mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Ashesh Vashi
8812025a8a
Consolidates 20 open dependabot PRs (JS + Python) into one bump, applied directly rather than cherry-picked (PR branches were stale and would have reverted unrelated fixes like the yarn packageManager pin). Adds further same-major patch/minor bumps found by auditing beyond dependabot's own PR list. JS (web + runtime): axios, brace-expansion, form-data, undici, js-yaml, dompurify, @babel/core, webpack, sharp, electron, eslint, react-checkbox-tree, autoprefixer, eslint-plugin-jest, globals, jest, jest-environment-jsdom, svgo, terser-webpack-plugin, typescript-eslint, webpack-bundle-analyzer, @date-io/date-fns, @szhsin/react-menu, @tanstack/react-query, @types/react, ajv, anti-trojan-source, ip-address, marked, moment-timezone, papaparse, postcss, react, react-dom, react-draggable, react-timer-hook, sql-formatter, zustand. Python: certifi, selenium (version-gated: 4.45.0 requires Python >=3.10, 4.44.0 kept for <=3.9 to preserve Python 3.9 support). Reverted / excluded, with reasons: - azure-mgmt-resource 26.0.0: moved ResourceManagementClient from azure.mgmt.resource to azure.mgmt.resource.resources, breaking pgadmin/misc/cloud/azure/__init__.py at import time. Caught by the Python regression suite. Kept at 25.0.0. - @simonwep/pickr 1.10.0: switched its build tool to tsup, which marks its UMD bundle as an ES module via Symbol.toStringTag instead of the __esModule flag Babel's interop helper checks for. Babel double-wraps the export, so `new Pickr(...)` resolves to a non-constructor and crashes every dialog that mounts a color picker -- reproduces only in the production/minified webpack build, not the dev bundle or Jest. Pinned to ~1.9.1 (tilde, not caret) so a future install can't silently float back to 1.10.x. - paramiko 3->5 (#9927): structurally blocked by sshtunnel 0.4.0 still referencing paramiko.DSSKey. - @mui/material / @mui/x-date-pickers 7/8->9 (#10091, #10092): known UI-breaking, needs the accompanying component fixes tracked on a separate branch, not a bare version bump. - react-arborist, @tanstack/react-virtual, react-frame-component: same-major bumps available but excluded -- core object-browser tree, already-fragile virtualization code, or tilde-pinned range respectively. - A handful of JS packages hit Yarn 4.15's registry quarantine gate (blocks just-published versions); backed off to the next-older version instead of forcing through. Added core-js as an explicit devDependency: it was never declared despite webpack's Babel config (useBuiltIns: 'usage', corejs: 3) requiring it -- it only worked because @simonwep/pickr 1.9.1 happened to pull it in transitively, which broke when pickr was briefly bumped. Verified: eslint (web + runtime), full JS test suite (149/149 suites, 916/916 tests), webpack production build compiles clean, Python regression suite (2388/2388, excl. Selenium), Selenium feature_tests (17/19 pass; the 2 failures trace to a local pldbgapi-extension gap, unrelated to any bumped dependency).