pgAdmin implements dependency pinning to secure build supply chain

The pgAdmin project has overhauled its build process by addressing vulnerabilities in its dependency management. By moving from mutable tags to immutable releases and implementing SHA-256 lock files, the project now ensures that the libraries included in Windows and macOS installers are exactly what the developers intended, improving both security and build reproducibility.

Securing the pgbuild and pgAdmin pipeline

• pgbuild now publishes immutable releases for each upstream version alongside rolling '-latest' tags.
• pgAdmin uses a new lock file containing the SHA-256 digest of every consumed archive.
• The build process now verifies downloads against these digests; a mismatch triggers an immediate build failure.
• Dependency updates now require a two-step process: rebuilding in pgbuild and then updating the lock file in pgAdmin to create a reviewable audit trail.
• The system distinguishes between security mismatches (which fail the build) and out-of-date dependencies (which only emit warnings).

Why it matters

This change provides a standardized, verifiable reference build for PostgreSQL dependencies on Windows and macOS, benefiting other projects that ship PostgreSQL clients.