chore: exclude major paramiko bumps and group minor/patch Dependabot updates

[dpage]

Follow-up to #9927, which I closed rather than merged.

paramiko 5.0 removed DSSKey altogether: there is no paramiko/dsskey.py in the wheel and the name is gone from paramiko/__init__.py. sshtunnel 0.4.0, which is how pgAdmin reaches paramiko at all, still refers to paramiko.DSSKey unconditionally in SSHTunnelForwarder.get_keys(), and _consolidate_auth() calls that from the constructor. So a major bump breaks every SSH tunnelled connection at the point the forwarder is created, not merely DSA key support:

$ python -c "import sshtunnel; sshtunnel.SSHTunnelForwarder(('ssh.example.invalid', 22),
    ssh_username='someone', ssh_password='x', remote_bind_address=('127.0.0.1', 5432))"
AttributeError: module 'paramiko' has no attribute 'DSSKey'

Nothing in CI exercises SSH tunnels, so the bump looked green and would have gone in on a quiet day. sshtunnel has had no release since 0.4.0 in 2019, so there is nothing newer to move to; the pin stays at paramiko==3.5.1 and this simply stops Dependabot proposing the jump again.

The exclusion appears under both the / and /web/regression pip entries because web/regression/requirements.txt opens with -r ../../requirements.txt, so the latter entry sees the root pins as well. That same include is why we periodically get two identical PRs for one root pin (#10203/#10209, #10205/#10208, #10082/#10084 were all such pairs); deduplicating that properly means restructuring how the test requirements include the runtime ones, which felt like more than this change should carry.

Summary by CodeRabbit

• Chores
  • Updated automated dependency management to defer major paramiko upgrades where compatibility concerns exist.
  • Added documentation explaining the dependency update restrictions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 930da54e-4073-4828-bfcd-ff5a522fa238

📥 Commits

Reviewing files that changed from the base of the PR and between 2d98923 and eb1dc59.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

Walkthrough

Dependabot now ignores major paramiko updates for the root Python dependencies and /web/regression. Comments document the sshtunnel incompatibility and the inherited root requirements.

Changes

Dependabot paramiko exclusions

Layer / File(s)	Summary
Configure paramiko exclusions .github/dependabot.yml	Adds documented major paramiko exclusions for the root and /web/regression Python dependency entries.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to eb1dc

This localized configuration change only prevents incompatible major Paramiko update proposals; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing Dependabot from proposing major Paramiko upgrades.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dpage]

I have added a second commit to this PR, so it now does two things to .github/dependabot.yml.

The first is the paramiko exclusion described above. The second batches minor and patch updates into a single weekly PR per manifest, whilst leaving major updates arriving individually.

The motivation is the queue this came out of: 27 open Dependabot PRs, most of them single patch bumps of transitive packages. Every genuine problem in that pile was a major bump, namely paramiko 5.0 breaking sshtunnel, use-resize-observer 10.0 dropping its default export, and jest-dom 7.0 requiring a newer Node than our CI runs, so majors keep their individual PRs and the review attention they deserve. Grouping applies to version updates only, so Dependabot security updates are unaffected and still arrive as their own PRs.