chore: apply non-breaking dependency updates from open dependabot PRs

[asheshv]

Summary

Applies non-breaking dependency updates surfaced by open dependabot PRs (pgadmin-org/pgadmin4). Major-version bumps are deferred.

Python

• requirements.txt: google-auth-oauthlib 1.3.1 → 1.4.0 (Python dependency: Bump google-auth-oauthlib from 1.3.1 to 1.4.0 #9929 / Python dependency: Bump google-auth-oauthlib from 1.3.1 to 1.4.0 in /web/regression #9931), gated so Python 3.9 stays on 1.3.1 (1.4.0 requires python_version >= 3.10)
• tools/requirements.txt: requests >=2.33.1 → >=2.34.2 for python_version > '3.9' (Python dependency: Update requests requirement from >=2.33.1 to >=2.34.2 #9943 / Python dependency: Update requests requirement from >=2.33.1 to >=2.34.2 in /tools #9944)
• web/regression/requirements.txt: selenium 4.43.0 → 4.44.0 (Python dependency: Bump selenium from 4.43.0 to 4.44.0 in /web/regression #9946)

JavaScript (web/package.json, web/yarn.lock)

• postcss 8.5.12 → 8.5.14 (Javascript dependency: Bump postcss from 8.5.13 to 8.5.14 in /web #9874 / Javascript dependency: Bump postcss from 8.5.13 to 8.5.14 in /web #9889)
• @tanstack/react-query 5.100.5 → 5.100.9 (Javascript dependency: Bump @tanstack/react-query from 5.100.7 to 5.100.9 in /web #9878)
• ip-address 10.1.0 → 10.1.1 (Javascript dependency: Bump ip-address from 10.1.0 to 10.1.1 in /web #9918)

Electron runtime (runtime/package.json, runtime/yarn.lock)

• axios 1.16.0 → 1.16.1 (Javascript dependency: Bump axios from 1.16.0 to 1.16.1 in /runtime #9948)
• eslint 10.3.0 → 10.4.0 (Javascript dependency: Bump eslint from 10.3.0 to 10.4.0 in /runtime #9947)

Skipped (major-version, deferred to a future minor)

• @mui/material 7 → 9 (Javascript dependency: Bump @mui/material from 7.3.10 to 9.0.0 in /web #9843)
• @mui/x-date-pickers 8 → 9 (Javascript dependency: Bump @mui/x-date-pickers from 8.28.3 to 9.0.2 in /web #9888)
• cryptography 47.0.* → 48.0.* (Python dependency: Update cryptography requirement from ==47.0.* to ==48.0.* #9926 / Python dependency: Update cryptography requirement from ==47.0.* to ==48.0.* in /web/regression #9932)
• paramiko 3.5.1 → 5.0.0 (Python dependency: Bump paramiko from 3.5.1 to 5.0.0 #9927 / Python dependency: Bump paramiko from 3.5.1 to 5.0.0 in /web/regression #9930)
• electron 41.5.0 → 42.1.0 (Javascript dependency: Bump electron from 41.5.0 to 42.2.0 in /runtime #9945)

Test plan

• yarn run test:js-once → 140 / 0 / 0 suites, 824 / 0 / 0 tests
• yarn run linter in /web → clean (silent)
• yarn run linter in /runtime → clean (silent)
• pycodestyle project-wide → 0 violations
• Each new version cross-checked against the corresponding dependabot PR diff via gh pr diff
• Each Python bump cross-checked against PyPI requires_python to preserve Python 3.9 support

Summary by CodeRabbit

• Chores
  • Updated several dependency versions across the project: google-auth-oauthlib (Python-version specific pins), eslint, axios, requests (and requests[security]), @tanstack/react-query, ip-address, postcss, selenium, and bumped the web package manager version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: cf5b8f9a-927e-4994-9ddf-10224dea0c8f

📥 Commits

Reviewing files that changed from the base of the PR and between 89f55a8 and e21828a.

⛔ Files ignored due to path filters (1)

• web/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• web/package.json

---

Walkthrough

This PR updates dependency versions across five manifest files: Python manifests gain version-conditional pins and request bumps; runtime and web JavaScript manifests receive minor package bumps and a packageManager update; web regression Selenium is also bumped.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Backend Python dependencies requirements.txt, tools/requirements.txt	google-auth-oauthlib transitions to Python-version-conditional pins (1.3.1 for Python ≤3.9, 1.4.0 for >3.9); requests and requests[security] are bumped to >=2.34.2 for Python >3.9 while keeping >=2.32.5,<2.33 for ≤3.9.
Frontend and runtime JavaScript dependencies runtime/package.json, web/package.json	eslint bumped to ^10.4.0 and axios to ^1.16.1 in runtime; frontend packages updated: @tanstack/react-query ^5.100.9, ip-address ^10.1.1, postcss ^8.5.14; packageManager bumped to yarn@4.15.0.
Testing dependencies web/regression/requirements.txt	Selenium regression test driver bumped to 4.44.0.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• pgadmin-org/pgadmin4#9827: Modifies requirements.txt's google-auth-oauthlib dependency with similar version targeting.
• pgadmin-org/pgadmin4#9834: Updates runtime/package.json for eslint and axios with overlapping version changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: applying non-breaking dependency updates from dependabot PRs across multiple package managers and files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/deps-2026-05

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}