Remove unused JavaScript and Python dependencies, and correct the dependency groups.

[dpage]

Removes packages that nothing in the tree uses any more, and sorts the web/ dependencies into the right groups so that make check-auditjs audits everything that actually ships in the bundle.

Removed from web/package.json

• Unused: valid-filename, brace, snapsvg-cjs, split.js, moment-timezone, immutability-helper, insert-if, react-new-window, react-timer-hook, @date-io/core, @date-io/date-fns.
• Build tooling no longer referenced by the webpack, Babel or Jest config: browserify, babelify, @babel/plugin-transform-runtime, style-loader, url-loader, exports-loader, css-minimizer-webpack-plugin, svgo, svgo-loader, resize-observer-polyfill. This also drops the vulnerable svgo 4.0.2 from the tree.
• Only ever needed transitively (still installed by their parents): ajv, ip-address, bignumber.js, @emotion/sheet, @emotion/memoize, @emotion/utils. The ip-address pin in resolutions is unchanged.

Added util ^0.12.5, which browserify had been quietly providing; wkx (geometry viewer) needs it and the bundle fails without it. The lockfile version is unchanged.

Regrouped

• To devDependencies: @types/react, @types/react-dom, postcss.
• To dependencies (bundled into shipped code, so previously missed by the audit): @emotion/react, @emotion/styled, html-react-parser, prop-types, stylis, buffer, process.

Python test requirements: removed extras, fixtures, linecache2, python-mimeparse and traceback2, which only old testtools releases needed. pbr stays for the Python 3.9 testscenarios pin.

Lint, Jest (984 tests), a production bundle and a backend test run from a fresh virtualenv all pass locally; the feature tests are the ones to watch here.

Summary by CodeRabbit

• Chores
  • Updated dependency configurations for the web app and regression testing, including changes to which packages are needed at runtime versus during development.
  • Removed several packages from the dependency lists. No changes to app functionality, scripts, or public interfaces are included.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: pgadmin-org/pgadmin4/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2833a0bc-238d-4ea7-8e63-45ada9b5e3a7

📥 Commits

Reviewing files that changed from the base of the PR and between ca21e94 and b9bf7eb.

⛔ Files ignored due to path filters (1)

• web/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• web/package.json
• web/regression/requirements.txt

💤 Files with no reviewable changes (1)

• web/regression/requirements.txt

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

The web dependency manifest changes its dependency entries and placement. The regression requirements remove five dependencies; the remaining listed pins are unchanged.

Changes

Dependency Manifest Updates

Layer / File(s)	Summary
Update dependency manifests web/package.json, web/regression/requirements.txt	The web manifest adds, removes, and moves dependencies across runtime and development sections. The regression requirements remove five dependencies; other listed pins remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: asheshv

Merge Risk: ⚪ Minimal · up to b9bf7

No actionable build or regression-setup failure was established from these dependency changes, so the PR has no identified merge-blocking risk.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b9bf7

The changes bring previously excluded bundled dependencies into the existing security audit without an evidenced expansion of runtime privileges. Packaging continues to build and ship static assets. Remaining uncertainty concerns dependency resolution and actual build and audit outcomes, not an identified security defect.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The evidenced exposure change concerns web dependency resolution and audit coverage, rather than new IAM, secret, or service authority. Regression requirement removals affect the explicitly selected test environment; application setup selects the root requirements file instead.

Trust Boundaries and Controls

• observed — The dependency-group audit boundary remains in place. Build-only dependencies remain outside this particular audit command, a pre-existing limitation rather than a newly weakened control.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: removing unused JavaScript and Python dependencies and correcting dependency groups.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}