mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Ashesh Vashi
5627944f87
Combined fix for 8 packages flagged by GitHub Dependabot (collapsing
6 of them from open dependabot bump PRs and 4 from transitive
vulnerabilities with no existing PR). All eight are transitive — no
direct dep changes — so we override via `resolutions` in web/package.json
and let yarn collapse duplicate-version entries during install.
Resolved (pre → post via resolution):
Runtime:
ws 8.20.0 -> 8.21.0 (patched 8.20.1)
Dev:
@xmldom/xmldom 0.7.13 -> 0.8.13 (patched 0.8.13)
serialize-javascript 6.0.2,
7.0.5 -> 7.0.5 (patched 7.0.5)
ip-address 10.1.0,
10.2.0 -> 10.2.0 (patched 10.1.1)
postcss 8.5.8,
8.5.15 -> 8.5.15 (patched 8.5.10)
qs 6.15.0 -> 6.15.2 (patched 6.15.2)
@tootallnate/once 2.0.0 -> 2.0.1 (patched 2.0.1)
tar (7.x lineage) 7.5.13 -> 7.5.16 (patched 7.5.11)
The tar 6.2.1 lineage (consumed via ^6.1.2/^6.1.11) is unaffected by
these CVEs (alert ranges are 7.x-only), so the resolution is scoped
`tar@npm:^7.5.4` to leave it on 6.2.1.
Supersedes open dependabot PRs #9956 (ws), #9962 (tar), #9966
(@tootallnate/once), and #9974 (qs) — one CI cycle instead of four.
Verification:
- yarn install — clean (only pre-existing peer-dep warnings about
@mui/system, aspen-core, eve, etc.; no new ones)
- yarn run test:js-once — 824 / 824 pass across 140 test suites
- yarn run bundle:dev — webpack compiled successfully
- All 8 packages confirmed at safe versions via lockfile audit;
duplicate entries collapsed (yarn.lock net -64 lines)
Out of scope (cannot fix here):
- paramiko (#276 #278): no patched version exists; bump-to-5.0.0
PRs #9927/#9930 audited 2026-05-20 and deferred to Q4 2026 over
SSH bastion compat risk
- elliptic (#176): no patched version, dev-only, low severity
- flatted (#224): alert is stale; lockfile already at 3.4.2 (patched);
will auto-dismiss on next dependabot rescan
* chore(deps): bump Python deps to latest 3.9-compatible
Picks up five Python dependency bumps that are 3.9-safe (still resolve
under Python 3.9 per PyPI requires_python). Four supersede open
dependabot PRs:
- certifi 2026.4.22 -> 2026.5.20
(no gate; CA bundle refresh; supersedes dependabot #9977 / #9979)
- typer 0.25.* -> 0.26.*
(py > 3.9 row only; supersedes dependabot #9995 / #9999)
- testscenarios 0.6.1 -> 0.6.2
(py > 3.9 row only; supersedes dependabot #9980)
- urllib3 2.6.* -> 2.7.* (py > 3.9 row only)
Picks up two HIGH-severity security fixes in urllib3 2.7.0
(2026-05-07): GHSA-mf9v-mfxr-j63j (decompression-bomb safeguards
bypassed under drain_conn / Brotli stream patterns) and
GHSA-qccp-gfcp-xxvc (ProxyManager.connection_from_url did not
strip sensitive headers on cross-host redirects). 2.7.0 requires
Python >=3.10, which the existing 'python_version > 3.9' gate
already enforces.
- Flask-Security-Too 5.4.* -> 5.6.* (py <= 3.9 row only)
Closes a roughly 2-year gap between the 3.9 row (last pin from
March 2024) and the py > 3.9 row (already on 5.8.*). 5.5/5.6
only touched flows pgAdmin doesn't use (register V2, MFA / WebAuthn
templates, username recovery/changing, secret_key rotation) and
config pgAdmin overrides (default hash bcrypt->argon2 sidestepped
by SECURITY_PASSWORD_HASH = 'pbkdf2_sha512'). The contract changes
that mattered (LoginForm.validate -> is_active, UserMixin.is_locked
hook, single-kwarg find_user) are all already exercised in
production via the existing FST 5.8.* / Python 3.10+ deployments.
70 lines
2.1 KiB
Plaintext
70 lines
2.1 KiB
Plaintext
###############################################################################
|
|
#
|
|
# IMPORTANT:
|
|
#
|
|
# If runtime or build time dependencies are changed in this file, the committer
|
|
# *must* ensure the DEB and RPM package maintainers are informed as soon as
|
|
# possible.
|
|
#
|
|
# The packages listed below are sorted alphabetically. It is recommended to add
|
|
# new packages in alphabetical order. However, exceptions can be made to
|
|
# preserve dependency order—please add a comment in such cases and specify the
|
|
# relevant packages.
|
|
###############################################################################
|
|
|
|
Authlib==1.6.*; python_version <= '3.9'
|
|
Authlib==1.7.*; python_version > '3.9'
|
|
azure-identity==1.25.3
|
|
azure-mgmt-rdbms==10.1.1
|
|
azure-mgmt-resource==25.0.0
|
|
azure-mgmt-subscription==3.1.1
|
|
bcrypt==5.0.*
|
|
boto3==1.42.*; python_version <= '3.9'
|
|
boto3==1.43.*; python_version > '3.9'
|
|
certifi==2026.5.20
|
|
cryptography==48.0.*
|
|
Flask-Babel==4.0.*
|
|
Flask-Compress==1.*
|
|
Flask-Login==0.*
|
|
Flask-Mail==0.*
|
|
Flask-Migrate==4.*
|
|
Flask-Paranoid==0.*
|
|
Flask-Security-Too==5.6.*; python_version <= '3.9'
|
|
Flask-Security-Too==5.8.*; python_version > '3.9'
|
|
Flask-SocketIO==5.6.*
|
|
Flask-SQLAlchemy==3.1.*
|
|
Flask-WTF==1.2.*; python_version <= '3.9'
|
|
Flask-WTF==1.3.*; python_version > '3.9'
|
|
Flask==3.1.*
|
|
google-api-python-client==2.*
|
|
google-auth-oauthlib==1.3.1; python_version <= '3.9'
|
|
google-auth-oauthlib==1.4.0; python_version > '3.9'
|
|
gssapi==1.11.*
|
|
jsonformatter~=0.3.4
|
|
keyring==25.*
|
|
ldap3==2.*
|
|
libgravatar==1.0.*
|
|
paramiko==3.5.1
|
|
passlib==1.*
|
|
psutil==7.2.*
|
|
psycopg[c]==3.2.13; python_version < '3.10'
|
|
psycopg[c]==3.3.4; python_version >= '3.10'
|
|
pyotp==2.*
|
|
python-dateutil==2.*
|
|
pytz==2026.*
|
|
# pinned for https://github.com/andfoy/pywinpty/issues/545
|
|
pywinpty==2.0.*; sys_platform=="win32"
|
|
qrcode[pil]==8.*
|
|
setuptools==82.*
|
|
SQLAlchemy==2.*
|
|
sqlparse==0.*
|
|
sshtunnel==0.*
|
|
typer[all]==0.23.*; python_version <= '3.9'
|
|
typer==0.26.*; python_version > '3.9'
|
|
urllib3==1.26.*; python_version <= '3.9'
|
|
urllib3==2.7.*; python_version > '3.9'
|
|
user-agents==2.2.0
|
|
Werkzeug==3.1.*
|
|
WTForms==3.1.*; python_version <= '3.9'
|
|
WTForms==3.2.*; python_version > '3.9'
|