mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Ashesh Vashi
8812025a8a
Consolidates 20 open dependabot PRs (JS + Python) into one bump, applied directly rather than cherry-picked (PR branches were stale and would have reverted unrelated fixes like the yarn packageManager pin). Adds further same-major patch/minor bumps found by auditing beyond dependabot's own PR list. JS (web + runtime): axios, brace-expansion, form-data, undici, js-yaml, dompurify, @babel/core, webpack, sharp, electron, eslint, react-checkbox-tree, autoprefixer, eslint-plugin-jest, globals, jest, jest-environment-jsdom, svgo, terser-webpack-plugin, typescript-eslint, webpack-bundle-analyzer, @date-io/date-fns, @szhsin/react-menu, @tanstack/react-query, @types/react, ajv, anti-trojan-source, ip-address, marked, moment-timezone, papaparse, postcss, react, react-dom, react-draggable, react-timer-hook, sql-formatter, zustand. Python: certifi, selenium (version-gated: 4.45.0 requires Python >=3.10, 4.44.0 kept for <=3.9 to preserve Python 3.9 support). Reverted / excluded, with reasons: - azure-mgmt-resource 26.0.0: moved ResourceManagementClient from azure.mgmt.resource to azure.mgmt.resource.resources, breaking pgadmin/misc/cloud/azure/__init__.py at import time. Caught by the Python regression suite. Kept at 25.0.0. - @simonwep/pickr 1.10.0: switched its build tool to tsup, which marks its UMD bundle as an ES module via Symbol.toStringTag instead of the __esModule flag Babel's interop helper checks for. Babel double-wraps the export, so `new Pickr(...)` resolves to a non-constructor and crashes every dialog that mounts a color picker -- reproduces only in the production/minified webpack build, not the dev bundle or Jest. Pinned to ~1.9.1 (tilde, not caret) so a future install can't silently float back to 1.10.x. - paramiko 3->5 (#9927): structurally blocked by sshtunnel 0.4.0 still referencing paramiko.DSSKey. - @mui/material / @mui/x-date-pickers 7/8->9 (#10091, #10092): known UI-breaking, needs the accompanying component fixes tracked on a separate branch, not a bare version bump. - react-arborist, @tanstack/react-virtual, react-frame-component: same-major bumps available but excluded -- core object-browser tree, already-fragile virtualization code, or tilde-pinned range respectively. - A handful of JS packages hit Yarn 4.15's registry quarantine gate (blocks just-published versions); backed off to the next-older version instead of forcing through. Added core-js as an explicit devDependency: it was never declared despite webpack's Babel config (useBuiltIns: 'usage', corejs: 3) requiring it -- it only worked because @simonwep/pickr 1.9.1 happened to pull it in transitively, which broke when pickr was briefly bumped. Verified: eslint (web + runtime), full JS test suite (149/149 suites, 916/916 tests), webpack production build compiles clean, Python regression suite (2388/2388, excl. Selenium), Selenium feature_tests (17/19 pass; the 2 failures trace to a local pldbgapi-extension gap, unrelated to any bumped dependency).
71 lines
2.1 KiB
Plaintext
71 lines
2.1 KiB
Plaintext
###############################################################################
|
|
#
|
|
# IMPORTANT:
|
|
#
|
|
# If runtime or build time dependencies are changed in this file, the committer
|
|
# *must* ensure the DEB and RPM package maintainers are informed as soon as
|
|
# possible.
|
|
#
|
|
# The packages listed below are sorted alphabetically. It is recommended to add
|
|
# new packages in alphabetical order. However, exceptions can be made to
|
|
# preserve dependency order—please add a comment in such cases and specify the
|
|
# relevant packages.
|
|
###############################################################################
|
|
|
|
Authlib==1.6.*; python_version <= '3.9'
|
|
Authlib==1.7.*; python_version > '3.9'
|
|
azure-identity==1.25.3
|
|
azure-mgmt-rdbms==10.1.1
|
|
azure-mgmt-resource==25.0.0
|
|
azure-mgmt-subscription==3.1.1
|
|
bcrypt==5.0.*
|
|
boto3==1.42.*; python_version <= '3.9'
|
|
boto3==1.43.*; python_version > '3.9'
|
|
certifi==2026.6.17
|
|
cryptography==49.0.*
|
|
Flask-Babel==4.0.*
|
|
Flask-Compress==1.*
|
|
Flask-Login==0.*
|
|
Flask-Mail==0.*
|
|
Flask-Migrate==4.*
|
|
Flask-Paranoid==0.*
|
|
Flask-Security-Too==5.6.*; python_version <= '3.9'
|
|
Flask-Security-Too==5.8.*; python_version > '3.9'
|
|
Flask-SocketIO==5.6.*
|
|
Flask-SQLAlchemy==3.1.*
|
|
Flask-WTF==1.2.*; python_version <= '3.9'
|
|
Flask-WTF==1.3.*; python_version > '3.9'
|
|
Flask==3.1.*
|
|
google-api-python-client==2.*
|
|
google-auth-oauthlib==1.3.1; python_version <= '3.9'
|
|
google-auth-oauthlib==1.4.0; python_version > '3.9'
|
|
gssapi==1.11.*
|
|
jsonformatter~=0.3.4
|
|
keyring==25.*
|
|
ldap3==2.*
|
|
libgravatar==1.0.*
|
|
paramiko==3.5.1
|
|
passlib==1.*
|
|
psutil==7.2.*
|
|
psycopg[c]==3.2.13; python_version < '3.10'
|
|
psycopg[c]==3.3.4; python_version >= '3.10'
|
|
pyotp==2.*
|
|
python-dateutil==2.*
|
|
pytz==2026.*
|
|
# pinned for https://github.com/andfoy/pywinpty/issues/545
|
|
pywinpty==2.0.*; sys_platform=="win32"
|
|
qrcode[pil]==8.*
|
|
setuptools<82; python_version <= '3.9'
|
|
setuptools==82.*; python_version > '3.9'
|
|
SQLAlchemy==2.*
|
|
sqlparse==0.*
|
|
sshtunnel==0.*
|
|
typer[all]==0.23.*; python_version <= '3.9'
|
|
typer==0.26.*; python_version > '3.9'
|
|
urllib3==1.26.*; python_version <= '3.9'
|
|
urllib3==2.7.*; python_version > '3.9'
|
|
user-agents==2.2.0
|
|
Werkzeug==3.1.*
|
|
WTForms==3.1.*; python_version <= '3.9'
|
|
WTForms==3.2.*; python_version > '3.9'
|