mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-19 01:15:04 -05:00
Ashesh Vashi
84b93c268d
Supersedes 7 open Dependabot PRs by applying the safe ones and properly fixing the one with a broken lockfile, in one CI cycle: - setuptools ==82.* -> ==83.* (#10144, #10145 - duplicate PRs, same patch). Only touches the `python_version > '3.9'` line; the `<82; python_version <= '3.9'` gate for Python 3.9 is untouched, so this doesn't affect Python 3.9 support. - fast-uri 3.1.2 -> 3.1.4 in both /web and /runtime (#10183, #10195) - fixes two real CVEs (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6). - tar 7.5.16 -> 7.5.21 (#10182) - patch series, decompression-bomb and unbounded-recursion hardening only. - shell-quote 1.8.4 -> 1.10.0 (#10185) - additive opt-in option + parser fixes, no breaking changes. - svgo 3.3.3 -> 4.0.2 (#10184) - Dependabot's own PR left yarn.lock internally inconsistent (dropped the workspace-level `svgo` entry while merging version-range blocks), so `yarn install --immutable` failed in CI with "the lockfile would have been modified by this install". Regenerated properly via `yarn up`/`yarn dedupe` here. The direct `svgo`/`svgo-loader` deps are not actually wired into any webpack rule (verified via grep) - the real SVG pipeline is `@svgr/webpack` -> `@svgr/plugin-svgo` -> svgo 3.3.3, which this bump does not touch - so the major version jump has no build impact. `yarn.lock` now correctly keeps that separate 3.3.3 resolution alongside the deduped 4.0.2 one. Not included (structurally blocked, tracked separately): - paramiko 3.5.1 -> 5.0.0 (#9927): paramiko 5 removes DSSKey entirely; sshtunnel 0.4.0 (dormant since 2021) still references paramiko.DSSKey, so `import sshtunnel` would crash immediately. - pywinpty 2.0.* -> 3.0.* (#10082, #10084): the existing pin cites https://github.com/andfoy/pywinpty/issues/545, confirmed still open ("process read and write not working as expected in 3.x"). Verified: `yarn install --immutable` clean in both /web and /runtime, `yarn run linter` clean, full `yarn run bundle:dev` compiles successfully.