[BUG]: Vulnerability MapLibre GL JS -> plotly.js -> plotly.py

[georgiossalon]

According to GHSA-jrc7-96c5-q579 there is a Vulnerability in the MapLibre GL JS that is being used within the plotly.js library.

From my understanding plotly.py is also using plotly.js in the background.

According to to MapLibre this is only being patched for >=6.4.1

"Please upgrade to maplibre-gl version 6.4.1 (or latest)."

Plotly.js is still using version v5.

Any recommendations how to handle this?

[camdecoster]

Thanks for the report! plotly.js is being updated in plotly/plotly.js#8035. Once that lands and gets released, we'll update plotly.py to match.