dependabot[bot] opened a new pull request, #44030: URL: https://github.com/apache/superset/pull/44030
Bumps the security group with 3 updates in the /superset-frontend directory: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js), [joi](https://github.com/hapijs/joi) and [svgo](https://github.com/svg/svgo). Updates `maplibre-gl` from 5.24.0 to 6.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/maplibre/maplibre-gl-js/releases";>maplibre-gl's releases</a>.</em></p> <blockquote> <h2>v6.8.0</h2> <h3>✨ Features and improvements</h3> <ul> <li>Add <code>map.getStyleUrl()</code>, which returns the URL the style was loaded from, or <code>null</code> when the style was given as an object (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/7109";>#7109</a>) (by <a href="https://github.com/bradymadden97";><code>@bradymadden97</code></a> and <a href="https://github.com/giswqs";><code>@giswqs</code></a>)</li> <li>Sample terrain render-to-texture output through mipmaps with trilinear filtering, so draped layers stop shimmering and aliasing at high pitch (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8328";>#8328</a>, continues <a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/7673";>#7673</a>) (by <a href="https://github.com/AveryanAlex";><code>@AveryanAlex</code></a>)</li> <li>Build the <code>Intl.Segmenter</code> instances used for text shaping on first use instead of at import, shaving several milliseconds off loading MapLibre on the main thread (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8337";>#8337</a>) (by <a href="https://github.com/cherenkov";><code>@cherenkov</code></a>)</li> <li>Link shader programs before reading their compile status, so the driver can overlap the compiles and the main thread waits less on shader compilation (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8338";>#8338</a>) (by <a href="https://github.com/cherenkov";><code>@cherenkov</code></a>)</li> <li>Build the default <code>Marker</code> pin once and clone it per marker, so creating many default markers takes roughly half the constructor time (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8340";>#8340</a>) (by <a href="https://github.com/cherenkov";><code>@cherenkov</code></a>)</li> <li>Add SDF rendering support for fill patterns, using <code>fill-color</code> as the foreground color (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/7747";>#7747</a>) (by <a href="https://github.com/bradymadden97";><code>@bradymadden97</code></a> and <a href="https://github.com/deniial00";><code>@deniial00</code></a>)</li> <li>Warn once when the canvas is clamped to <code>maxCanvasSize</code>, which previously lowered the rendered resolution silently (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8200";>#8200</a>) (by <a href="https://github.com/str0kes";><code>@str0kes</code></a>)</li> </ul> <h3>🐞 Bug fixes</h3> <ul> <li>Fix a marker's popup jumping to another world copy when the marker is moved across the antimeridian on a zoomed-out map (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5655";>#5655</a>, <a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8326";>#8326</a>, continues <a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/5956";>#5956</a>) (by <a href="https://github.com/yuiseki";><code>@yuiseki</code></a>)</li> <li>Fix terrain drape textures not being refreshed after zoom changes, causing stale rendering at the new zoom level (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8251";>#8251</a>) (by <a href="https://github.com/patte";><code>@patte</code></a>)</li> <li>Fix a gap between the sky and the ground at high pitch while globe transitions to mercator (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/7382";>#7382</a>) (by <a href="https://github.com/birkskyum";><code>@birkskyum</code></a>)</li> <li>Treat an empty tile response (e.g. HTTP 204) as no data: raster-DEM tiles now load without elevation instead of failing with a <code>dem dimension mismatch</code> error, and empty raster tiles render as transparent (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/1551";>#1551</a>) (by <a href="https://github.com/clement-igonet";><code>@clement-igonet</code></a>)</li> <li>Validate the <code>before</code> layer in <code>map.moveLayer</code> before reordering, so passing the id of a layer that does not exist leaves the layer order untouched instead of dropping the moved layer out of it (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8301";>#8301</a>) (by <a href="https://github.com/lazerg";><code>@lazerg</code></a>)</li> <li>Fix visible seams between hillshade tiles when using linear interpolation. (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8302";>#8302</a>) (by <a href="https://github.com/Turbo87";><code>@Turbo87</code></a>)</li> <li>Fix the map freezing when a render task throws an error (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/6093";>#6093</a>) (by <a href="https://github.com/UberMouse";><code>@UberMouse</code></a>)</li> <li>Fix <code>getCameraAltitude()</code> returning <code>NaN</code> under <code>globe</code> and <code>vertical-perspective</code>, which disabled marker terrain occlusion and the camera terrain check; the altitude now follows the sphere (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/6584";>#6584</a>) (by <a href="https://github.com/bigmistqke";><code>@bigmistqke</code></a> and <a href="https://github.com/patte";><code>@patte</code></a>)</li> <li>Draw an elevated symbol on globe when the symbol itself is in view but the ground under it is behind the horizon; occlusion now follows the line of sight to the elevated point (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8253";>#8253</a>) (by <a href="https://github.com/clement-igonet";><code>@clement-igonet</code></a>)</li> <li>Fix <code>setTiles</code> producing stale tile URLs when <code>loadTile</code> runs in the same frame (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8323";>#8323</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a> and <a href="https://github.com/nostrorom";><code>@nostrorom</code></a>)</li> <li>Keep the tile under an elevated symbol from being culled near the horizon, so a symbol with a large <code>symbol-height-offset</code> stays visible until it is behind the planet (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8316";>#8316</a>) (by <a href="https://github.com/clement-igonet";><code>@clement-igonet</code></a>)</li> </ul> <h2>v6.7.0</h2> <h3>✨ Features and improvements</h3> <ul> <li>Support the style specification's <code>font-faces</code> property, with <code>map.setFontFaces</code> and <code>map.getFontFaces</code> and improve complex script languages such as Devanagari, Khmer, Burmese and Hebrew (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8237";>#8237</a>) (by <a href="https://github.com/HarelM";><code>@HarelM</code></a>)</li> <li>Wrap Thai, Khmer, Burmese, Lao, Tibetan, Javanese and Balinese labels at word boundaries instead of running them on in one line, which applies to every style whether or not it declares <code>font-faces</code> (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8237";>#8237</a>) (by <a href="https://github.com/HarelM";><code>@HarelM</code></a>)</li> <li>Throw <code>GPUInitializationError</code> from the <code>Map</code> constructor when the WebGL2 context cannot be created, instead of firing an <code>error</code> event no listener can catch and returning a partially constructed map (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8066";>#8066</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Allow adding an image source without a <code>url</code>. The source starts empty and makes no network request; call <code>updateImage({image})</code> or <code>updateImage({url})</code> later to show an image (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8167";>#8167</a>) (by <a href="https://github.com/mondsichtung";><code>@mondsichtung</code></a>)</li> <li>Skip symbol re-placement when its inputs are unchanged, so repaints from animated style images or custom layers cost a single frame (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8208";>#8208</a>) (by <a href="https://github.com/lucaswoj";><code>@lucaswoj</code></a>)</li> <li>Add <code>Style#triggerSymbolPlacement</code>, which re-places symbols when something the map cannot see for itself has moved them (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8208";>#8208</a>) (by <a href="https://github.com/lucaswoj";><code>@lucaswoj</code></a>)</li> <li>Make <code>{validate: false}</code> skip the style snapshot the style setters only build as error context, so adding layers one at a time no longer serializes the whole style on every call (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8259";>#8259</a>) (by <a href="https://github.com/lazerg";><code>@lazerg</code></a>)</li> </ul> <h3>🐞 Bug fixes</h3> <ul> <li>Disable the navigation control's zoom-out button when viewport constraints prevent zooming out further (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5316";>#5316</a>) (by <a href="https://github.com/miakh";><code>@miakh</code></a>)</li> <li>Keep a vector tile's etag when the tile is reloaded after a style change, so the next expiry refresh can still skip unchanged tiles (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/3309";>#3309</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Fix <code>project()</code> and <code>queryTerrainElevation</code> disagreeing with the rendered terrain surface when the elevation lookup sampled a different DEM zoom than the drawn mesh (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8212";>#8212</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Draw numbers (e.g. “21” in “반포대로21길”) and short uppercase codes (e.g. “A1”) upright in vertical line labels instead of rotating them along the line (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5404";>#5404</a>) (by <a href="https://github.com/NEKOYASAN";><code>@NEKOYASAN</code></a>)</li> <li>Fix the camera jumping at the end of a pan or zoom gesture on terrain by sampling the center elevation from the rendered terrain surface (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/7989";>#7989</a>, <a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/3982";>#3982</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Ensure style state defaults are serialized (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8263";>#8263</a>) (by <a href="https://github.com/hiddewie";><code>@hiddewie</code></a>)</li> </ul> <h2>v6.6.0</h2> <h3>✨ Features and improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md";>maplibre-gl's changelog</a>.</em></p> <blockquote> <h2>6.8.0</h2> <h3>✨ Features and improvements</h3> <ul> <li>Add <code>map.getStyleUrl()</code>, which returns the URL the style was loaded from, or <code>null</code> when the style was given as an object (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/7109";>#7109</a>) (by <a href="https://github.com/bradymadden97";><code>@bradymadden97</code></a> and <a href="https://github.com/giswqs";><code>@giswqs</code></a>)</li> <li>Sample terrain render-to-texture output through mipmaps with trilinear filtering, so draped layers stop shimmering and aliasing at high pitch (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8328";>#8328</a>, continues <a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/7673";>#7673</a>) (by <a href="https://github.com/AveryanAlex";><code>@AveryanAlex</code></a>)</li> <li>Build the <code>Intl.Segmenter</code> instances used for text shaping on first use instead of at import, shaving several milliseconds off loading MapLibre on the main thread (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8337";>#8337</a>) (by <a href="https://github.com/cherenkov";><code>@cherenkov</code></a>)</li> <li>Link shader programs before reading their compile status, so the driver can overlap the compiles and the main thread waits less on shader compilation (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8338";>#8338</a>) (by <a href="https://github.com/cherenkov";><code>@cherenkov</code></a>)</li> <li>Build the default <code>Marker</code> pin once and clone it per marker, so creating many default markers takes roughly half the constructor time (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8340";>#8340</a>) (by <a href="https://github.com/cherenkov";><code>@cherenkov</code></a>)</li> <li>Add SDF rendering support for fill patterns, using <code>fill-color</code> as the foreground color (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/7747";>#7747</a>) (by <a href="https://github.com/bradymadden97";><code>@bradymadden97</code></a> and <a href="https://github.com/deniial00";><code>@deniial00</code></a>)</li> <li>Warn once when the canvas is clamped to <code>maxCanvasSize</code>, which previously lowered the rendered resolution silently (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8200";>#8200</a>) (by <a href="https://github.com/str0kes";><code>@str0kes</code></a>)</li> </ul> <h3>🐞 Bug fixes</h3> <ul> <li>Fix a marker's popup jumping to another world copy when the marker is moved across the antimeridian on a zoomed-out map (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5655";>#5655</a>, <a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8326";>#8326</a>, continues <a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/5956";>#5956</a>) (by <a href="https://github.com/yuiseki";><code>@yuiseki</code></a>)</li> <li>Fix terrain drape textures not being refreshed after zoom changes, causing stale rendering at the new zoom level (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8251";>#8251</a>) (by <a href="https://github.com/patte";><code>@patte</code></a>)</li> <li>Fix a gap between the sky and the ground at high pitch while globe transitions to mercator (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/7382";>#7382</a>) (by <a href="https://github.com/birkskyum";><code>@birkskyum</code></a>)</li> <li>Treat an empty tile response (e.g. HTTP 204) as no data: raster-DEM tiles now load without elevation instead of failing with a <code>dem dimension mismatch</code> error, and empty raster tiles render as transparent (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/1551";>#1551</a>) (by <a href="https://github.com/clement-igonet";><code>@clement-igonet</code></a>)</li> <li>Validate the <code>before</code> layer in <code>map.moveLayer</code> before reordering, so passing the id of a layer that does not exist leaves the layer order untouched instead of dropping the moved layer out of it (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8301";>#8301</a>) (by <a href="https://github.com/lazerg";><code>@lazerg</code></a>)</li> <li>Fix visible seams between hillshade tiles when using linear interpolation. (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8302";>#8302</a>) (by <a href="https://github.com/Turbo87";><code>@Turbo87</code></a>)</li> <li>Fix the map freezing when a render task throws an error (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/6093";>#6093</a>) (by <a href="https://github.com/UberMouse";><code>@UberMouse</code></a>)</li> <li>Fix <code>getCameraAltitude()</code> returning <code>NaN</code> under <code>globe</code> and <code>vertical-perspective</code>, which disabled marker terrain occlusion and the camera terrain check; the altitude now follows the sphere (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/6584";>#6584</a>) (by <a href="https://github.com/bigmistqke";><code>@bigmistqke</code></a> and <a href="https://github.com/patte";><code>@patte</code></a>)</li> <li>Draw an elevated symbol on globe when the symbol itself is in view but the ground under it is behind the horizon; occlusion now follows the line of sight to the elevated point (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8253";>#8253</a>) (by <a href="https://github.com/clement-igonet";><code>@clement-igonet</code></a>)</li> <li>Fix <code>setTiles</code> producing stale tile URLs when <code>loadTile</code> runs in the same frame (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8323";>#8323</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a> and <a href="https://github.com/nostrorom";><code>@nostrorom</code></a>)</li> <li>Keep the tile under an elevated symbol from being culled near the horizon, so a symbol with a large <code>symbol-height-offset</code> stays visible until it is behind the planet (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8316";>#8316</a>) (by <a href="https://github.com/clement-igonet";><code>@clement-igonet</code></a>)</li> </ul> <h2>6.7.0</h2> <h3>✨ Features and improvements</h3> <ul> <li>Support the style specification's <code>font-faces</code> property, with <code>map.setFontFaces</code> and <code>map.getFontFaces</code> and improve complex script languages such as Devanagari, Khmer, Burmese and Hebrew (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8237";>#8237</a>) (by <a href="https://github.com/HarelM";><code>@HarelM</code></a>)</li> <li>Wrap Thai, Khmer, Burmese, Lao, Tibetan, Javanese and Balinese labels at word boundaries instead of running them on in one line, which applies to every style whether or not it declares <code>font-faces</code> (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8237";>#8237</a>) (by <a href="https://github.com/HarelM";><code>@HarelM</code></a>)</li> <li>Throw <code>GPUInitializationError</code> from the <code>Map</code> constructor when the WebGL2 context cannot be created, instead of firing an <code>error</code> event no listener can catch and returning a partially constructed map (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8066";>#8066</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Allow adding an image source without a <code>url</code>. The source starts empty and makes no network request; call <code>updateImage({image})</code> or <code>updateImage({url})</code> later to show an image (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8167";>#8167</a>) (by <a href="https://github.com/mondsichtung";><code>@mondsichtung</code></a>)</li> <li>Skip symbol re-placement when its inputs are unchanged, so repaints from animated style images or custom layers cost a single frame (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8208";>#8208</a>) (by <a href="https://github.com/lucaswoj";><code>@lucaswoj</code></a>)</li> <li>Add <code>Style#triggerSymbolPlacement</code>, which re-places symbols when something the map cannot see for itself has moved them (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8208";>#8208</a>) (by <a href="https://github.com/lucaswoj";><code>@lucaswoj</code></a>)</li> <li>Make <code>{validate: false}</code> skip the style snapshot the style setters only build as error context, so adding layers one at a time no longer serializes the whole style on every call (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8259";>#8259</a>) (by <a href="https://github.com/lazerg";><code>@lazerg</code></a>)</li> </ul> <h3>🐞 Bug fixes</h3> <ul> <li>Disable the navigation control's zoom-out button when viewport constraints prevent zooming out further (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5316";>#5316</a>) (by <a href="https://github.com/miakh";><code>@miakh</code></a>)</li> <li>Keep a vector tile's etag when the tile is reloaded after a style change, so the next expiry refresh can still skip unchanged tiles (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/3309";>#3309</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Fix <code>project()</code> and <code>queryTerrainElevation</code> disagreeing with the rendered terrain surface when the elevation lookup sampled a different DEM zoom than the drawn mesh (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8212";>#8212</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Draw numbers (e.g. “21” in “반포대로21길”) and short uppercase codes (e.g. “A1”) upright in vertical line labels instead of rotating them along the line (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/5404";>#5404</a>) (by <a href="https://github.com/NEKOYASAN";><code>@NEKOYASAN</code></a>)</li> <li>Fix the camera jumping at the end of a pan or zoom gesture on terrain by sampling the center elevation from the rendered terrain surface (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/7989";>#7989</a>, <a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/3982";>#3982</a>) (by <a href="https://github.com/johncarmack1984";><code>@johncarmack1984</code></a>)</li> <li>Ensure style state defaults are serialized (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/pull/8263";>#8263</a>) (by <a href="https://github.com/hiddewie";><code>@hiddewie</code></a>)</li> </ul> <h2>6.6.0</h2> <h3>✨ Features and improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/9df21da874e49ee4943aecb3350db9dfd98e7d1b";><code>9df21da</code></a> Bump js version to 6.8.0 (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8371";>#8371</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/05302adadc681543ee15ff60290bb70b8348a978";><code>05302ad</code></a> fix: compute pixelsPerMeter in the transform helper so getCameraAltitude() wo...</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/cf1781cb5ea3af00f9f9665649431d89ebd0856e";><code>cf1781c</code></a> test: serve the browser tests' tiles and styles from local fixtures (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8367";>#8367</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/055db89755ae902f4a1840308b270bc0313b0784";><code>055db89</code></a> refactor: unify bucket dependency finalization through addFeatures (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8347";>#8347</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/045a3ce58615fcb0ac155ac309bf9dbf23d1cbd6";><code>045a3ce</code></a> Warn when the canvas is clamped to maxCanvasSize (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8275";>#8275</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/d2d0371abacb40e6b8f3136af1eba5e93deecdb1";><code>d2d0371</code></a> Keep tiles under elevated symbols from being culled near the horizon (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8319";>#8319</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/0b33607be5d0ac25844696a7ba2eac1d8ea9dfe3";><code>0b33607</code></a> chore(deps-dev): bump puppeteer from 25.9.0 to 25.10.0 (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8359";>#8359</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/86d30b0234131b16d1b77681c946be53f88dc91a";><code>86d30b0</code></a> chore(deps-dev): bump devtools-protocol from 0.0.1687809 to 0.0.1692173 (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8354";>#8354</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/9a0884f180d7f591323183ff6694af0a2805803e";><code>9a0884f</code></a> chore(deps-dev): bump cspell from 10.2.0 to 10.2.1 (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8360";>#8360</a>)</li> <li><a href="https://github.com/maplibre/maplibre-gl-js/commit/3d42c642babf9d31d8fea3967f62c78d1facc2c5";><code>3d42c64</code></a> chore(deps-dev): bump postcss from 8.5.26 to 8.5.28 (<a href="https://redirect.github.com/maplibre/maplibre-gl-js/issues/8362";>#8362</a>)</li> <li>Additional commits viewable in <a href="https://github.com/maplibre/maplibre-gl-js/compare/v5.24.0...v6.8.0";>compare view</a></li> </ul> </details> <br /> Updates `joi` from 17.13.4 to 17.13.7 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hapijs/joi/commit/ed9d7cdd11ef5f7751fd46886f38dc605c9c3995";><code>ed9d7cd</code></a> 17.13.7</li> <li><a href="https://github.com/hapijs/joi/commit/f2729f71839c57c94ac500b4be9e4b5b26d4e637";><code>f2729f7</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3145";>#3145</a> from hapijs/backport/isodate-timeshift-v17</li> <li><a href="https://github.com/hapijs/joi/commit/c43fc964799c9b5f0c6921bf788162b67066ae81";><code>c43fc96</code></a> chore: add regression test for <a href="https://redirect.github.com/hapijs/joi/issues/3143";>#3143</a></li> <li><a href="https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec";><code>115e7b5</code></a> fix(isoDate): pad a bare-hour timeshift with a colon, not just zeros</li> <li><a href="https://github.com/hapijs/joi/commit/850be1ee24be8d548bb09359bdb0cf9fe41635ff";><code>850be1e</code></a> 17.13.6</li> <li><a href="https://github.com/hapijs/joi/commit/9faeecc48b18ec40e3881467645ae9074f0dfa3c";><code>9faeecc</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3139";>#3139</a> from hapijs/chore/backport-messages-proto</li> <li><a href="https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36";><code>8d0b808</code></a> fix: prevent messages proto injection</li> <li><a href="https://github.com/hapijs/joi/commit/566e73fa58e72f0a1dcbb3b110ee2f49f33aece3";><code>566e73f</code></a> 17.13.5</li> <li><a href="https://github.com/hapijs/joi/commit/3f3907cd944257e143b22f3bf3f05e71478fa1b1";><code>3f3907c</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3135";>#3135</a> from hapijs/chore/backport-rename-proto</li> <li><a href="https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01";><code>172ecec</code></a> fix: prevent proto on renames</li> <li>Additional commits viewable in <a href="https://github.com/hapijs/joi/compare/v17.13.4...v17.13.7";>compare view</a></li> </ul> </details> <br /> Updates `joi` from 18.2.3 to 18.2.8 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hapijs/joi/commit/ed9d7cdd11ef5f7751fd46886f38dc605c9c3995";><code>ed9d7cd</code></a> 17.13.7</li> <li><a href="https://github.com/hapijs/joi/commit/f2729f71839c57c94ac500b4be9e4b5b26d4e637";><code>f2729f7</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3145";>#3145</a> from hapijs/backport/isodate-timeshift-v17</li> <li><a href="https://github.com/hapijs/joi/commit/c43fc964799c9b5f0c6921bf788162b67066ae81";><code>c43fc96</code></a> chore: add regression test for <a href="https://redirect.github.com/hapijs/joi/issues/3143";>#3143</a></li> <li><a href="https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec";><code>115e7b5</code></a> fix(isoDate): pad a bare-hour timeshift with a colon, not just zeros</li> <li><a href="https://github.com/hapijs/joi/commit/850be1ee24be8d548bb09359bdb0cf9fe41635ff";><code>850be1e</code></a> 17.13.6</li> <li><a href="https://github.com/hapijs/joi/commit/9faeecc48b18ec40e3881467645ae9074f0dfa3c";><code>9faeecc</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3139";>#3139</a> from hapijs/chore/backport-messages-proto</li> <li><a href="https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36";><code>8d0b808</code></a> fix: prevent messages proto injection</li> <li><a href="https://github.com/hapijs/joi/commit/566e73fa58e72f0a1dcbb3b110ee2f49f33aece3";><code>566e73f</code></a> 17.13.5</li> <li><a href="https://github.com/hapijs/joi/commit/3f3907cd944257e143b22f3bf3f05e71478fa1b1";><code>3f3907c</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3135";>#3135</a> from hapijs/chore/backport-rename-proto</li> <li><a href="https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01";><code>172ecec</code></a> fix: prevent proto on renames</li> <li>Additional commits viewable in <a href="https://github.com/hapijs/joi/compare/v17.13.4...v17.13.7";>compare view</a></li> </ul> </details> <br /> Updates `svgo` from 3.3.4 to 3.3.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/svg/svgo/releases";>svgo's releases</a>.</em></p> <blockquote> <h2>v3.3.5</h2> <h2>What's Changed</h2> <h3>Security</h3> <ul> <li>Backport the <code>removeScriptElement</code> hardening from SVGO v4 in <a href="https://redirect.github.com/svg/svgo/issues/2269";>#2269</a>: <ul> <li>reject executable <code>data:</code> URLs and legacy <code>vbscript:</code> URLs</li> <li>sanitize executable HTML inside <code><foreignObject></code> elements</li> <li>handle namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines</li> </ul> </li> </ul> <p>This addresses <a href="https://github.com/svg/svgo/security/advisories/GHSA-4vpr-x523-8j87";>GHSA-4vpr-x523-8j87</a> and <a href="https://github.com/svg/svgo/security/advisories/GHSA-w27v-7q3p-w38r";>GHSA-w27v-7q3p-w38r</a> for the v3 release line.</p> <h2>Support</h2> <p>SVGO v3 is not officially supported; please consider upgrading to SVGO v4. This security fix has been backported, but there is no commitment to backport more complex changes in the future.</p> <p>See the <a href="https://svgo.dev/docs/migrations/migration-from-v3-to-v4/";>migration guide from v3 to v4</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/svg/svgo/commit/438059032950dde2c2d36ce45f912085947e60d0";><code>4380590</code></a> ci: configure v3 publish tag in package metadata (<a href="https://redirect.github.com/svg/svgo/issues/2271";>#2271</a>)</li> <li><a href="https://github.com/svg/svgo/commit/4c84fe7ef022f05350404a469ca66321e0afcb47";><code>4c84fe7</code></a> ci: publish v3 with npm trusted publishing (<a href="https://redirect.github.com/svg/svgo/issues/2270";>#2270</a>)</li> <li><a href="https://github.com/svg/svgo/commit/994a9f00d79ddec68ce19a1ce9eb8ca08d747e4f";><code>994a9f0</code></a> fix(removeScriptElement): backport security hardening to v3 (<a href="https://redirect.github.com/svg/svgo/issues/2269";>#2269</a>)</li> <li>See full diff in <a href="https://github.com/svg/svgo/compare/v3.3.4...v3.3.5";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for svgo since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/superset/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
