diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5d19024..d0a9e2c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,6 +54,10 @@ jobs: uses: actions/dependency-review-action@v5 with: fail-on-severity: high + # See pnpm-workspace.yaml for why maplibre-gl is held at 5.24.0 and + # why this advisory is not reachable in this app. Remove once + # react-map-gl renders with maplibre-gl >= 6.4.1. + allow-ghsas: GHSA-jrc7-96c5-q579 - run: pnpm build - run: pnpm exec playwright install --with-deps chromium - run: pnpm test:e2e --project=desktop-chromium diff --git a/package.json b/package.json index 758d402..c195ff6 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,7 @@ "jose": "^6.1.3", "lucide-react": "^0.562.0", "mapbox-gl": "^3.2.0", - "maplibre-gl": "^6.4.1", + "maplibre-gl": "5.24.0", "next": "16.3.4", "next-themes": "^0.4.6", "react": "19.2.8", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2c10b8d..776437b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -78,8 +78,8 @@ importers: specifier: ^3.2.0 version: 3.18.0 maplibre-gl: - specifier: ^6.4.1 - version: 6.4.1 + specifier: 5.24.0 + version: 5.24.0 next: specifier: 16.3.4 version: 16.3.4(@playwright/test@1.62.1)(@types/node@20.19.30)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) @@ -94,7 +94,7 @@ importers: version: 19.2.8(react@19.2.8) react-map-gl: specifier: ^8.1.3 - version: 8.1.3(mapbox-gl@3.18.0)(maplibre-gl@6.4.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + version: 8.1.3(mapbox-gl@3.18.0)(maplibre-gl@5.24.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) react-markdown: specifier: ^10.1.0 version: 10.1.0(@types/react@19.2.8)(react@19.2.8) @@ -645,9 +645,6 @@ packages: '@mapbox/vector-tile@2.0.4': resolution: {integrity: sha512-AkOLcbgGTdXScosBWwmmD7cDlvOjkg/DetGva26pIRiZPdeJYjYKarIlb4uxVzi6bwHO6EWH82eZ5Nuv4T5DUg==} - '@mapbox/vector-tile@3.0.0': - resolution: {integrity: sha512-Qf10S1uIHMk20ri/IVBnpS+esUEkVaR5Hftmz88jTInrpmWgPGJfPe3LVjjlE77trLx8tH6qjTG7uWH9hIq/0Q==} - '@mapbox/whoots-js@3.1.0': resolution: {integrity: sha512-Es6WcD0nO5l+2BOQS4uLfNPYQaNDfbot3X1XUoloz+x0mPDS3eeORZJl06HXjwBG1fOGwCRnzK88LMdxKRrd6Q==} engines: {node: '>=6.0.0'} @@ -659,8 +656,8 @@ packages: resolution: {integrity: sha512-cOZZOVhDSulgK0meTsTkmNXb1ahVvmTmWmfx9gRBwc6hq98wS9JP35ESIoNq3xqEan+UN+gn8187Z6E4NKhLsw==} hasBin: true - '@maplibre/maplibre-gl-style-spec@26.4.2': - resolution: {integrity: sha512-6J0vZqMZvRAJKtdWJdDGHEh1YJ2ZHG08/GOur8gCArYhO8ZkM//OXqtI2AAEz4jc2G+Wq4MfcePg8qNK5TZ4Kg==} + '@maplibre/maplibre-gl-style-spec@24.10.0': + resolution: {integrity: sha512-lichxSiagMEBBrqHF0trtMQH9RKh+9jUlIJl0qW0QHvt2H/tbvUWdE+ZzI2Jd0/pT7j/iavLonlPu7EQ/ixTOw==} hasBin: true '@maplibre/mlt@1.2.1': @@ -2545,8 +2542,8 @@ packages: mapbox-gl@3.18.0: resolution: {integrity: sha512-xMr9HUoof0qPqWrVNK+kLiPtU1ogyfR6cihGSTB4eQAzdfFuMTC7CPrbpbZK0oUKQxXI/1qvB35FXZIK7kfR9w==} - maplibre-gl@6.4.1: - resolution: {integrity: sha512-KzxQKtfBu/pSz1C+yW1hNS9eyj2h2lC7ufdAi6/SEt177n3oAfDfmUmslRfJdXY7ReAFBcnvwsqmiyoDhtA9GQ==} + maplibre-gl@5.24.0: + resolution: {integrity: sha512-ALyFxgtd5R+65UqZ/++lOqwWcC0SNho9c27fYSyLmG7AfnAul2o46F05aDJGPbFU57wos9dgcIySHs0Xe6ia3A==} engines: {node: '>=16.14.0', npm: '>=8.1.0'} markdown-table@3.0.4: @@ -3998,12 +3995,6 @@ snapshots: '@types/geojson': 7946.0.16 pbf: 4.0.1 - '@mapbox/vector-tile@3.0.0': - dependencies: - '@mapbox/point-geometry': 1.1.0 - '@types/geojson': 7946.0.16 - pbf: 5.1.2 - '@mapbox/whoots-js@3.1.0': {} '@maplibre/geojson-vt@6.1.1': @@ -4019,7 +4010,7 @@ snapshots: rw: 1.3.3 sort-object: 3.0.3 - '@maplibre/maplibre-gl-style-spec@26.4.2': + '@maplibre/maplibre-gl-style-spec@24.10.0': dependencies: '@mapbox/jsonlint-lines-primitives': 2.0.3 '@mapbox/unitbezier': 1.0.0 @@ -4729,13 +4720,13 @@ snapshots: optionalDependencies: mapbox-gl: 3.18.0 - '@vis.gl/react-maplibre@8.1.3(maplibre-gl@6.4.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)': + '@vis.gl/react-maplibre@8.1.3(maplibre-gl@5.24.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)': dependencies: '@maplibre/maplibre-gl-style-spec': 19.3.3 react: 19.2.8 react-dom: 19.2.8(react@19.2.8) optionalDependencies: - maplibre-gl: 6.4.1 + maplibre-gl: 5.24.0 '@vitest/expect@4.1.11': dependencies: @@ -5262,8 +5253,8 @@ snapshots: '@next/eslint-plugin-next': 16.3.4(eslint@9.39.2(jiti@1.21.7)) eslint: 9.39.2(jiti@1.21.7) eslint-import-resolver-node: 0.3.9 - eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)) - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)) + eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.2(jiti@1.21.7)) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.2(jiti@1.21.7)) eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.2(jiti@1.21.7)) eslint-plugin-react: 7.37.5(eslint@9.39.2(jiti@1.21.7)) eslint-plugin-react-hooks: 7.0.1(eslint@9.39.2(jiti@1.21.7)) @@ -5285,7 +5276,7 @@ snapshots: transitivePeerDependencies: - supports-color - eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)): + eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.2(jiti@1.21.7)): dependencies: '@nolyfill/is-core-module': 1.0.39 debug: 4.4.3 @@ -5296,22 +5287,22 @@ snapshots: tinyglobby: 0.2.17 unrs-resolver: 1.11.1 optionalDependencies: - eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)) + eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.2(jiti@1.21.7)) transitivePeerDependencies: - supports-color - eslint-module-utils@2.12.1(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)): + eslint-module-utils@2.12.1(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.2(jiti@1.21.7)): dependencies: debug: 3.2.7 optionalDependencies: '@typescript-eslint/parser': 8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3) eslint: 9.39.2(jiti@1.21.7) eslint-import-resolver-node: 0.3.9 - eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)) + eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.2(jiti@1.21.7)) transitivePeerDependencies: - supports-color - eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)): + eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.2(jiti@1.21.7)): dependencies: '@rtsao/scc': 1.1.0 array-includes: 3.1.9 @@ -5322,7 +5313,7 @@ snapshots: doctrine: 2.1.0 eslint: 9.39.2(jiti@1.21.7) eslint-import-resolver-node: 0.3.9 - eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)))(eslint@9.39.2(jiti@1.21.7)) + eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.53.0(eslint@9.39.2(jiti@1.21.7))(typescript@5.9.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.2(jiti@1.21.7)) hasown: 2.0.2 is-core-module: 2.16.1 is-glob: 4.0.3 @@ -5962,14 +5953,16 @@ snapshots: supercluster: 8.0.1 tinyqueue: 3.0.0 - maplibre-gl@6.4.1: + maplibre-gl@5.24.0: dependencies: + '@mapbox/jsonlint-lines-primitives': 2.0.3 '@mapbox/point-geometry': 1.1.0 '@mapbox/tiny-sdf': 2.2.0 - '@mapbox/unitbezier': 1.0.0 - '@mapbox/vector-tile': 3.0.0 + '@mapbox/unitbezier': 0.0.1 + '@mapbox/vector-tile': 2.0.4 + '@mapbox/whoots-js': 3.1.0 '@maplibre/geojson-vt': 6.1.1 - '@maplibre/maplibre-gl-style-spec': 26.4.2 + '@maplibre/maplibre-gl-style-spec': 24.10.0 '@maplibre/mlt': 1.2.1 '@maplibre/vt-pbf': 4.3.2 '@types/geojson': 7946.0.16 @@ -5977,7 +5970,7 @@ snapshots: gl-matrix: 3.4.4 kdbush: 4.1.0 murmurhash-js: 1.0.0 - pbf: 5.1.2 + pbf: 4.0.1 potpack: 2.1.0 quickselect: 3.0.0 tinyqueue: 3.0.0 @@ -6607,15 +6600,15 @@ snapshots: react-is@16.13.1: {} - react-map-gl@8.1.3(mapbox-gl@3.18.0)(maplibre-gl@6.4.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): + react-map-gl@8.1.3(mapbox-gl@3.18.0)(maplibre-gl@5.24.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8): dependencies: '@vis.gl/react-mapbox': 8.1.3(mapbox-gl@3.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) - '@vis.gl/react-maplibre': 8.1.3(maplibre-gl@6.4.1)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + '@vis.gl/react-maplibre': 8.1.3(maplibre-gl@5.24.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) react: 19.2.8 react-dom: 19.2.8(react@19.2.8) optionalDependencies: mapbox-gl: 3.18.0 - maplibre-gl: 6.4.1 + maplibre-gl: 5.24.0 react-markdown@10.1.0(@types/react@19.2.8)(react@19.2.8): dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 46e22d5..76a7dc6 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,3 +1,20 @@ minimumReleaseAgeExclude: - next@16.3.4 - eslint-config-next@16.3.4 + +# maplibre-gl is pinned to 5.24.0 because react-map-gl v8 (@vis.gl/react-maplibre) +# cannot render with maplibre-gl 6.x: the map constructs, but the style never +# finishes loading, so no basemap tiles are ever requested. Verified across +# react-map-gl 8.0.4/8.1.3 x maplibre 6.4.1/6.9.0; 4.7.1 and 5.24.0 both render. +# +# CVE-2026-85061 (GHSA-jrc7-96c5-q579) affects maplibre-gl <= 6.4.0, so 5.24.0 +# carries it. It is an XSS sanitizer bypass in DOM.sanitize(), which requires +# untrusted HTML to reach maplibre's sanitizer. This app has no Popup, +# setHTML, setDOMContent or dangerouslySetInnerHTML anywhere near the map; the +# only HTML surface is the built-in attribution control with static strings. +# +# REMOVE THIS IGNORE once react-map-gl renders with maplibre-gl >= 6.4.1. +# Tracking: https://github.com/visgl/react-map-gl (no upstream issue yet) +auditConfig: + ignoreCves: + - CVE-2026-85061