chore(deps): consolidated dependency bumps (setuptools, fast-uri, tar, shell-quote, svgo)

[asheshv]

Summary

Supersedes 7 open Dependabot PRs by applying the safe ones and properly fixing the one with a broken lockfile, in one CI cycle, following the precedent of #10023.

Included

• setuptools ==82.* → ==83.* (Python dependency: Update setuptools requirement from ==82.* to ==83.* #10144, Python dependency: Update setuptools requirement from ==82.* to ==83.* in /web/regression #10145 — duplicate PRs, identical patch). Only touches the python_version > '3.9' line; the setuptools<82; python_version <= '3.9' gate is untouched, so Python 3.9 support is unaffected.
• fast-uri 3.1.2 → 3.1.4 in both /web and /runtime (Javascript dependency: Bump fast-uri from 3.1.2 to 3.1.4 in /web #10183, Javascript dependency: Bump fast-uri from 3.1.2 to 3.1.4 in /runtime #10195) — fixes two real CVEs (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6).
• tar 7.5.16 → 7.5.21 (Javascript dependency: Bump tar from 7.5.16 to 7.5.21 in /web #10182) — patch series, decompression-bomb guard + unbounded-recursion fix only, no breaking changes. Also bumped the project's own forced resolutions["tar@npm:^7.5.4"] pin to match.
• shell-quote 1.8.4 → 1.10.0 (Javascript dependency: Bump shell-quote from 1.8.4 to 1.10.0 in /web #10185) — additive opt-in parser option + fixes, no breaking changes.
• svgo 3.3.3 → 4.0.2 (Javascript dependency: Bump svgo from 3.3.3 to 4.0.2 in /web #10184) — see below.

Why #10184 needed manual work

Dependabot's own PR left yarn.lock internally inconsistent: it merged the svgo@npm:^4.0.1 / svgo@npm:^4.0.2 resolution blocks but dropped the workspace-level svgo dependency entry that mirrors package.json. Result: yarn install --immutable fails in CI with "the lockfile would have been modified by this install."

Regenerated properly here via yarn up svgo@4.0.2 + yarn dedupe svgo. Also verified the actual risk of the 3→4 major bump: the direct svgo/svgo-loader deps are not wired into any webpack rule (grepped webpack.config.js — zero references). The real SVG import pipeline is @svgr/webpack → its own bundled @svgr/plugin-svgo → svgo 3.3.3, which this bump doesn't touch at all (confirmed via yarn why svgo — that resolution stays untouched, correctly kept separate from the deduped 4.0.2). So this bump has no effect on the actual build output.

Not included (structurally blocked, tracked separately)

• paramiko 3.5.1 → 5.0.0 (Python dependency: Bump paramiko from 3.5.1 to 5.0.0 #9927): paramiko 5.0.0 removes DSSKey entirely (verified by inspecting the actual wheel — paramiko/__init__.py no longer imports it). sshtunnel 0.4.0 (dormant since 2021) still has a hard module-level reference to paramiko.DSSKey, so import sshtunnel would crash immediately — matches that PR's own CI failing in 17s–3min across every job.
• pywinpty 2.0.* → 3.0.* (Python dependency: Update pywinpty requirement from ==2.0.* to ==3.0.* #10082, Python dependency: Update pywinpty requirement from ==2.0.* to ==3.0.* in /web/regression #10084): the existing pin in requirements.txt cites andfoy/pywinpty#545, confirmed still open ("process read and write not working as expected in 3.x"). Bumping walks straight into the bug the pin exists to avoid.

Testing

• yarn install --immutable clean in both /web and /runtime (the exact check CI runs).
• yarn run linter clean.
• Full yarn run bundle:dev — webpack 5.108.4 compiled successfully.
• pycodestyle --config=.pycodestyle requirements.txt-relevant check: N/A (plain requirements pin, no Python code changed).

Once merged, #10144, #10145, #10182, #10183, #10184, #10185, #10195 can all be closed as superseded.

Summary by CodeRabbit

• Chores
  • Updated underlying tooling and package versions to improve compatibility, stability, and maintainability.
  • Refined version controls to ensure more consistent build and installation results.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a2e6f6e-1b6f-40ec-b495-39a11b94446d

📥 Commits

Reviewing files that changed from the base of the PR and between 108797d and e678d6e.

⛔ Files ignored due to path filters (2)

• runtime/yarn.lock is excluded by !**/yarn.lock, !**/*.lock
• web/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• requirements.txt
• web/package.json

---

Walkthrough

Dependency constraints are updated for Python and web tooling: setuptools advances to 83.*, svgo is exactly pinned at 4.0.2, and the tar resolution advances to 7.5.21.

Changes

Dependency updates

Layer / File(s)	Summary
Dependency constraint updates requirements.txt, web/package.json	Updates the Python setuptools pin, pins svgo to 4.0.2, and changes the tar resolution to ^7.5.21.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• pgadmin-org/pgadmin4#10023: Updates the related tar@npm:^7.5.4 resolution in web/package.json.

Suggested reviewers: dpage

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency bump theme and names the main packages changed in this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}