Skip to content

fix: Upgrade MapLibre to v6 to address CVE - #8035

Open
camdecoster wants to merge 9 commits into
mainfrom
cam/8031/upgrade-maplibre-v6
Open

fix: Upgrade MapLibre to v6 to address CVE#8035
camdecoster wants to merge 9 commits into
mainfrom
cam/8031/upgrade-maplibre-v6

Conversation

@camdecoster

@camdecoster camdecoster commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Description

Upgrade maplibre-gl dependency to v6.9.0 to address CVE.

Closes #8031.

Changes

  • Upgrade maplibre-gl
  • Extract maplibre worker to be used in our bundle
  • Update maplibre function calls for v6 compatibility
  • Add maplibre worker diff check to CI
  • Update map selection logic to handle bearing, pitch
  • Remove map_angles mock from disallow list and update baseline image

Notes

  • v5 used to export a UMD bundle that included the worker. v6 went ESM only, so we have to extract the worker ourselves now (following what v5 did as an example). This will unfortunately add about 500KiB to the library size. v5 did a soft of deduping on the worker code, but that's not possible when we bundle it in.
  • It's worth noting that this solution (mostly) follows the example that is shown in the installation docs (here and here)
  • This worker code file will need to be updated any time maplibre-gl is updated
  • The selection logic update fixes a bug that I discovered during this update. Without it, using the select tool would break for non-standard projections.
  • The map_angles mock is the only one that uses a different angle than the default, so I added it back in. 🤞 that it doesn't behave flaky.

@camdecoster
camdecoster marked this pull request as draft September 10, 2026 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG]: critical CVE in maplibre-gl, please update to version 6

1 participant