Repository navigation
[BUG]: critical CVE in maplibre-gl, please update to version 6 #8031
Description
Description
maplibre-gl has a critical secutiry vulnerability, which affects versions <= 6.4.0.
https://nvd.nist.gov/vuln/detail/cve-2026-85061
GHSA-jrc7-96c5-q579
Steps to reproduce
npm i plotly.js
Notes
They don't want to backport the fix (maplibre/maplibre-gl-js#8384 (comment))
Alternatives
Maybe maplibre-gl could be an optional dependency?
Activity
camdecoster commentedon Sep 9, 2026
Thanks for letting us know! I'll look into upgrading, but this one might be difficult as v6 went ESM only.
Mathlete-101 commentedon Sep 9, 2026
As a workaround, I overrode maplibre-gl to an empty package and that has appeared to work. (I'm not using anything map related). This suggests that making in an optional dependency may be feasible.
camdecoster commentedon Sep 9, 2026
@birkskyum hello from plotly.js! Do you know if the MapLibre team has any plans to port this fix to v5?
camdecoster commentedon Sep 14, 2026
This update has been released in v4.1.1.