rusackas commented on PR #42608: URL: https://github.com/apache/superset/pull/42608#issuecomment-5612969262
Update: the re-pin approach from my last comment was a bad idea. `maplibre-gl` 5.x is vulnerable to CVE-2026-85061 (CVSS 10, zero-click XSS), which is exactly what #44030 bumped to 6.8.0 to fix, so pinning `preset-chart-deckgl` back to 5.x just traded one bug for a much worse one. Went with the actual fix instead. deck.gl 9.4.0 ships a dedicated `@deck.gl/maplibre` package built against MapLibre's public API, so `preset-chart-deckgl` doesn't need a different `maplibre-gl` version from the rest of the frontend anymore. Bumped the whole deck.gl/luma.gl stack to `~9.4.0` and swapped `DeckGLOverlayMapLibre` over to it. Turned up a real packaging bug in the new package while I was in there... it ships ESM-only with no CJS build, unlike every other `@deck.gl/*` package, which broke Jest resolution until I patched around it in `jest.config.js`. Filing that upstream too. CI's green across the board now (jest, playwright, cypress, dependency-review, the works). Should be good for us to merge whenever. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
