inline script and an iframe ``srcdoc`` inherits the embedding origin, the injected JavaScript ran same-origin to the victim's authenticated pgAdmin session and could read every saved server connection credential and issue arbitrary SQL against every server the victim was connected to (CVE-2026-12048). Reported by Fernando Bortotti.
+  | `Issue #10069 <https://github.com/pgadmin-org/pgadmin4/issues/10069>`_ -  Fix HTML injection in the cloud deployment module (RDS, Azure, Google) where SDK exception text was forwarded to the browser unsanitised and rendered through html-react-parser in the Cloud Wizard (CVE-2026-12047). Reported by Fernando Bortotti.
+  | `Issue #10072 <https://github.com/pgadmin-org/pgadmin4/issues/10072>`_ -  Fix two SQL Editor endpoints (close and update_connection) missing the ``@pga_login_required`` decorator, making them reachable without authentication in server mode and exposing a pickle deserialization sink (CVE-2026-12046). Reported by Fernando Bortotti.
+  | `Issue #10078 <https://github.com/pgadmin-org/pgadmin4/issues/10078>`_ -  Fix SQL injection across sixteen dialog templates that rendered ``COMMENT ON ... IS '<description>'`` and the related ``pgstattuple``/``pgstatindex`` stats sinks, where a low-privilege user could plant a table or index name containing an apostrophe and a superuser viewing statistics on the object would trigger SQL execution under the superuser role. The fix switches the affected templates to the ``qtLiteral`` escape filter and rewrites the ``pgstattuple``/``pgstatindex`` calls to address the relation via OID with a ``::oid::regclass`` cast, eliminating the embedded string-literal call form entirely. Also hardens ``qtLiteral`` to raise instead of silently returning raw values when ``conn`` is falsy (CVE-2026-12044). Reported by Jasser Chebbi.
+
+Additional changes (no associated issue)
+****************************************
+
+Dependencies
+------------
+
+Non-breaking ``dependabot`` updates aggregated for v9.16.
+
+Python:
+
+  | ``certifi`` 2026.4.22 -> 2026.5.20
+  | ``cryptography`` 47.0 -> 49.0
+  | ``Flask-Security-Too`` 5.4 -> 5.6 (``python_version <= '3.9'``)
+  | ``google-auth-oauthlib`` 1.3.1 -> 1.4.0 (``python_version > '3.9'``; Python 3.9 stays on 1.3.1)
+  | ``requests`` >=2.33.1 -> >=2.34.2 (``python_version > '3.9'``)
+  | ``safety`` >=3.7.0 -> >=3.8.1
+  | ``selenium`` 4.43.0 -> 4.44.0
+  | ``testscenarios`` 0.6.1 -> 0.6.2 (``python_version > '3.9'``)
+  | ``typer`` 0.25 -> 0.26 (``python_version > '3.9'``)
+  | ``urllib3`` 2.6 -> 2.7 (``python_version > '3.9'``)
+
+JavaScript (``web/``):
+
+  | ``@tanstack/react-query`` 5.100.5 -> 5.100.9
+  | ``ip-address`` 10.1.0 -> 10.1.1
+  | ``postcss`` 8.5.12 -> 8.5.14
+
+JavaScript (``runtime/``):
+
+  | ``axios`` 1.16.0 -> 1.18.0
+  | ``electron`` 41.5.0 -> 42.3.3
+  | ``eslint`` 10.3.0 -> 10.4.1

docs/en_US/release_notes_9_17.rst

@@ -0,0 +1,119 @@
+************
+Version 9.17
+************
+
+Release date: 2026-07-30
+
+This release contains a number of bug fixes and new features since the release of pgAdmin 4 v9.16.
+
+Supported Database Servers
+**************************
+**PostgreSQL**: 14, 15, 16, 17 and 18
+
+**EDB Advanced Server**: 14, 15, 16, 17 and 18
+
+Bundled PostgreSQL Utilities
+****************************
+**psql**, **pg_dump**, **pg_dumpall**, **pg_restore**: 18.4
+
+
+New features
+************
+
+  | `Issue #9990 <https://github.com/pgadmin-org/pgadmin4/issues/9990>`_ -  Include the authenticated user's identity in the HTTP access log.
+  | `Issue #9942 <https://github.com/pgadmin-org/pgadmin4/issues/9942>`_ -  Add an opt-in Gateway API HTTPRoute template to the Helm chart as an alternative to the existing Ingress.
+  | `Issue #10104 <https://github.com/pgadmin-org/pgadmin4/issues/10104>`_ -  Add a preference to cap the row count fetched by the plain "View Data" action, so it is usable on large tables without always doing a full ``SELECT *``.
+  | `Issue #10142 <https://github.com/pgadmin-org/pgadmin4/issues/10142>`_ -  Add support for a custom XYZ tile provider (URL, name, CRS, attribution, max zoom) in the Geometry Viewer, alongside the existing built-in base layers.
+
+Housekeeping
+************
+
+  | `Issue #10077 <https://github.com/pgadmin-org/pgadmin4/issues/10077>`_ -  Centralize shared-server-group visibility and access-control logic, and adjust the ServerGroup-to-Server/SharedServer model relationships.
+  | `Issue #10093 <https://github.com/pgadmin-org/pgadmin4/issues/10093>`_ -  Add a basic starter contributing guide.
+  | `Issue #10135 <https://github.com/pgadmin-org/pgadmin4/issues/10135>`_ -  Fail the macOS appbundle build if any bundled library links outside the bundle, and scan all Mach-O binaries for bundle linkage rather than only files named ``.so``/``.dylib``.
+  | `Issue #10154 <https://github.com/pgadmin-org/pgadmin4/issues/10154>`_ -  Pin the sonarqube-scan-action GitHub workflow to a full commit SHA instead of a mutable branch ref, to harden against supply-chain tampering.
+  | `Issue #10138 <https://github.com/pgadmin-org/pgadmin4/issues/10138>`_ -  Update the Simplified Chinese (zh_Hans_CN) translation to match the wording used in the interface.
+  | `Issue #10156 <https://github.com/pgadmin-org/pgadmin4/issues/10156>`_ -  Pin the Yarn version used by the build scripts to the ``packageManager`` field, rather than whatever Yarn happens to be on the builder's PATH.
+  | `Issue #10176 <https://github.com/pgadmin-org/pgadmin4/issues/10176>`_ -  Bump JavaScript and Python third-party dependencies, including axios, webpack, react, electron, and certifi.
+
+Bug fixes
+*********
+
+  | `Issue #10053 <https://github.com/pgadmin-org/pgadmin4/issues/10053>`_ -  Warn when OAuth2 provider settings are misplaced at the top level of the config instead of under ``OAUTH2_CONFIG``.
+  | `Issue #10100 <https://github.com/pgadmin-org/pgadmin4/issues/10100>`_ -  Fix Schema Diff's "Generate Script" and the browser tree's CREATE Script view emitting wrong SQL for SERIAL/identity columns, by detecting column-owned sequences via pg_depend instead of guessing the sequence name.
+  | `Issue #10102 <https://github.com/pgadmin-org/pgadmin4/issues/10102>`_ -  Fix a Schema Diff result-status filter chip showing "No difference found" after being toggled off and back on, even when real differences exist.
+  | `Issue #10106 <https://github.com/pgadmin-org/pgadmin4/issues/10106>`_ -  Fix the Object Explorer briefly showing the literal HTML markup instead of a greyed-out "[Disconnecting...]" label when disconnecting a server or database.
+  | `Issue #10107 <https://github.com/pgadmin-org/pgadmin4/issues/10107>`_ -  Detect a selected-but-unusable OS keyring and fall back gracefully instead of failing.
+  | `Issue #10109 <https://github.com/pgadmin-org/pgadmin4/issues/10109>`_ -  Fix ALT+F5 ("Execute query at cursor") doing nothing when the cursor is on or near a statement that is not highlighted, in a Query Tool tab with multiple statements separated by blank lines.
+  | `Issue #10110 <https://github.com/pgadmin-org/pgadmin4/issues/10110>`_ -  Stop the googleapiclient cloud-deployment dependency from pulling in the system oauth2client package.
+  | `Issue #10117 <https://github.com/pgadmin-org/pgadmin4/issues/10117>`_ -  Fix a "'Response' object is not iterable" crash when expanding a Trigger node under a Table to view its trigger function, and report the correct error message on a node.sql failure in that flow.
+  | `Issue #10158 <https://github.com/pgadmin-org/pgadmin4/issues/10158>`_ -  Honor the selected EOL sequence when copying query text to the clipboard.
+  | `Issue #10187 <https://github.com/pgadmin-org/pgadmin4/issues/10187>`_ -  Fix the object browser's extension UI breaking under PostgreSQL 19's extension catalog changes.
+  | `Issue #10190 <https://github.com/pgadmin-org/pgadmin4/issues/10190>`_ -  Fix a tool-permission bypass where a user denied the Query Tool, Grant Wizard, or Schema Diff permission could still drive that tool's backend routes and Socket.IO handlers directly, since the permission check was applied only to a single "front door" route per tool. Also fixes a non-owner triggering an adhoc connection against another user's shared server persisting a new server record still owned by that other user (CVE-2026-17350). Reported by LXY.
+  | `Issue #10191 <https://github.com/pgadmin-org/pgadmin4/issues/10191>`_ -  Fix OS command injection in the MASTER_PASSWORD_HOOK feature, where an externally-sourced username (e.g. via OAuth2/OIDC, Kerberos, or webserver authentication) containing shell metacharacters could execute arbitrary commands as the pgAdmin service account when the configured hook string uses ``%u`` (CVE-2026-17347). Reported by Thiago Pereira.
+  | `Issue #10192 <https://github.com/pgadmin-org/pgadmin4/issues/10192>`_ -  Fix a lexer-differential bypass of the AI Assistant's read-only transaction guard, where sqlparse's string-literal lexing disagreed with PostgreSQL's own parser under ``standard_conforming_strings = on``, letting a crafted multi-statement payload smuggle a COMMIT past the intended read-only wrapper, an incomplete fix for CVE-2026-12045 (CVE-2026-17351). Reported by Kai Aizen.
+  | `Issue #10193 <https://github.com/pgadmin-org/pgadmin4/issues/10193>`_ -  Fix SQL injection in the Index Statistics all-indexes listing and the Publications/Subscriptions Dependencies views, where an apostrophe in a table, index, publication, or subscription name broke out of an unescaped template interpolation, an incomplete fix for CVE-2026-12044 (CVE-2026-17346). Reported by Hung Tran Quoc (@rampage0010).
+  | `Issue #10194 <https://github.com/pgadmin-org/pgadmin4/issues/10194>`_ -  Fix several Constraints, Preferences, Debugger, and Schema Diff routes missing the ``@pga_login_required`` decorator, making them reachable without authentication in server mode, an incomplete fix for CVE-2026-12046 (CVE-2026-17348). Reported by Hung Tran Quoc (@rampage0010).
+  | `Issue #10200 <https://github.com/pgadmin-org/pgadmin4/issues/10200>`_ -  Fix an adhoc server connection cloning another user's stored database credentials (password, save password flag, tunnel password) alongside ownership, letting a non-owner who cloned another user's shared server connect using that user's saved database password (CVE-2026-17349).
+  | `Issue #10213 <https://github.com/pgadmin-org/pgadmin4/issues/10213>`_ -  Fix OS command injection in the Import/Export Data tool, where a query-based export could pass a crafted query string past the ``\copy (...)`` parenthesis-balance guard by exploiting a backslash-escape mismatch with psql's default ``standard_conforming_strings = on`` behaviour, exposing a live ``TO PROGRAM`` clause for arbitrary command execution (CVE-2026-17566). Reported by Arpit Jain.
+
+Additional changes (no associated issue)
+****************************************
+
+Dependencies
+------------
+
+Non-breaking ``dependabot`` and audit-driven bumps aggregated for v9.17.
+
+Python:
+
+  | ``certifi`` 2026.5.20 -> 2026.6.17
+
+JavaScript (``web/``):
+
+  | ``@babel/core`` 7.29.0 -> 7.29.6
+  | ``@date-io/date-fns`` 3.x -> 3.2.1
+  | ``@szhsin/react-menu`` 4.5.1 -> 4.5.2
+  | ``@tanstack/react-query`` 5.100.9 -> 5.101.4
+  | ``@types/react`` 19.2.14 -> 19.2.17
+  | ``ajv`` 8.18.0 -> 8.20.0
+  | ``anti-trojan-source`` 1.8.1 -> 1.12.0
+  | ``autoprefixer`` 10.5.0 -> 10.5.4
+  | ``axios`` 1.16.0 -> 1.18.1
+  | ``core-js`` added as an explicit direct dependency (3.49.0), previously relied on transitively via pickr
+  | ``date-fns`` 4.1.0 -> 4.4.0
+  | ``dompurify`` 3.4.1 -> 3.4.12
+  | ``eslint-plugin-jest`` 29.15.2 -> 29.15.5
+  | ``globals`` 17.5.0 -> 17.7.0
+  | ``hotkeys-js`` 4.0.3 -> 4.0.4
+  | ``html-to-image`` 1.11.11 -> 1.11.13
+  | ``ip-address`` 10.1.1 -> 10.2.0
+  | ``jest`` / ``jest-environment-jsdom`` 30.3.0 -> 30.4.2 / 30.4.1
+  | ``marked`` 18.0.2 -> 18.0.7
+  | ``moment-timezone`` 0.6.2 -> 0.6.3
+  | ``papaparse`` 5.5.3 -> 5.5.4
+  | ``postcss`` 8.5.10/8.5.14 -> 8.5.20
+  | ``react`` / ``react-dom`` 19.2.5 -> 19.2.7
+  | ``react-checkbox-tree`` 2.0.1 -> 2.0.2
+  | ``react-draggable`` 4.5.0 -> 4.7.0
+  | ``react-timer-hook`` 4.0.5 -> 4.0.6
+  | ``sharp`` 0.34.4 -> 0.35.3
+  | ``sql-formatter`` 15.7.3 -> 15.8.2
+  | ``svgo`` 4.0.1 -> 4.0.2
+  | ``terser-webpack-plugin`` 5.5.0 -> 5.6.1
+  | ``typescript-eslint`` 8.59.0 -> 8.65.0
+  | ``webpack`` 5.106.2 -> 5.108.4
+  | ``webpack-bundle-analyzer`` 5.3.0 -> 5.3.1
+  | ``zustand`` 5.0.12 -> 5.0.14
+  | Transitive advisory bumps: ``brace-expansion``, ``form-data``, ``undici``, ``js-yaml``
+  | Reverted ``azure-mgmt-resource`` to avoid a breaking import-path change in ``pgadmin/misc/cloud/azure``
+
+JavaScript (``runtime/``):
+
+  | ``electron`` 42.3.3 -> 43.1.1
+  | ``eslint`` 10.4.1 -> 10.7.0
+  | ``globals`` 17.6.0 -> 17.7.0
+  | ``axios`` 1.18.0 -> 1.18.1
+  | ``ip-address`` 10.1.1 -> 10.2.0
+  | ``postcss`` 8.5.10 -> 8.5.20
+  | Pinned ``packageManager`` to ``yarn@4.15.0``