Maurice 1696162d22 fix(deps): maplibre-gl 6.15.0 past the attribution sanitizer advisory ...

GHSA-jrc7-96c5-q579 covers every maplibre-gl up to 6.4.0 and has no 5.x
release, so npm audit kept flagging the patched 5.24.0. Moving to 6.15.0
retires the local backport: patch-maplibre.mjs and its postinstall,
predev and prebuild hooks go, along with the Dockerfile copy and its
format-baseline entry. 6.x sanitizes attributions against an allow list.

What the major changes for TREK:
- ESM only, no default export: the engine module imports the namespace
  and hands that out as its default, so every caller stays as it was.
- The worker is no longer inlined, and inside a bundle MapLibre cannot
  find it next to its own module. The engine sets it from Vite's
  ?worker&url build before any map, the Leaflet bridge's included.
- WebGL2 only: the probe asks for webgl2 alone, so a WebGL1-only browser
  gets the raster basemap instead of a GPUInitializationError.
- 6.9 shapes right-to-left text itself and deprecated setRTLTextPlugin;
  the old plugin would replace that and could only run through eval in
  the module worker, so MapLibre no longer registers it. Mapbox does.

The lockfile moves maplibre-gl and its own dependencies only; the
Leaflet bridge already allows ^6.0.0 as its peer.

2026-10-24 22:41:56 +00:00

..

mapbox.ts

fix(maps): register the RTL text plugin so Arabic labels join

2026-09-04 19:53:33 +02:00

maplibre.ts

fix(deps): maplibre-gl 6.15.0 past the attribution sanitizer advisory

2026-10-24 22:41:56 +00:00

rtlRegistration.test.ts

fix(deps): maplibre-gl 6.15.0 past the attribution sanitizer advisory

2026-10-24 22:41:56 +00:00