[BUG]: critical CVE in maplibre-gl, please update to version 6

[jendrikw]

Description

maplibre-gl has a critical secutiry vulnerability, which affects versions <= 6.4.0.

https://nvd.nist.gov/vuln/detail/cve-2026-85061
GHSA-jrc7-96c5-q579

Steps to reproduce

npm i plotly.js

Notes

They don't want to backport the fix (maplibre/maplibre-gl-js#8384 (comment))

Alternatives

Maybe maplibre-gl could be an optional dependency?

[camdecoster]

Thanks for letting us know! I'll look into upgrading, but this one might be difficult as v6 went ESM only.

[Mathlete-101]

As a workaround, I overrode maplibre-gl to an empty package and that has appeared to work. (I'm not using anything map related). This suggests that making in an optional dependency may be feasible.

[camdecoster]

@birkskyum hello from plotly.js! Do you know if the MapLibre team has any plans to port this fix to v5?