fix: Upgrade MapLibre to v6 to address CVE

.github/workflows/ci.yml

@@ -599,6 +599,16 @@ jobs:
       - name: Verify entry point declarations are in sync
         run: npm run entry-point-types-check
 
+  maplibre-worker-drift:
+    needs: install-and-cibuild
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: ./.github/actions/setup-workspace
+
+      - name: Verify the inlined maplibre-gl worker is in sync
+        run: npm run maplibre-worker-diff-check
+
   package-resolution:
     needs: install-and-cibuild
     runs-on: ubuntu-latest

.gitignore

@@ -2,6 +2,7 @@ node_modules
 
 build/*
 !build/plotcss.js
+!build/maplibre_worker.js
 !build/README.md
 
 dist/*.LICENSE.txt

.npmignore

@@ -1,9 +1,10 @@
 # Exclude all hidden files and folders
 .*
 
-# Exclude all files in build/, except for plotcss.js and README.md
+# Exclude all files in build/, except for those required when bundling the package
 build/*
 !build/plotcss.js
+!build/maplibre_worker.js
 !build/README.md
 
 # Exclude these directories

CONTRIBUTING.md

@@ -220,8 +220,11 @@ files.
 
 #### Other npm scripts that may be of interest in development
 
-- `npm run preprocess`: pre-processes the css and svg source file in js. This
-  script must be run manually when updating the css and svg source files.
+- `npm run preprocess`: regenerates the sources that the build depends on, and
+  must be run manually when their inputs change. Commit the result.
+  `build/README.md` describes the committed files under `build/` and what
+  triggers each one. Note that the `preprocess` step is always run automatically
+  as part of `npm run build`.
 
 ## Testing
 
@@ -386,7 +389,14 @@ If you would like a link to the dev build for your PR but don't have permission
 - All tasks can be run using [`npm run-script`](https://docs.npmjs.com/cli/run-script)
 - Tests are in `test/`; they are partitioned into `image` and `jasmine` tests
 - Test dashboard and image viewer code is in `devtools/`
-- Built files are in `build/` (the files in here are git-ignored, except for `plotcss.js`)
+- Built files are in `build/` (mostly git-ignored, with a few exceptions: see `build/README.md`)  
+
+### The bundled maplibre-gl worker
+
+`map` traces render through `maplibre-gl`, which parses tiles in a web worker.
+As of v6, the library no longer includes a UMD bundle with this code. As such,
+it's now necessary to extract it and include it as part of the build process.
+See `tasks/util/bundle_maplibre_worker.js` for more information.
 
 ## Trace module design
 

build/README.md

@@ -1 +1,15 @@
-Directory of non-distributed built files
+## Directory of generated build files
+
+Most of what lands here is scratch output that git and npm both ignore. The dev server and the image tests read their bundles from here.
+
+There are exceptions for the files listed below. These files are used in the build process, but need to be generated prior to that.
+
+- `plotcss.js`: The stylesheet compiled from `src/css/style.scss`. Required by `src/core.js`.
+- `maplibre_worker.js`: The maplibre-gl web worker, bundled into one standalone script and exported as a string. `src/plots/map/map.js` requires it and turns the string into a blob URL.
+
+These files are committed and shipped in the npm package. Anyone who installs plotly.js and bundles it from `lib/` or `src/` resolves all of these, so leaving any out of the package breaks that build. These are specifically allowlisted in `.gitignore` and `.npmignore` for that reason.
+
+`npm run preprocess` regenerates these files. Run that command and commit the result whenever the input changes.
+
+- For `maplibre_worker.js` this means every time the version of `maplibre-gl` is updated in `package.json`. The worker file must match the `maplibre-gl` version used by plotly.js. The command `npm run maplibre-worker-diff-check` runs in CI to verify that the two are in sync.
+- For `plotcss.js` this means every time a stylesheet under `src/css/` changes, including the partials that `style.scss` pulls in with `@use`. The same command also writes `dist/plotly.css`, which strict-CSP applications load instead of the inlined styles.

draftlogs/8035_change.md

@@ -0,0 +1,2 @@
+- Update `maplibre-gl` to v6 to address [CVE-2026-85061](https://github.com/advisories/GHSA-jrc7-96c5-q579) [[#8035](https://github.com/plotly/plotly.js/pull/8035)]
+  - `maplibre-gl` v6 dropped WebGL1 support, so some older browsers won't be able to use the map traces. Safari 15, Chrome 56, Firefox 51 and later are now required for the map traces.

draftlogs/8035_fix.md

@@ -0,0 +1 @@
+- Box and lasso selection of `scattermap` points are now supported on a rotated or pitched map [[#8035](https://github.com/plotly/plotly.js/pull/8035)]

package.json

@@ -44,6 +44,7 @@
     "locales": "node tasks/locales.mjs",
     "schema": "node tasks/schema.mjs",
     "schema-typegen-diff-check": "npm run schema && git diff --exit-code src/types/generated/schema.d.ts test/plot-schema.json",
+    "maplibre-worker-diff-check": "npm run preprocess && git diff --exit-code build/maplibre_worker.js",
     "entry-point-types": "node tasks/entry_point_types.mjs",
     "entry-point-types-check": "node tasks/entry_point_types.mjs --check",
     "stats": "node tasks/stats.mjs",
@@ -109,7 +110,7 @@
     "has-hover": "^1.0.1",
     "has-passive-events": "^1.0.0",
     "is-mobile": "^5.0.0",
-    "maplibre-gl": "^5.24.0",
+    "maplibre-gl": "6.9.0",
     "mouse-event-offset": "^3.0.2",
     "native-promise-only": "^0.8.1",
     "parse-svg-path": "^0.2.0",

src/plots/map/map.js

@@ -1,6 +1,21 @@
 'use strict';
 
-var maplibregl = require('maplibre-gl');
+// maplibre-gl v6 is ESM only, so request the bundle by its explicit path.
+const maplibregl = require('maplibre-gl/dist/maplibre-gl.mjs');
+
+// Get the maplibre-gl worker src to load it as v5 used to.
+// This (mostly) follows the guidance from the MapLibre install
+// guide: https://maplibre.org/maplibre-gl-js/docs/#installation
+const maplibreWorkerSource = require('../../../build/maplibre_worker');
+let workerUrlIsSet = false;
+
+// Point maplibre-gl at the worker
+const setWorkerUrl = () => {
+    // Only load the inlined blob when the first map is requested to avoid taking a chunk of memory
+    if (workerUrlIsSet) return;
+    workerUrlIsSet = true;
+    maplibregl.setWorkerUrl(URL.createObjectURL(new Blob([maplibreWorkerSource], { type: 'text/javascript' })));
+};
 
 var Lib = require('../../lib');
 var geoUtils = require('../../lib/geo_location_utils');
@@ -111,23 +126,30 @@ proto.createMap = function (calcData, fullLayout, resolve, reject) {
         mapOptions.fitBoundsOptions = { padding: constants.fitBoundsPadding };
     }
 
+    setWorkerUrl();
+
     // Create the map!
     const map = (self.map = new maplibregl.Map(mapOptions).addControl(
         new maplibregl.AttributionControl({ compact: true })
     ));
 
-    var requestedIcons = {};
-    map.on('styleimagemissing', function (e) {
-        var id = e.id;
+    const requestedIcons = {};
+    map.setMissingStyleImageResolver((id) => {
         if (!requestedIcons[id] && /^[a-zA-Z0-9-]+$/.test(id)) {
-            requestedIcons[id] = true;
-            var img = new Image(15, 15);
-            img.onload = function () {
-                map.addImage(id, img, { sdf: true });
-            };
-            img.crossOrigin = 'Anonymous';
-            img.src = 'https://cdn.jsdelivr.net/npm/@mapbox/maki@8.2.0/icons/' + id + '.svg';
+            // Use a promise so that maplibre-gl awaits the resolution before treating the image as missing
+            requestedIcons[id] = new Promise((resolve) => {
+                const img = new Image(15, 15);
+                img.onload = () => {
+                    map.addImage(id, img, { sdf: true });
+                    resolve();
+                };
+                img.onerror = () => resolve();
+                img.crossOrigin = 'Anonymous';
+                img.src = `https://cdn.jsdelivr.net/npm/@mapbox/maki@8.2.0/icons/${id}.svg`;
+            });
         }
+
+        return requestedIcons[id];
     });
 
     map.setTransformRequest(function (url) {