Repository navigation
fix(security): maplibre-gl 5 -> 6, clearing the last shipped critical - #26
Merged
Merged
Conversation
XSS sanitizer bypass in DOM.sanitize() via Live NamedN... No patch exists in 5.x; the advisory requires 6.14.0. v6 removed the default export. MapContainer imports Map as MapLibreMap because the module also uses the built-in Map, and a bare Map import would shadow it. basemap-styles takes addProtocol directly. Call-site behaviour is unchanged; only the import form. typecheck pass, lint pass, build pass, npm audit critical 1 -> 0. test:data: 401 failures, identical set to main after building both (verified with a worktree at origin/main; set difference empty in both directions).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the last shipped-runtime critical on this repo.
The vulnerability
maplibre-gl@5.24.0— XSS sanitizer bypass inDOM.sanitize()via Live NamedN... Vulnerable range requires6.14.0; there is no patch in 5.x.The change
maplibre-gl v6 removed the default export. Two files imported it as
maplibregland are now on named imports:src/components/MapContainer.ts—Mapis imported asMapLibreMap, because this module also uses the built-inMap(routeGroups = new Map<string, ...>) and a bareMapimport shadows it.NavigationControl,Popup,ScaleControl,GeoJSONSourcetake their plain names.src/config/basemap-styles.ts—addProtocolNo call-site behaviour changed; only the import form.
Verification
npm run typechecknpm run lintnpm run buildnpm auditOn the test suite
test:datareports 401 failures — the same 401mainreports. Both numbers are worth being precise about, because the naive reading is misleading:main, no buildmain, afternpm run buildnpm run build8 chunking/bundle-boundary assertions read build output from
dist/, so they only run meaningfully against a fresh build. Comparing like-for-like, this branch's failing set is identical tomain's — set difference in both directions is empty. The migration introduces no regressions.The 401 are pre-existing and unrelated; #23 has context. They should drop when the suite is burned down.
One thing I did not fix
tests/map-renderer-deferral.test.mjsassertsMapContainer.tsmust not statically importmaplibre-gl— the renderer is meant to load lazily via dynamic import. That invariant is already violated onmain, which is why it is among the 401. Fixing it properly means moving the maplibre import into the deferred renderer, which is a refactor rather than a dependency bump, and it is not what this PR should be doing.