[BUG]: critical CVE in maplibre-gl, please update to version 6

[jendrikw]

Description

maplibre-gl has a critical secutiry vulnerability, which affects versions <= 6.4.0.

https://nvd.nist.gov/vuln/detail/cve-2026-85061
GHSA-jrc7-96c5-q579

Steps to reproduce

npm i plotly.js

Notes

They don't want to backport the fix (maplibre/maplibre-gl-js#8384 (comment))

Alternatives

Maybe maplibre-gl could be an optional dependency?

[camdecoster]

Thanks for letting us know! I'll look into upgrading, but this one might be difficult as v6 went ESM only.