fix: Upgrade MapLibre to v6 to address CVE

.github/workflows/ci.yml

@@ -599,6 +599,9 @@ jobs:
       - name: Verify entry point declarations are in sync
         run: npm run entry-point-types-check
 
+      - name: Verify the inlined maplibre-gl worker is in sync
+        run: npm run maplibre-worker-diff-check
+
   package-resolution:
     needs: install-and-cibuild
     runs-on: ubuntu-latest

.gitignore

@@ -2,6 +2,7 @@ node_modules
 
 build/*
 !build/plotcss.js
+!build/maplibre_worker.js
 !build/README.md
 
 dist/*.LICENSE.txt

.npmignore

@@ -1,9 +1,10 @@
 # Exclude all hidden files and folders
 .*
 
-# Exclude all files in build/, except for plotcss.js and README.md
+# Exclude all files in build/, except for those required when bundling the package
 build/*
 !build/plotcss.js
+!build/maplibre_worker.js
 !build/README.md
 
 # Exclude these directories

draftlogs/8035_fix.md

@@ -0,0 +1,3 @@
+ - Update `maplibre-gl` to v6 to address ([CVE-2026-85061](https://github.com/advisories/GHSA-jrc7-96c5-q579)) [[#8035](https://github.com/plotly/plotly.js/pull/8035)]
+  - `maplibre-gl` v6 dropped WebGL1 support, so some older browsers won't be able to use the map traces. Safari 15, Chrome 56, Firefox 51 and later are now required for the map traces.
+  - Box and lasso selection of `scattermap` points are now supported on a rotated or pitched map

package.json

@@ -44,6 +44,7 @@
     "locales": "node tasks/locales.mjs",
     "schema": "node tasks/schema.mjs",
     "schema-typegen-diff-check": "npm run schema && git diff --exit-code src/types/generated/schema.d.ts test/plot-schema.json",
+    "maplibre-worker-diff-check": "npm run preprocess && git diff --exit-code build/maplibre_worker.js",
     "entry-point-types": "node tasks/entry_point_types.mjs",
     "entry-point-types-check": "node tasks/entry_point_types.mjs --check",
     "stats": "node tasks/stats.mjs",
@@ -109,7 +110,7 @@
     "has-hover": "^1.0.1",
     "has-passive-events": "^1.0.0",
     "is-mobile": "^5.0.0",
-    "maplibre-gl": "^5.24.0",
+    "maplibre-gl": "^6.9.0",
     "mouse-event-offset": "^3.0.2",
     "native-promise-only": "^0.8.1",
     "parse-svg-path": "^0.2.0",

src/plots/map/map.js

@@ -1,6 +1,21 @@
 'use strict';
 
-var maplibregl = require('maplibre-gl');
+// maplibre-gl v6 is ESM only, so request the bundle by its explicit path.
+const maplibregl = require('maplibre-gl/dist/maplibre-gl.mjs');
+
+// Get the maplibre-gl worker src to load it as v5 used to.
+// This (mostly) follows the guidance from the MapLibre install
+// guide: https://maplibre.org/maplibre-gl-js/docs/#installation
+const maplibreWorkerSource = require('../../../build/maplibre_worker');
+let workerUrlIsSet = false;
+
+// Point maplibre-gl at the worker
+const setWorkerUrl = () => {
+    // Only load the inlined blob when the first map is requested to avoid taking a chunk of memory
+    if (workerUrlIsSet) return;
+    workerUrlIsSet = true;
+    maplibregl.setWorkerUrl(URL.createObjectURL(new Blob([maplibreWorkerSource], { type: 'text/javascript' })));
+};
 
 var Lib = require('../../lib');
 var geoUtils = require('../../lib/geo_location_utils');
@@ -111,23 +126,30 @@ proto.createMap = function (calcData, fullLayout, resolve, reject) {
         mapOptions.fitBoundsOptions = { padding: constants.fitBoundsPadding };
     }
 
+    setWorkerUrl();
+
     // Create the map!
     const map = (self.map = new maplibregl.Map(mapOptions).addControl(
         new maplibregl.AttributionControl({ compact: true })
     ));
 
-    var requestedIcons = {};
-    map.on('styleimagemissing', function (e) {
-        var id = e.id;
+    const requestedIcons = {};
+    map.setMissingStyleImageResolver((id) => {
         if (!requestedIcons[id] && /^[a-zA-Z0-9-]+$/.test(id)) {
-            requestedIcons[id] = true;
-            var img = new Image(15, 15);
-            img.onload = function () {
-                map.addImage(id, img, { sdf: true });
-            };
-            img.crossOrigin = 'Anonymous';
-            img.src = 'https://cdn.jsdelivr.net/npm/@mapbox/maki@8.2.0/icons/' + id + '.svg';
+            // Use a promise so that maplibre-gl awaits the resolution before treating the image as missing
+            requestedIcons[id] = new Promise((resolve) => {
+                const img = new Image(15, 15);
+                img.onload = () => {
+                    map.addImage(id, img, { sdf: true });
+                    resolve();
+                };
+                img.onerror = () => resolve();
+                img.crossOrigin = 'Anonymous';
+                img.src = `https://cdn.jsdelivr.net/npm/@mapbox/maki@8.2.0/icons/${id}.svg`;
+            });
         }
+
+        return requestedIcons[id];
     });
 
     map.setTransformRequest(function (url) {