[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
maplibre-gl (source)	6.3.0 → 6.4.1
maplibre-gl (source)	^6.3.0 → ^6.4.1

These land in the published bundle (map0-viewer). Check the page-tier line of pnpm size in the CI log, and the smoke and visual steps.

MapLibre is copied into dist as three files (docs/09 §3.1) and is an optional peer of map0-viewer. On a major, run pnpm build:npm && node e2e/verify-types.mjs as well.

---

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

CVE-2026-85061 / GHSA-jrc7-96c5-q579

More information

Details

Impact

DOM.sanitize() in src/util/dom.ts iterated elem.attributes (a live NamedNodeMap) while calling elem.removeAttribute() in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute.

An attacker can provide an HTML payload with consecutive dangerous attributes (such as <details open onload="1" ontoggle="...">). The first attribute is stripped while the second survives and executes upon insertion into innerHTML via the attribution control without requiring user interaction (zero-click XSS).

Applications rendering untrusted/third-party style attribution strings or user-supplied custom attributions are impacted.

Patches

The issue has been resolved by creating a static snapshot of attributes using Array.from(elem.attributes) before iteration. Please upgrade to maplibre-gl version 6.4.1 (or latest).

Workarounds

Sanitizing the attribute field of a source before passing it down to maplibre

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

• https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579
• https://nvd.nist.gov/vuln/detail/CVE-2026-85061
• https://github.com/maplibre/maplibre-gl-js/pull/8189
• https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27
• https://github.com/maplibre/maplibre-gl-js
• https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

maplibre/maplibre-gl-js (maplibre-gl)

v6.4.1

Compare Source

🐞 Bug fixes

• Fix DOM.sanitize leaving dangerous attributes behind when multiple consecutive attributes are present. Iterating the live NamedNodeMap from elem.attributes while calling removeAttribute skipped the attribute directly after a removed one, so a second dangerous attribute (for example an ontoggle on a <details open> element) could survive sanitisation and later execute (#​8189) (by @​0xKirisame)
• Give custom layers the live globe transition in CustomRenderMethodInput.defaultProjectionData.projectionTransition, which was hardcoded to 1 for the whole globe/mercator transition, so a custom layer jumped straight to the fully bent globe while every other layer eased (#​8169) (by @​mondsichtung)

v6.4.0

Compare Source

✨ Features and improvements

• Avoid a per-query Array.sort() in cross-tile symbol matching (TileLayerIndex.findMatches), claiming the lowest-index unclaimed candidate in a single pass instead; reduces main-thread symbol-placement cost on dense/coincident symbol layers (#​7797) (by @​pholmstr)
• Use texelFetch for exact DEM and color-relief elevation stop lookups instead of normalized texture coordinate arithmetic (#​7640) (by @​johncarmack1984)
• Make default draggable markers keyboard-focusable and movable with the arrow keys (1 px per press, 10 px with Shift); custom marker elements stay application-owned (#​8020) (by @​smmariquit)

🐞 Bug fixes

• Fix a permanent frame rate degradation after switching styles: every sprite reload marked its images as updated forever, making every in-view tile re-check and re-upload them on every frame. Also stop leaking the images of a replaced sprite, which were never removed from the image manager (#​8052) (by @​HarelM)
• Prevent a rejected missing style image resolver from blocking successfully resolved images in the same batch (#​8146) (by @​birkskyum)
• Explicitly request no browser color management when decoding raster-DEM tiles so their RGB-encoded elevation values are not changed (what would otherwise happen with gfx.color_management.mode = 1 in Firefox) (#​8125) (by @​tnikkel)
• Let an abort reach an image or raster tile load that is still awaiting its transformRequest, so ImageSource.updateImage no longer loses the image it was just handed and an aborted tile is no longer fetched (#​8071) (by @​mondsichtung)
• Fix raster tiles fading in again when they are reloaded, briefly flashing the map background, most visibly when switching projection (#​8106) (by @​mondsichtung)
• Fix globe panning inverting and stalling near and across the poles by rotating the globe with a versor, keeping the drag direction consistent at every latitude. Panning also eases off as the cursor approaches the edge of the globe and continues past it, instead of stopping. The bearing is preserved while panning, as before (#​5296) (by @​jcolot)
• Fix fill-extrusion-rounded-corner-distance producing spikes: corner arcs now land on the integer tile grid, and corners created by tile clipping are left sharp (#​8153) (by @​HarelM)
• Fix a gesture which was held still before being released still flinging the map (#​1303) (by @​zdila)

---

Configuration

📅 Schedule: (in timezone Europe/Vienna)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.