From 788f38db68b630aa838fefc821f966c81eaed9b0 Mon Sep 17 00:00:00 2001 From: Dave Page Date: Wed, 9 Sep 2026 08:33:02 +0100 Subject: [PATCH] fix(pkg): stop shipping the JavaScript build configuration The Windows installer and the pip wheel were both shipping web/yarn.lock, web/package.json and the rest of the JavaScript build configuration into the installed tree, even though none of it is used at runtime: only the webpack output under pgadmin/static/js/generated is. Because node_modules is stripped, the lockfile that remains describes packages that are not present, so vulnerability scanners run against an installation report the whole build-time dependency tree, devDependencies included, as findings that cannot be acted on and will recur on every release no matter how current the versions are. The Linux, macOS and Docker builds already removed these files, so this brings Windows and pip into line with them, and adds webpack.* to the Linux and macOS lists so that all of the packagers now strip the same set. For pip the cleanup runs before syft, so the SBOM describes what actually ships. Verified by assembling a web tree with the cleanup applied and starting pgAdmin from it: /misc/ping and /browser/ both return 200 and every generated bundle is served. --- Make.bat | 12 +++++++++++- pkg/linux/build-functions.sh | 2 +- pkg/mac/build-functions.sh | 2 +- pkg/pip/build.sh | 9 +++++++++ 4 files changed, 22 insertions(+), 3 deletions(-) diff --git a/Make.bat b/Make.bat index c6fbac77446..c4f714f5c77 100644 --- a/Make.bat +++ b/Make.bat @@ -246,8 +246,18 @@ REM Main build sequence Ends RD /Q /S "%BUILDROOT%\web\regression" 1> nul 2>&1 ECHO Removing tools... RD /Q /S "%BUILDROOT%\web\tools" 1> nul 2>&1 - ECHO Removing yarn cache... + ECHO Removing the JavaScript build configuration... RD /Q /S "%BUILDROOT%\web\.yarn" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\yarn.lock" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\.yarnrc.yml" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\package.json" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\jest.config.js" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\babel.cfg" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\babel.config.json" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\webpack.config.js" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\webpack.shim.js" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\.eslintrc.js" 1> nul 2>&1 + DEL /q "%BUILDROOT%\web\.editorconfig" 1> nul 2>&1 ECHO Removing any existing configurations... DEL /q "%BUILDROOT%\web\pgadmin4.db" 1> nul 2>&1 DEL /q "%BUILDROOT%\web\config_local.py" 1> nul 2>&1 diff --git a/pkg/linux/build-functions.sh b/pkg/linux/build-functions.sh index f0947f9e52d..a98e42cbcf6 100644 --- a/pkg/linux/build-functions.sh +++ b/pkg/linux/build-functions.sh @@ -313,7 +313,7 @@ _copy_code() { cp "${SOURCEDIR}/pkg/linux/config_distro.py" "${SERVERROOT}/usr/${APP_NAME}/web/" cd "${SERVERROOT}/usr/${APP_NAME}/web/" || exit rm -f pgadmin4.db config_local.* - rm -rf jest.config.js babel.* package.json .yarn* yarn* .editorconfig .eslint* node_modules/ regression/ tools/ pgadmin/static/js/generated/.cache + rm -rf jest.config.js babel.* package.json .yarn* yarn* webpack.* .editorconfig .eslint* node_modules/ regression/ tools/ pgadmin/static/js/generated/.cache find . -name "tests" -type d -print0 | xargs -0 rm -rf find . -name "feature_tests" -type d -print0 | xargs -0 rm -rf find . -name "__pycache__" -type d -print0 | xargs -0 rm -rf diff --git a/pkg/mac/build-functions.sh b/pkg/mac/build-functions.sh index c5174e98a1b..50e29cdf067 100644 --- a/pkg/mac/build-functions.sh +++ b/pkg/mac/build-functions.sh @@ -346,7 +346,7 @@ _complete_bundle() { cp -r "${SOURCE_DIR}/web" "${BUNDLE_DIR}/Contents/Resources/" cd "${BUNDLE_DIR}/Contents/Resources/web" || exit rm -f pgadmin4.db config_local.* - rm -rf jest.config.js babel.* package.json .yarn* yarn* .editorconfig .eslint* node_modules/ regression/ tools/ pgadmin/static/js/generated/.cache + rm -rf jest.config.js babel.* package.json .yarn* yarn* webpack.* .editorconfig .eslint* node_modules/ regression/ tools/ pgadmin/static/js/generated/.cache find . -name "tests" -type d -print0 | xargs -0 rm -rf find . -name "feature_tests" -type d -print0 | xargs -0 rm -rf find . -name "__pycache__" -type d -print0 | xargs -0 rm -rf diff --git a/pkg/pip/build.sh b/pkg/pip/build.sh index 395b5624b6c..35e5ed669af 100755 --- a/pkg/pip/build.sh +++ b/pkg/pip/build.sh @@ -76,6 +76,15 @@ do tar cf - "${FILE}" | (cd ../pip-build/pgadmin4; tar xf -) done +# Remove the JavaScript build configuration from the tree we're shipping. None +# of it is used at runtime (only the bundle under pgadmin/static/js/generated +# is), and leaving yarn.lock in place means vulnerability scanners report the +# entire build-time dependency tree against the installed package. This happens +# before the SBOM is generated so that the SBOM describes what actually ships. +echo Removing the JavaScript build configuration... +(cd ../pip-build/pgadmin4 && rm -rf jest.config.js babel.* package.json \ + .yarn* yarn* webpack.* .editorconfig .eslint*) + cd ../docs || exit for FILE in $(git ls-files) do