chore(deps): consolidate dependabot + additional patch/minor dependency bumps#10176
Merged
Conversation
Consolidates 22 open dependabot PRs into one manual bump, applied directly against current package.json/requirements.txt rather than cherry-picked (the PR branches were stale and would have reverted unrelated fixes like the yarn packageManager pin and cryptography version). JS (web + runtime): axios, brace-expansion, form-data, undici, js-yaml, dompurify, @babel/core, webpack, sharp, electron, eslint, react-checkbox-tree. brace-expansion/form-data/undici/js-yaml are transitive-only, pinned via yarn `resolutions` with range-specific selectors so unrelated major-version chains (brace-expansion v2, js-yaml v4) aren't clobbered. Python: azure-mgmt-resource 26.0.0 and selenium 4.45.0 both require Python >=3.10, so both are version-gated (python_version <=/> '3.9') to keep 3.9 support intact; certifi bumped plain (still >=3.7). Excluded from this batch: - paramiko 3.5.1 -> 5.0.0 (pgadmin-org#9927): structurally blocked by sshtunnel 0.4.0 still referencing paramiko.DSSKey - @mui/material 7 -> 9, @mui/x-date-pickers 8 -> 9 (pgadmin-org#10091, pgadmin-org#10092): known-breaking (see chore/mui-9 branch), needs the accompanying component fixes, not a bare version bump - draft pgadmin-org#9961 (manual mui bump, not a dependabot PR) Pre-existing gap noted, not fixed here: selenium==4.44.0 (the <=3.9 pin) already requires Python >=3.10 upstream, so 3.9 was already broken before this change.
26.0.0 restructured the package layout: ResourceManagementClient moved from azure.mgmt.resource to azure.mgmt.resource.resources. pgadmin/misc/cloud/azure/__init__.py imports it from the old top-level location and fails at import time, breaking the whole cloud module registration. Caught by running the Python regression suite before opening the PR. Same treatment as the mui 7->9 bump: real breaking change needs a code fix, not a version bump.
Scanned web/package.json and runtime/package.json direct deps against npm registry latest (dependabot only covers its own opened PRs, not a full audit). Applied same-major-version bumps only; anything crossing a major version is left for separate review. Excluded despite being same-major, due to blast radius: - react-arborist (3.5.0, latest 3.15.1): only consumer is PgTreeView/index.jsx, the core object-browser tree every feature depends on. 10 minor versions unreviewed. - @tanstack/react-virtual (3.13.24, latest 3.14.8): used in DataGridView/grid.jsx and PgTable.jsx, already known-fragile virtualization code (see perf toolkit / tree-nav bench memory). - react-frame-component: pinned "~5.2.6" (tilde, patch-only by design); latest 5.3.2 needs widening the range operator itself, not just a version number change. Two picks hit Yarn's registry quarantine gate (blocks packages newer than the age threshold) and were backed off to the next-older version instead of forced through: - react/react-dom: wanted ^19.2.8 (published yesterday), used ^19.2.7 - electron (runtime): wanted ^43.2.0 (published today), kept ^43.1.1 postcss also hit quarantine at ^8.5.22; used ^8.5.20 instead. certifi (python) same situation, reverted to existing 2026.6.17 pin (2026.7.22 published same day) rather than force it. Bumping @simonwep/pickr 1.9.1 -> 1.10.0 surfaced a latent bug: pickr 1.9.1 was the *only* source of `core-js` in the whole dependency tree, and the project relies on core-js via webpack.config.js's `useBuiltIns: 'usage', corejs: 3` babel preset without ever declaring core-js itself. 1.10.0 drops that transitive path, which silently broke every JS bundle/test import (core-js/modules/es.array.includes.js not found) project-wide. Fixed at the root: added core-js as an explicit devDependency instead of reverting pickr, since any future unrelated bump could hit the same landmine again. Verified: eslint (web+runtime), full JS test suite (149/149, 916/916), webpack dev build compiles, Python regression suite (2388/2388, excl. Selenium feature_tests).
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughDependency manifests are refreshed across Python, runtime, and web projects, including package version bumps, transitive dependency resolutions, and Python-version-specific Selenium pins. ChangesDependency refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)web/package.jsonTraceback (most recent call last): Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CI feature tests failed on this PR (every dialog: "Register - Server: Something went wrong"). Root cause: pickr 1.10.0 switched the package to "type": "module" with a new interop shim; under webpack production mode the resulting `import Pickr from '@simonwep/pickr'; new Pickr.default(...)` call resolves .default to something that isn't a constructor, throwing on every first render that mounts a color picker (which construction is triggered from a Register/Properties dialog effect, hence "every dialog" rather than something pickr- specific). Confirmed by exact-pinned bisection against a known-good baseline (caret ranges silently float to latest-satisfying on every `yarn install`, which produced several false negatives before pinning versions with no range operator for the test). Reproduces 100% with `yarn run bundle` (production, matches CI); does not reproduce with `yarn run bundle:dev` or the Jest suite, since neither exercises webpack's production/minified code path. Pinned with `~1.9.1` (tilde, not caret) specifically so a future `yarn install` can't silently float back up to 1.10.x and reintroduce this. Verified: full Selenium feature_tests suite, 17/19 pass (remaining 2 failures are the pre-existing local pldbgapi-extension gap, unrelated).
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
core-jswas never a direct dependency despite the webpack Babel config (useBuiltIns: 'usage', corejs: 3) requiring it — it only worked because@simonwep/pickr@1.9.1happened to drag it in transitively. Bumping pickr to 1.10.0 dropped that path and broke every JS build/test. Fixed by declaringcore-jsexplicitly.azure-mgmt-resource26.0.0: that release movedResourceManagementClientfromazure.mgmt.resourcetoazure.mgmt.resource.resources, breakingpgadmin/misc/cloud/azure/__init__.pyat import time. Caught by the Python regression suite.seleniumneeded apython_versiongate split since 4.45.0 requires Python ≥3.10 (repo still supports 3.9).Excluded, not part of this PR:
paramiko3→5 (Python dependency: Bump paramiko from 3.5.1 to 5.0.0 #9927): structurally blocked bysshtunnel0.4.0 still referencingparamiko.DSSKey.@mui/material/@mui/x-date-pickers7/8→9 (Javascript dependency: Bump @mui/material from 7.3.10 to 9.1.1 in /web #10091, Javascript dependency: Bump @mui/x-date-pickers from 8.28.3 to 9.5.0 in /web #10092): known-breaking, needs the accompanying component fixes tracked separately, not a bare version bump.react-arborist,@tanstack/react-virtual,react-frame-component: same-major bumps available, but excluded due to blast radius (core object-browser tree / already-fragile virtualization code) or range-syntax caveats (tilde-pinned).Test plan
yarn eslintclean (web + runtime)yarn test:js-once— 149/149 suites, 916/916 tests passyarn bundle:dev— webpack compiles cleanruntests.py --exclude feature_tests) — 2388/2388 passfeature_tests— 17/19 pass; 2 failures traced to a local-environment gap (nopldbgapiextension available for this PG18 install), unrelated to any bumped packageSummary by CodeRabbit