From 29cf3f1a9763c94675135df14b130df526526377 Mon Sep 17 00:00:00 2001 From: Nitish Reddy M Date: Mon, 24 Aug 2026 00:28:40 -0400 Subject: [PATCH 01/20] fix(desktop): open default browser on startup (#2095) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #934 ## Summary The Go desktop binary started its local server and printed the URL, but never opened a browser automatically. This PR: - opens the default browser after the listener successfully binds - uses the actual runtime URL - uses a stdlib-only cross-platform launcher - keeps browser-open failures non-fatal - adds `--no-browser` for headless/Docker use - leaves the normal Vite/web development flow unchanged The listener is created before launching the browser so the browser cannot race the server startup path. ## Platform behavior - Windows: `rundll32 url.dll,FileProtocolHandler` - macOS: `open` - Linux: `xdg-open` No shell command strings are used; arguments are passed directly through `exec.Command`. ## Testing - `go test ./...` - `go vet ./...` - `go build ./...` - `git diff --check` - repeated manual Windows startup verification (3 clean runs, confirmed the browser opened and hit the server, no duplicate launches) - `--no-browser` verification (confirmed no launch attempt occurs) - non-fatal launcher failure covered by a unit test that injects a nonexistent opener binary macOS/Linux launch paths were not runtime-tested on this Windows machine — they follow the standard `open`/`xdg-open` convention used across other Go CLIs but are unverified here. The full packaged release flow (`gox`, `go.rice`, `go-winres`) was not exercised locally. --- CHANGELOG.md | 1 + desktop/go.mod | 9 ++------- desktop/go.sum | 11 ++++------- desktop/maputnik.go | 28 ++++++++++++++++++++++++++-- 4 files changed, 33 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b28beb7d..7194e6a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ ### 🐞 Bug fixes - The map's data listener now fires on tile loads again, so source and vector layer field autocompletion is populated +- The `maputnik` desktop binary now opens the default browser automatically on startup (opt out with `--no-browser`) - _...Add new stuff here..._ ## 3.1.0 diff --git a/desktop/go.mod b/desktop/go.mod index 2ef268ab..ea11c272 100644 --- a/desktop/go.mod +++ b/desktop/go.mod @@ -9,19 +9,14 @@ require ( github.com/gorilla/mux v1.8.0 github.com/gorilla/websocket v1.5.0 github.com/maputnik/desktop v1.0.7 + github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c github.com/urfave/cli v1.22.12 ) require ( - github.com/GeertJohan/go.incremental v1.0.0 // indirect - github.com/akavel/rsrc v0.8.0 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect github.com/daaku/go.zipexe v1.0.2 // indirect github.com/felixge/httpsnoop v1.0.1 // indirect - github.com/jessevdk/go-flags v1.4.0 // indirect - github.com/nkovacs/streamquote v1.0.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect - github.com/valyala/bytebufferpool v1.0.0 // indirect - github.com/valyala/fasttemplate v1.0.1 // indirect - golang.org/x/sys v0.0.0-20220908164124-27713097b956 // indirect + golang.org/x/sys v0.1.0 // indirect ) diff --git a/desktop/go.sum b/desktop/go.sum index da1a3d5d..fcff59bb 100644 --- a/desktop/go.sum +++ b/desktop/go.sum @@ -1,9 +1,7 @@ github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= -github.com/GeertJohan/go.incremental v1.0.0 h1:7AH+pY1XUgQE4Y1HcXYaMqAI0m9yrFqo/jt0CW30vsg= github.com/GeertJohan/go.incremental v1.0.0/go.mod h1:6fAjUhbVuX1KcMD3c8TEgVUqmo4seqhv0i0kdATSkM0= github.com/GeertJohan/go.rice v1.0.3 h1:k5viR+xGtIhF61125vCE1cmJ5957RQGXG6dmbaWZSmI= github.com/GeertJohan/go.rice v1.0.3/go.mod h1:XVdrU4pW00M4ikZed5q56tPf1v2KwnIKeIdc9CBYNt4= -github.com/akavel/rsrc v0.8.0 h1:zjWn7ukO9Kc5Q62DOJCcxGpXC18RawVtYAGdz2aLlfw= github.com/akavel/rsrc v0.8.0/go.mod h1:uLoCtb9J+EyAqh+26kdrTgmzRBFPGOolLWKpdxkKq+c= github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w= github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= @@ -22,12 +20,12 @@ github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc= github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= -github.com/jessevdk/go-flags v1.4.0 h1:4IU2WS7AumrZ/40jfhf4QVDMsQwqA7VEHozFRrGARJA= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/maputnik/desktop v1.0.7 h1:rdFg7emIJOT3YsZpwqSChmWtMOvu+T4h6WwVQAZP9n4= github.com/maputnik/desktop v1.0.7/go.mod h1:wmDjHUztx9jOBz0I22589yWguAGdV/sEM57YANpN8oQ= -github.com/nkovacs/streamquote v1.0.0 h1:PmVIV08Zlx2lZK5fFZlMZ04eHcDTIFJCv/5/0twVUow= github.com/nkovacs/streamquote v1.0.0/go.mod h1:BN+NaZ2CmdKqUuTUXUEm9j95B2TRbpOWpxbJYzzgUsc= +github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= +github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= @@ -41,12 +39,11 @@ github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKs github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/urfave/cli v1.22.12 h1:igJgVw1JdKH+trcLWLeLwZjU9fEfPesQ+9/e4MQ44S8= github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8= -github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= -github.com/valyala/fasttemplate v1.0.1 h1:tY9CJiPnMXf1ERmG2EyK7gNUd+c6RKGD0IfU8WdUSz8= github.com/valyala/fasttemplate v1.0.1/go.mod h1:UQGH1tvbgY+Nz5t2n7tXsz52dQxojPUpymEIMZ47gx8= -golang.org/x/sys v0.0.0-20220908164124-27713097b956 h1:XeJjHH1KiLpKGb6lvMiksZ9l0fVUh+AmGcm0nOMEBOY= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U= +golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/desktop/maputnik.go b/desktop/maputnik.go index d0af5176..4cc84d60 100644 --- a/desktop/maputnik.go +++ b/desktop/maputnik.go @@ -2,6 +2,7 @@ package main import ( "fmt" + "net" "net/http" "os" "path/filepath" @@ -9,6 +10,7 @@ import ( "github.com/gorilla/handlers" "github.com/gorilla/mux" "github.com/maputnik/desktop/filewatch" + "github.com/pkg/browser" "github.com/urfave/cli" ) @@ -36,6 +38,10 @@ func main() { Name: "static", Usage: "Serve directory under /static/", }, + &cli.BoolFlag{ + Name: "no-browser", + Usage: "Do not automatically open the default browser", + }, } app.Action = func(c *cli.Context) error { @@ -71,8 +77,26 @@ func main() { loggedRouter := handlers.LoggingHandler(os.Stdout, router) corsRouter := handlers.CORS(handlers.AllowedHeaders([]string{"Content-Type"}), handlers.AllowedMethods([]string{"GET", "PUT"}), handlers.AllowedOrigins([]string{"*"}), handlers.AllowCredentials())(loggedRouter) - fmt.Printf("Exposing Maputnik on http://localhost:%d\n", c.Int("port")) - return http.ListenAndServe(fmt.Sprintf(":%d", c.Int("port")), corsRouter) + listener, err := net.Listen("tcp", fmt.Sprintf(":%d", c.Int("port"))) + if err != nil { + return err + } + + url := fmt.Sprintf("http://localhost:%d", c.Int("port")) + fmt.Printf("Exposing Maputnik on %s\n", url) + + // Listener is already accepting connections, so this can't race http.Serve below. + // xdg-open is known to hang on some headless Linux setups, so this runs in its own + // goroutine to keep a stuck opener from stalling server startup. + if !c.Bool("no-browser") { + go func() { + if err := browser.OpenURL(url); err != nil { + fmt.Printf("Could not open browser automatically: %s\nPlease open %s manually.\n", err, url) + } + }() + } + + return http.Serve(listener, corsRouter) } app.Run(os.Args) From 61dd517dae17c714448beb011cdff36f6a9e2176 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:53:24 +0000 Subject: [PATCH 02/20] chore(deps-dev): Bump eslint from 10.8.1 to 10.9.0 (#2098) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [eslint](https://github.com/eslint/eslint) from 10.8.1 to 10.9.0.
Release notes

Sourced from eslint's releases.

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint&package-manager=npm_and_yarn&previous-version=10.8.1&new-version=10.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index d835ae28..358c5d6b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -92,7 +92,7 @@ "@vitejs/plugin-react": "^6.0.5", "@vitest/coverage-v8": "^4.1.11", "cors": "^2.8.6", - "eslint": "^10.8.1", + "eslint": "^10.9.0", "eslint-plugin-react": "^7.37.5", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.4", @@ -5242,9 +5242,9 @@ } }, "node_modules/eslint": { - "version": "10.8.1", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.1.tgz", - "integrity": "sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==", + "version": "10.9.0", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.0.tgz", + "integrity": "sha512-5KeEOJZBfEVA47boFiBsf+6MmmJpffM7qEBg4pLla2e4nlKgdKlqCW0oSLOGsT8Wl5uCGJptLV1bkaiShj90Gw==", "dev": true, "license": "MIT", "workspaces": [ diff --git a/package.json b/package.json index daef1461..3524da18 100644 --- a/package.json +++ b/package.json @@ -127,7 +127,7 @@ "@vitejs/plugin-react": "^6.0.5", "@vitest/coverage-v8": "^4.1.11", "cors": "^2.8.6", - "eslint": "^10.8.1", + "eslint": "^10.9.0", "eslint-plugin-react": "^7.37.5", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.4", From c9bee2428dc6d0f988f7e14d9fc3f72fc279552e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:53:49 +0000 Subject: [PATCH 03/20] chore(deps-dev): Bump sass from 1.102.0 to 1.103.1 (#2097) Bumps [sass](https://github.com/sass/dart-sass) from 1.102.0 to 1.103.1.
Release notes

Sourced from sass's releases.

Dart Sass 1.103.1

To install Sass 1.103.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.103.0

To install Sass 1.103.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.103.1

  • No user-visible changes.

1.103.0

  • Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sass&package-manager=npm_and_yarn&previous-version=1.102.0&new-version=1.103.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 358c5d6b..ac9a596c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -102,7 +102,7 @@ "nyc": "^18.0.0", "postcss": "^8.5.26", "react-hot-loader": "^4.13.1", - "sass": "^1.102.0", + "sass": "^1.103.1", "stylelint": "^17.14.1", "stylelint-config-recommended-scss": "^17.0.1", "stylelint-scss": "^7.2.0", @@ -11316,9 +11316,9 @@ "license": "MIT" }, "node_modules/sass": { - "version": "1.102.0", - "resolved": "https://registry.npmjs.org/sass/-/sass-1.102.0.tgz", - "integrity": "sha512-NSOyTnaQF7rTAEOtI2fwb386vL+akyiQLBZu8Na7hXCb+umJy0GAqlcMIaqACZ6Z1VgTBS4K9PG6B3IdjHGJsw==", + "version": "1.103.1", + "resolved": "https://registry.npmjs.org/sass/-/sass-1.103.1.tgz", + "integrity": "sha512-9icZURbP51S6S0QGoyaeqk9uB06GNWxsFYWfH5RgpFgqK5FA8tJcM3AdVxrZEVJ7dz+L87nG95gBKf4VuaMHGw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 3524da18..2ab7c3eb 100644 --- a/package.json +++ b/package.json @@ -137,7 +137,7 @@ "nyc": "^18.0.0", "postcss": "^8.5.26", "react-hot-loader": "^4.13.1", - "sass": "^1.102.0", + "sass": "^1.103.1", "stylelint": "^17.14.1", "stylelint-config-recommended-scss": "^17.0.1", "stylelint-scss": "^7.2.0", From 05fc9881a5080edf44b19b22585fa35f5905d39b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:54:11 +0000 Subject: [PATCH 04/20] chore(deps): Bump the react group with 2 updates (#2096) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the react group with 2 updates: [react-i18next](https://github.com/i18next/react-i18next) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react). Updates `react-i18next` from 17.0.11 to 17.0.12
Changelog

Sourced from react-i18next's changelog.

17.0.12

  • fix(IcuTrans): key-less icu.macro nodes (<Trans>Welcome, {name}!</Trans>, <Select>, <Plural> without i18nKey) rendered an empty string since 17.0.0. The macro now emits <IcuTrans defaultTranslation="…"> without a key and IcuTrans passed undefined to t(), which returns ''. Like Trans, IcuTrans now uses defaultTranslation as the key when i18nKey is not provided.
Commits
  • ea721fb 17.0.12
  • 6c2a71e fix(IcuTrans): use defaultTranslation as key when no i18nKey is given
  • 258c96d chore(examples): upgrade all example apps off unmaintained toolchains
  • b8677c8 chore: update dependencies to close dependabot alerts
  • aa9c92b docs: point Trans component links at the current docs (#1929)
  • See full diff in compare view

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'

export default defineConfig({

plugins: [

react({ compiler: true })

]

})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'

export default defineConfig({

plugins: [

react({ compiler: true })

]

})

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 28 ++++++++++++++++------------ package.json | 4 ++-- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/package-lock.json b/package-lock.json index ac9a596c..fab43cb8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -55,7 +55,7 @@ "react-collapse": "^5.1.1", "react-color": "^2.19.3", "react-dom": "^19.2.8", - "react-i18next": "^17.0.11", + "react-i18next": "^17.0.12", "react-icons": "^5.7.0", "react-markdown": "^10.1.0", "reconnecting-websocket": "^4.4.0", @@ -89,7 +89,7 @@ "@types/react-dom": "^19.2.4", "@types/string-hash": "^1.1.3", "@types/wicg-file-system-access": "^2023.10.7", - "@vitejs/plugin-react": "^6.0.5", + "@vitejs/plugin-react": "^6.1.0", "@vitest/coverage-v8": "^4.1.11", "cors": "^2.8.6", "eslint": "^10.9.0", @@ -327,9 +327,9 @@ } }, "node_modules/@babel/runtime": { - "version": "7.29.2", - "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz", - "integrity": "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz", + "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==", "license": "MIT", "engines": { "node": ">=6.9.0" @@ -3379,9 +3379,9 @@ "license": "ISC" }, "node_modules/@vitejs/plugin-react": { - "version": "6.0.5", - "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.5.tgz", - "integrity": "sha512-BOVzne/NL162sMdResB25mUv+vWMF5NoAjNf09TeGlE7ZpszZWSD3winycicLJw72yeVsoCn/2kOhEuCvEShMA==", + "version": "6.1.0", + "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.0.tgz", + "integrity": "sha512-qd2BzUBehkov86WFhg0JkEFEYyCLG9uPCe6qWTY/kRlss9OvJrOF2UbIWT7p+8IzZHkEu0DNGHc4HSv+JdDLsw==", "dev": true, "license": "MIT", "dependencies": { @@ -3393,6 +3393,7 @@ "peerDependencies": { "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0", "babel-plugin-react-compiler": "^1.0.0", + "oxc-transform-react": "^0.145.0", "vite": "^8.0.0" }, "peerDependenciesMeta": { @@ -3401,6 +3402,9 @@ }, "babel-plugin-react-compiler": { "optional": true + }, + "oxc-transform-react": { + "optional": true } } }, @@ -10788,12 +10792,12 @@ } }, "node_modules/react-i18next": { - "version": "17.0.11", - "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.11.tgz", - "integrity": "sha512-cDtkXgxjuFTWUH6V+aQn1Ve5vDiUztCNPWW5GtSHDccsgRXO1nE6QFWCEmc1KAutrb3OUv87wFShJL5RhUwPXg==", + "version": "17.0.12", + "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.12.tgz", + "integrity": "sha512-lFWPEGkxQ6RhusdUkysFBD58VHfSSzvHBzqMgN0SvfVpdQGfwtNkStTqdy08/sJd7s807qqutgx93fRpD0DJ3Q==", "license": "MIT", "dependencies": { - "@babel/runtime": "^7.29.2", + "@babel/runtime": "^7.29.7", "html-parse-stringify": "^4.0.1", "use-sync-external-store": "^1.6.0" }, diff --git a/package.json b/package.json index 2ab7c3eb..301dd79e 100644 --- a/package.json +++ b/package.json @@ -73,7 +73,7 @@ "react-collapse": "^5.1.1", "react-color": "^2.19.3", "react-dom": "^19.2.8", - "react-i18next": "^17.0.11", + "react-i18next": "^17.0.12", "react-icons": "^5.7.0", "react-markdown": "^10.1.0", "reconnecting-websocket": "^4.4.0", @@ -124,7 +124,7 @@ "@types/react-dom": "^19.2.4", "@types/string-hash": "^1.1.3", "@types/wicg-file-system-access": "^2023.10.7", - "@vitejs/plugin-react": "^6.0.5", + "@vitejs/plugin-react": "^6.1.0", "@vitest/coverage-v8": "^4.1.11", "cors": "^2.8.6", "eslint": "^10.9.0", From f099edf0ed4ecba804141829d78c88fb5a18bfdf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:54:31 +0000 Subject: [PATCH 05/20] chore(deps): Bump maplibre-gl from 6.4.1 to 6.5.0 (#2099) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from 6.4.1 to 6.5.0.
Release notes

Sourced from maplibre-gl's releases.

v6.5.0

✨ Features and improvements

  • Add experimental ImageSource.setWarp and ImageSource.getWarp, choosing between a auto, perspective and a flat warp of the image (#8172) (by @​HarelM)

🐞 Bug fixes

  • Fixed incorrect image source on projection on globe view (#8172) (by @​HarelM)
  • Fix the globe zooming itself in when panned away from a pole at the minimum zoom, where the latitude zoom compensation was applied on top of the constrain's own clamp (#8182) (by @​mondsichtung)
  • Fix dragging the globe from the empty space around it, which barely moved the map and often in the wrong direction (#8174) (by @​mondsichtung)
Changelog

Sourced from maplibre-gl's changelog.

6.5.0

✨ Features and improvements

  • Add experimental ImageSource.setWarp and ImageSource.getWarp, choosing between a auto, perspective and a flat warp of the image (#8172) (by @​HarelM)

🐞 Bug fixes

  • Fixed incorrect image source on projection on globe view (#8172) (by @​HarelM)
  • Fix the globe zooming itself in when panned away from a pole at the minimum zoom, where the latitude zoom compensation was applied on top of the constrain's own clamp (#8182) (by @​mondsichtung)
  • Fix dragging the globe from the empty space around it, which barely moved the map and often in the wrong direction (#8174) (by @​mondsichtung)
Commits
  • 3a0a4f7 Bump js version to 6.5.0 (#8203)
  • 60b9c68 chore(deps): bump @​maplibre/mlt from 1.1.12 to 1.2.0 (#8196)
  • e347d1f feat: add image warp option to ImageSource (#8172)
  • a17c989 chore(deps-dev): bump devtools-protocol from 0.0.1680125 to 0.0.1681094 (#8202)
  • 8e91a9c chore(deps-dev): bump puppeteer from 25.5.0 to 25.8.0 (#8201)
  • fa757b9 chore(deps-dev): bump cssnano from 8.0.5 to 8.0.6 (#8199)
  • 58f4540 chore(deps): bump zensical/zensical from 0.0.54 to 0.0.55 (#8198)
  • d261017 chore(deps-dev): bump devtools-protocol from 0.0.1679354 to 0.0.1680125 (#8197)
  • 1275d68 fix: pan the globe from the center when the grab is off the sphere (#8174)
  • bf32dec fix: do not zoom in when panning the globe off a pole at min zoom (#8182)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=maplibre-gl&package-manager=npm_and_yarn&previous-version=6.4.1&new-version=6.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 16 ++++++++-------- package.json | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index fab43cb8..7f264492 100644 --- a/package-lock.json +++ b/package-lock.json @@ -42,7 +42,7 @@ "lodash.get": "^4.4.2", "lodash.isequal": "^4.5.0", "lodash.throttle": "^4.1.1", - "maplibre-gl": "^6.4.1", + "maplibre-gl": "^6.5.0", "maputnik-design": "github:maputnik/design#172b06c", "ol": "^10.10.0", "ol-mapbox-style": "^13.4.2", @@ -1725,9 +1725,9 @@ } }, "node_modules/@maplibre/mlt": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/@maplibre/mlt/-/mlt-1.1.12.tgz", - "integrity": "sha512-ZeK5w2TTeHOajcLaEQs1KZXw2V9wIKo1PmThlxlsHoXsQsYlBqLJzPOd6tJHRtGTChUY3DPPmjXRArYVvAbmZw==", + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/@maplibre/mlt/-/mlt-1.2.0.tgz", + "integrity": "sha512-g45M8gEI4sMO3X9ib4K7n3ZKFf0qQOL+NMkHCnEK51lOrYFHiEssOuZncx1+miIgi1IEE2NcbRMcq8RBkL+QHA==", "license": "(MIT OR Apache-2.0)", "dependencies": { "@mapbox/point-geometry": "^1.1.0" @@ -8492,9 +8492,9 @@ "license": "BSD-2-Clause" }, "node_modules/maplibre-gl": { - "version": "6.4.1", - "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.4.1.tgz", - "integrity": "sha512-KzxQKtfBu/pSz1C+yW1hNS9eyj2h2lC7ufdAi6/SEt177n3oAfDfmUmslRfJdXY7ReAFBcnvwsqmiyoDhtA9GQ==", + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.5.0.tgz", + "integrity": "sha512-kVStPz9Rw/ATjWV5tQ3iCR0tY+viz16Nh3E14iZNlBj0HloMAzFaDNtFYqPGkZSFRnv56txMh3ImjR0g6oClTw==", "license": "BSD-3-Clause", "dependencies": { "@mapbox/point-geometry": "^1.1.0", @@ -8503,7 +8503,7 @@ "@mapbox/vector-tile": "^3.0.0", "@maplibre/geojson-vt": "^6.1.1", "@maplibre/maplibre-gl-style-spec": "^26.2.1", - "@maplibre/mlt": "^1.1.12", + "@maplibre/mlt": "^1.2.0", "@maplibre/vt-pbf": "^4.3.2", "@types/geojson": "^7946.0.16", "earcut": "^3.2.3", diff --git a/package.json b/package.json index 301dd79e..f74e634e 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,7 @@ "lodash.get": "^4.4.2", "lodash.isequal": "^4.5.0", "lodash.throttle": "^4.1.1", - "maplibre-gl": "^6.4.1", + "maplibre-gl": "^6.5.0", "maputnik-design": "github:maputnik/design#172b06c", "ol": "^10.10.0", "ol-mapbox-style": "^13.4.2", From b28583db741fc0d3d22a7450d1ee74c106688ff8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:54:46 +0000 Subject: [PATCH 06/20] chore(deps-dev): Bump vite from 8.2.1 to 8.2.2 (#2100) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.2.1 to 8.2.2.
Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

  • deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

  • bundled-dev: handle lazy request error (#23291) (3ba026d)
  • bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
  • config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
  • css: don't pass empty targets to lightningcss (#23295) (2804636)
  • define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
  • deps: update all non-major dependencies (#23217) (ba958bd)
  • deps: update rolldown-related dependencies (#23218) (83ecb2c)
  • module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
  • optimizer: close custom extension analysis bundles (#23207) (8fb7675)
  • reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
  • respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
  • ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
  • vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

Miscellaneous Chores

Code Refactoring

  • use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
  • use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

  • define: close rolldown bundler after generate (#23231) (b4d66fe)
  • module-runner: add TLA circular import case (#23299) (4a261f2)
  • module-runner: simplify server-hmr tests (#23300) (599b44b)
  • ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

  • use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)
Commits
  • de1111a release: v8.2.2
  • cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
  • 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
  • 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
  • 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
  • 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
  • 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
  • 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
  • 599b44b test(module-runner): simplify server-hmr tests (#23300)
  • 4a261f2 test(module-runner): add TLA circular import case (#23299)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=8.2.1&new-version=8.2.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 14 +++++++------- package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7f264492..5cf4d8b4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -109,7 +109,7 @@ "typescript": "^6.0.3", "typescript-eslint": "^8.67.0", "uuid": "^14.0.2", - "vite": "^8.2.1", + "vite": "^8.2.2", "vite-plugin-istanbul": "^9.0.1", "vitest": "^4.1.11" } @@ -12885,16 +12885,16 @@ } }, "node_modules/vite": { - "version": "8.2.1", - "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz", - "integrity": "sha512-EU/eS7BH3XROHh2YnBefjM6DBKA6ZeMZEYQbj7NLWg5wHYlhB8B/Mayd5XsgWq+NFYccDOTemRpdETWR6Ka/lw==", + "version": "8.2.2", + "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz", + "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==", "dev": true, "license": "MIT", "dependencies": { "lightningcss": "^1.33.0", "picomatch": "^4.0.5", - "postcss": "^8.5.25", - "rolldown": "~1.2.1", + "postcss": "^8.5.26", + "rolldown": "~1.2.4", "tinyglobby": "^0.2.17" }, "bin": { @@ -12911,7 +12911,7 @@ }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", - "@vitejs/devtools": "^0.4.0", + "@vitejs/devtools": "^0.4.0 || ^0.5.0", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", diff --git a/package.json b/package.json index f74e634e..8ebd3a59 100644 --- a/package.json +++ b/package.json @@ -144,7 +144,7 @@ "typescript": "^6.0.3", "typescript-eslint": "^8.67.0", "uuid": "^14.0.2", - "vite": "^8.2.1", + "vite": "^8.2.2", "vite-plugin-istanbul": "^9.0.1", "vitest": "^4.1.11" } From d90686f8503d0c8a54e972df8254ec7bb66f6ebe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:54:50 +0000 Subject: [PATCH 07/20] chore(deps): Bump github/codeql-action/autobuild from 4.37.7 to 4.37.8 (#2103) Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8.
Release notes

Sourced from github/codeql-action/autobuild's releases.

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/autobuild's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits
  • db488dd Merge pull request #4102 from github/update-v4.37.8-9ee088e13
  • 1845f5b Update changelog for v4.37.8
  • 9ee088e Merge pull request #4080 from github/henrymercer/studious-giggle
  • 1aef003 Address review feedback on overlay disk flags
  • 508b83b Merge main into overlay minimum disk feature branch
  • d97b342 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error
  • 47fa622 Make EACCES a ConfigurationError
  • 45693cc Refactor ENOSPC check into isDiskConfigurationError function
  • c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
  • c56f48e Log unexpected conditions during caching CLI output
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action/autobuild&package-manager=github_actions&previous-version=4.37.7&new-version=4.37.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 8fe0fb88..85e72418 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -53,7 +53,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl From 817b9abea878c2cb6dbf5b4c280896968ff1aa7e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:55:00 +0000 Subject: [PATCH 08/20] chore(deps): Bump i18next from 26.3.6 to 26.4.0 (#2102) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [i18next](https://github.com/i18next/i18next) from 26.3.6 to 26.4.0.
Release notes

Sourced from i18next's releases.

v26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
Changelog

Sourced from i18next's changelog.

26.4.0

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.3.6&new-version=26.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5cf4d8b4..d50ba05d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -30,7 +30,7 @@ "downshift": "^9.4.0", "events": "^3.3.0", "file-saver": "^2.0.5", - "i18next": "^26.3.6", + "i18next": "^26.4.0", "i18next-browser-languagedetector": "^8.2.1", "i18next-resources-to-backend": "^1.2.3", "json-stringify-pretty-compact": "^4.0.0", @@ -6702,9 +6702,9 @@ } }, "node_modules/i18next": { - "version": "26.3.6", - "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.3.6.tgz", - "integrity": "sha512-Bu5Z2nAXgfVyM8xvW3jk9EKRIuX37PudsrBViThNFx7CR7aaYTpP01cxNB/E4c4UUzTDiAZRstEhsRfPOL/8xA==", + "version": "26.4.0", + "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.4.0.tgz", + "integrity": "sha512-rsmK5bFqsD1AetSFSIa43wtNR4WpvvH4p0tLEsTxkC7QTrfdFm06nbQ95bh8Og4wwaCnUEcm9DVYL2cgxitiQg==", "funding": [ { "type": "individual", diff --git a/package.json b/package.json index 8ebd3a59..70658b67 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "downshift": "^9.4.0", "events": "^3.3.0", "file-saver": "^2.0.5", - "i18next": "^26.3.6", + "i18next": "^26.4.0", "i18next-browser-languagedetector": "^8.2.1", "i18next-resources-to-backend": "^1.2.3", "json-stringify-pretty-compact": "^4.0.0", From 520a1aab20503b0641fe55b9cc09b3d2d61571fb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:55:10 +0000 Subject: [PATCH 09/20] chore(deps): Bump @maplibre/maplibre-gl-style-spec from 26.2.1 to 26.3.0 (#2101) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [@maplibre/maplibre-gl-style-spec](https://github.com/maplibre/maplibre-style-spec) from 26.2.1 to 26.3.0.
Release notes

Sourced from @​maplibre/maplibre-gl-style-spec's releases.

v26.3.0

✨ Features and improvements

  • Add semiliteral operator for expressions inside arrays and objects (#951) (by @​sargunv)
  • Add symbol-height-offset and symbol-height-anchor properties to symbol layers to allow icons and text to be elevated above the ground (#1508) (by @​HatulaPro)
Changelog

Sourced from @​maplibre/maplibre-gl-style-spec's changelog.

26.3.0

✨ Features and improvements

  • Add semiliteral operator for expressions inside arrays and objects (#951) (by @​sargunv)
  • Add symbol-height-offset and symbol-height-anchor properties to symbol layers to allow icons and text to be elevated above the ground (#1508) (by @​HatulaPro)
Commits
  • 2d22724 Bump js version to 26.3.0 (#1835)
  • 55a91fe Add symbol-elevation property to symbol layers (#1508)
  • 6855b3e build(deps-dev): bump rolldown from 1.2.4 to 1.2.5 (#1834)
  • dbdd5b0 build(deps-dev): bump oxfmt from 0.63.0 to 0.64.0 (#1833)
  • 7920d03 build(deps-dev): bump the vitest group with 3 updates (#1831)
  • 4f227cd build(deps-dev): bump @​typescript-eslint/eslint-plugin (#1827)
  • b53cb1b build(deps-dev): bump globals from 17.9.0 to 17.11.0 (#1824)
  • 693849f build(deps-dev): bump rolldown from 1.2.3 to 1.2.4 (#1823)
  • fa7eca1 build(deps-dev): bump @​types/node from 26.1.2 to 26.2.0 (#1826)
  • ba3a733 build(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#1822)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@maplibre/maplibre-gl-style-spec&package-manager=npm_and_yarn&previous-version=26.2.1&new-version=26.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index d50ba05d..e8fd70d2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20,7 +20,7 @@ "@mapbox/mapbox-gl-rtl-text": "^0.4.0", "@maplibre/maplibre-gl-geocoder": "^1.9.4", "@maplibre/maplibre-gl-inspect": "^1.9.0", - "@maplibre/maplibre-gl-style-spec": "^26.2.1", + "@maplibre/maplibre-gl-style-spec": "^26.3.0", "array-move": "^4.0.0", "buffer": "^6.0.3", "classnames": "^2.5.1", @@ -1706,9 +1706,9 @@ } }, "node_modules/@maplibre/maplibre-gl-style-spec": { - "version": "26.2.1", - "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-26.2.1.tgz", - "integrity": "sha512-QFKCXkOeSzOr8jF75jm6kySOg+dUvOehPhRi68gcOYPHb7U5JloUq0dJW0Y5/fZV8ygfT0Vp2RWodvq+fyxFWA==", + "version": "26.3.0", + "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-26.3.0.tgz", + "integrity": "sha512-i5qRxjNvktTZ7CR08u7JJpOrVAd0JbYjYlnHypoVpbaqi6INJ7JZ3ZFTKTxK4QFqRdYAozlu3KeOcZp0g9bvdQ==", "license": "ISC", "dependencies": { "@mapbox/jsonlint-lines-primitives": "^2.0.3", diff --git a/package.json b/package.json index 70658b67..b268249b 100644 --- a/package.json +++ b/package.json @@ -38,7 +38,7 @@ "@mapbox/mapbox-gl-rtl-text": "^0.4.0", "@maplibre/maplibre-gl-geocoder": "^1.9.4", "@maplibre/maplibre-gl-inspect": "^1.9.0", - "@maplibre/maplibre-gl-style-spec": "^26.2.1", + "@maplibre/maplibre-gl-style-spec": "^26.3.0", "array-move": "^4.0.0", "buffer": "^6.0.3", "classnames": "^2.5.1", From c08269de332b8d85ddb1a24bc7853ad9161d227a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 21:54:11 +0000 Subject: [PATCH 10/20] chore(deps): Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3 in /desktop (#2106) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/gorilla/websocket](https://github.com/gorilla/websocket) from 1.5.0 to 1.5.3.
Release notes

Sourced from github.com/gorilla/websocket's releases.

v1.5.3

Important change

This reverts the websockets package back to https://github.com/gorilla/websocket/commit/931041c5ee6de24fe9cba1aa16f1a0b910284d6d

What's Changed

New Contributors

Full Changelog: https://github.com/gorilla/websocket/compare/v1.5.1...v1.5.3

v1.5.2

What's Changed

... (truncated)

Commits
  • ce903f6 Reverts to v1.5.0
  • 9ec25ca fixes broken random value generation
  • 1bddf2e bumps go version & removes deprecated module usage
  • 750bf92 adds GHA & Makefile configs
  • b2c246b Revert " Update go version & add verification/testing tools (#840)"
  • 09a6bab removing error handling while closing connections
  • 58af150 return errors instead of printing to logs
  • e5f1a0a excludes errchecks linter
  • b2a86a1 Do not timeout when WriteControl deadline is zero
  • 695e909 Remove hideTempErr to allow downstream users to check for errors like net.Err...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gorilla/websocket&package-manager=go_modules&previous-version=1.5.0&new-version=1.5.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/maplibre/maputnik/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- desktop/go.mod | 2 +- desktop/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/desktop/go.mod b/desktop/go.mod index ea11c272..e50dc248 100644 --- a/desktop/go.mod +++ b/desktop/go.mod @@ -7,7 +7,7 @@ require ( github.com/fsnotify/fsnotify v1.6.0 github.com/gorilla/handlers v1.5.1 github.com/gorilla/mux v1.8.0 - github.com/gorilla/websocket v1.5.0 + github.com/gorilla/websocket v1.5.3 github.com/maputnik/desktop v1.0.7 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c github.com/urfave/cli v1.22.12 diff --git a/desktop/go.sum b/desktop/go.sum index fcff59bb..6771e7a0 100644 --- a/desktop/go.sum +++ b/desktop/go.sum @@ -18,8 +18,8 @@ github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q= github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= -github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc= -github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= +github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/maputnik/desktop v1.0.7 h1:rdFg7emIJOT3YsZpwqSChmWtMOvu+T4h6WwVQAZP9n4= github.com/maputnik/desktop v1.0.7/go.mod h1:wmDjHUztx9jOBz0I22589yWguAGdV/sEM57YANpN8oQ= From 5ffa887e0fc9d2bc202be3a9255bdc35f4a27865 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 13:53:34 +0000 Subject: [PATCH 11/20] chore(deps): Bump @maplibre/maplibre-gl-style-spec from 26.3.0 to 26.4.0 (#2107) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [@maplibre/maplibre-gl-style-spec](https://github.com/maplibre/maplibre-style-spec) from 26.3.0 to 26.4.0.
Release notes

Sourced from @​maplibre/maplibre-gl-style-spec's releases.

v26.4.0

✨ Features and improvements

  • Enable data-driven icon-rotation-alignment (#1836) (by @​Turbo87)
  • Make url optional for image sources. An image source can now be defined with only type and coordinates; it renders nothing until an image is set at runtime (#1817)

🐞 Bug fixes

  • Fix missing setFontFaces operation when style changes (#1837) (by @​HarelM)
Changelog

Sourced from @​maplibre/maplibre-gl-style-spec's changelog.

26.4.0

✨ Features and improvements

  • Enable data-driven icon-rotation-alignment (#1836) (by @​Turbo87)
  • Make url optional for image sources. An image source can now be defined with only type and coordinates; it renders nothing until an image is set at runtime (#1817)

🐞 Bug fixes

  • Fix missing setFontFaces operation when style changes (#1837) (by @​HarelM)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@maplibre/maplibre-gl-style-spec&package-manager=npm_and_yarn&previous-version=26.3.0&new-version=26.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index e8fd70d2..4317884c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20,7 +20,7 @@ "@mapbox/mapbox-gl-rtl-text": "^0.4.0", "@maplibre/maplibre-gl-geocoder": "^1.9.4", "@maplibre/maplibre-gl-inspect": "^1.9.0", - "@maplibre/maplibre-gl-style-spec": "^26.3.0", + "@maplibre/maplibre-gl-style-spec": "^26.4.0", "array-move": "^4.0.0", "buffer": "^6.0.3", "classnames": "^2.5.1", @@ -1706,9 +1706,9 @@ } }, "node_modules/@maplibre/maplibre-gl-style-spec": { - "version": "26.3.0", - "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-26.3.0.tgz", - "integrity": "sha512-i5qRxjNvktTZ7CR08u7JJpOrVAd0JbYjYlnHypoVpbaqi6INJ7JZ3ZFTKTxK4QFqRdYAozlu3KeOcZp0g9bvdQ==", + "version": "26.4.0", + "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-26.4.0.tgz", + "integrity": "sha512-FHR/9P4g2MrO4+yAQvhIWJEQ34vEBwupoTyGXH4OUAPSeApoOq0Mqc53i4tU4UfTOWxr5KxGM74w9oxK+Snklw==", "license": "ISC", "dependencies": { "@mapbox/jsonlint-lines-primitives": "^2.0.3", diff --git a/package.json b/package.json index b268249b..f27bba83 100644 --- a/package.json +++ b/package.json @@ -38,7 +38,7 @@ "@mapbox/mapbox-gl-rtl-text": "^0.4.0", "@maplibre/maplibre-gl-geocoder": "^1.9.4", "@maplibre/maplibre-gl-inspect": "^1.9.0", - "@maplibre/maplibre-gl-style-spec": "^26.3.0", + "@maplibre/maplibre-gl-style-spec": "^26.4.0", "array-move": "^4.0.0", "buffer": "^6.0.3", "classnames": "^2.5.1", From 4f451fbfa416b0ec90585f7b07d7b5eace0d5bab Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 26 Aug 2026 13:54:16 +0000 Subject: [PATCH 12/20] chore(deps): Bump @maplibre/maplibre-gl-style-spec from 26.4.0 to 26.4.1 (#2108) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [@maplibre/maplibre-gl-style-spec](https://github.com/maplibre/maplibre-style-spec) from 26.4.0 to 26.4.1.
Release notes

Sourced from @​maplibre/maplibre-gl-style-spec's releases.

v26.4.1

✨ Features and improvements

  • Publish the ESM build (dist/index.mjs, referenced by package.json#module) as one module per source file instead of a single bundle, so that bundlers which eliminate dead code at module granularity can drop unused parts of the package (#1829) (by @​ahocevar)

🐞 Bug fixes

  • Fix validation and typescript types for font-faces (#1840) (by @​HarelM)
Changelog

Sourced from @​maplibre/maplibre-gl-style-spec's changelog.

26.4.1

✨ Features and improvements

  • Publish the ESM build (dist/index.mjs, referenced by package.json#module) as one module per source file instead of a single bundle, so that bundlers which eliminate dead code at module granularity can drop unused parts of the package (#1829) (by @​ahocevar)

🐞 Bug fixes

  • Fix validation and typescript types for font-faces (#1840) (by @​HarelM)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@maplibre/maplibre-gl-style-spec&package-manager=npm_and_yarn&previous-version=26.4.0&new-version=26.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4317884c..383c2eda 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20,7 +20,7 @@ "@mapbox/mapbox-gl-rtl-text": "^0.4.0", "@maplibre/maplibre-gl-geocoder": "^1.9.4", "@maplibre/maplibre-gl-inspect": "^1.9.0", - "@maplibre/maplibre-gl-style-spec": "^26.4.0", + "@maplibre/maplibre-gl-style-spec": "^26.4.1", "array-move": "^4.0.0", "buffer": "^6.0.3", "classnames": "^2.5.1", @@ -1706,9 +1706,9 @@ } }, "node_modules/@maplibre/maplibre-gl-style-spec": { - "version": "26.4.0", - "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-26.4.0.tgz", - "integrity": "sha512-FHR/9P4g2MrO4+yAQvhIWJEQ34vEBwupoTyGXH4OUAPSeApoOq0Mqc53i4tU4UfTOWxr5KxGM74w9oxK+Snklw==", + "version": "26.4.1", + "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-26.4.1.tgz", + "integrity": "sha512-I/qcIKVFHFSg1Meu/eqHrkSTjIez0gCsSaK56TNPutM3TkE61aSq6F1cZ4Kg4KiNs3cpViLtubDjfyRcQCdEJQ==", "license": "ISC", "dependencies": { "@mapbox/jsonlint-lines-primitives": "^2.0.3", diff --git a/package.json b/package.json index f27bba83..65e0390d 100644 --- a/package.json +++ b/package.json @@ -38,7 +38,7 @@ "@mapbox/mapbox-gl-rtl-text": "^0.4.0", "@maplibre/maplibre-gl-geocoder": "^1.9.4", "@maplibre/maplibre-gl-inspect": "^1.9.0", - "@maplibre/maplibre-gl-style-spec": "^26.4.0", + "@maplibre/maplibre-gl-style-spec": "^26.4.1", "array-move": "^4.0.0", "buffer": "^6.0.3", "classnames": "^2.5.1", From d802049d029e37adfc75e1c8e6b4eecaf0a10ec9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 13:55:00 +0000 Subject: [PATCH 13/20] chore(deps-dev): Bump @types/react-dom from 19.2.4 to 19.2.5 in the react group (#2109) Bumps the react group with 1 update: [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom). Updates `@types/react-dom` from 19.2.4 to 19.2.5
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/react-dom&package-manager=npm_and_yarn&previous-version=19.2.4&new-version=19.2.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 383c2eda..1549c2a0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -86,7 +86,7 @@ "@types/react-aria-modal": "^5.0.0", "@types/react-collapse": "^5.0.4", "@types/react-color": "^3.0.13", - "@types/react-dom": "^19.2.4", + "@types/react-dom": "^19.2.5", "@types/string-hash": "^1.1.3", "@types/wicg-file-system-access": "^2023.10.7", "@vitejs/plugin-react": "^6.1.0", @@ -3041,9 +3041,9 @@ } }, "node_modules/@types/react-dom": { - "version": "19.2.4", - "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.4.tgz", - "integrity": "sha512-Bsc+QHgp+P/F02XDzNCY9jnZNCUuLki36KT7VKrTXXLdHf+vHMNZnW1rVu5DNW/rCK+fya3DATySbLM4yhtKUw==", + "version": "19.2.5", + "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.5.tgz", + "integrity": "sha512-fMPwH9v7r/pp43yUd2/Mbiex5KouJwwR3dzHkhLREUC6764VyDsqxhAxv6OFEYR1RhjOyD1naqba8ECDBe7ZQg==", "dev": true, "license": "MIT", "peerDependencies": { diff --git a/package.json b/package.json index 65e0390d..fc59de76 100644 --- a/package.json +++ b/package.json @@ -121,7 +121,7 @@ "@types/react-aria-modal": "^5.0.0", "@types/react-collapse": "^5.0.4", "@types/react-color": "^3.0.13", - "@types/react-dom": "^19.2.4", + "@types/react-dom": "^19.2.5", "@types/string-hash": "^1.1.3", "@types/wicg-file-system-access": "^2023.10.7", "@vitejs/plugin-react": "^6.1.0", From b4241cf43daffe07cc94befca69c8cf8cc14b0df Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:53:25 +0000 Subject: [PATCH 14/20] chore(deps-dev): Bump eslint from 10.9.0 to 10.9.1 (#2113) Bumps [eslint](https://github.com/eslint/eslint) from 10.9.0 to 10.9.1.
Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint&package-manager=npm_and_yarn&previous-version=10.9.0&new-version=10.9.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1549c2a0..92e5e2bd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -92,7 +92,7 @@ "@vitejs/plugin-react": "^6.1.0", "@vitest/coverage-v8": "^4.1.11", "cors": "^2.8.6", - "eslint": "^10.9.0", + "eslint": "^10.9.1", "eslint-plugin-react": "^7.37.5", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.4", @@ -5246,9 +5246,9 @@ } }, "node_modules/eslint": { - "version": "10.9.0", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.0.tgz", - "integrity": "sha512-5KeEOJZBfEVA47boFiBsf+6MmmJpffM7qEBg4pLla2e4nlKgdKlqCW0oSLOGsT8Wl5uCGJptLV1bkaiShj90Gw==", + "version": "10.9.1", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.1.tgz", + "integrity": "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A==", "dev": true, "license": "MIT", "workspaces": [ diff --git a/package.json b/package.json index fc59de76..2ea72f98 100644 --- a/package.json +++ b/package.json @@ -127,7 +127,7 @@ "@vitejs/plugin-react": "^6.1.0", "@vitest/coverage-v8": "^4.1.11", "cors": "^2.8.6", - "eslint": "^10.9.0", + "eslint": "^10.9.1", "eslint-plugin-react": "^7.37.5", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.4", From 0c2b0380b42da16a8f49599a5869d44a86442037 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:53:41 +0000 Subject: [PATCH 15/20] chore(deps): Bump maplibre-gl from 6.5.0 to 6.6.0 (#2112) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) from 6.5.0 to 6.6.0.
Release notes

Sourced from maplibre-gl's releases.

v6.6.0

✨ Features and improvements

  • Add support for symbol-height-offset and symbol-height-anchor layout properties, which raise icons and text above the map. symbol-height-anchor selects whether the offset is measured from the terrain surface (ground, the default) or from the zero elevation datum (absolute) (#7827) (by @​HarelM)
  • Pick terrain coordinates with a CPU raycast against the DEM instead of a coords framebuffer readback: full DEM resolution, no GPU stall on pointer events, and about 4MB less GPU memory (#7640) (by @​johncarmack1984)

🐞 Bug fixes

  • Fix labels briefly appearing too large when zooming out several levels at once (e.g. a scroll-wheel or pinch fling) with a zoom-dependent text-size/icon-size (#8175) (by @​mondsichtung)
  • Fix globe tile selection measuring distances from the ground point below the camera instead of the camera itself, refining some views past the requested zoom and leaving others coarser (#8187) (by @​Alchez)
  • Fix the style's center, zoom, bearing, pitch and roll being ignored when the map was created with a minZoom or minPitch option, since applying those limits marked the transform as modified (#5932)
  • Upload the color-relief DEM texture once per tile instead of on every frame (#8209)
Changelog

Sourced from maplibre-gl's changelog.

6.6.0

✨ Features and improvements

  • Add support for symbol-height-offset and symbol-height-anchor layout properties, which raise icons and text above the map. symbol-height-anchor selects whether the offset is measured from the terrain surface (ground, the default) or from the zero elevation datum (absolute) (#7827) (by @​HarelM)
  • Pick terrain coordinates with a CPU raycast against the DEM instead of a coords framebuffer readback: full DEM resolution, no GPU stall on pointer events, and about 4MB less GPU memory (#7640) (by @​johncarmack1984)

🐞 Bug fixes

  • Fix labels briefly appearing too large when zooming out several levels at once (e.g. a scroll-wheel or pinch fling) with a zoom-dependent text-size/icon-size (#8175) (by @​mondsichtung)
  • Fix globe tile selection measuring distances from the ground point below the camera instead of the camera itself, refining some views past the requested zoom and leaving others coarser (#8187) (by @​Alchez)
  • Fix the style's center, zoom, bearing, pitch and roll being ignored when the map was created with a minZoom or minPitch option, since applying those limits marked the transform as modified (#5932)
  • Upload the color-relief DEM texture once per tile instead of on every frame (#8209)
Commits
  • 407a8ce Bump js version to 6.6.0 (#8226)
  • 7446d5a feat: add support for symbol elevation (#7827)
  • 038265c chore(deps-dev): bump rolldown from 1.2.4 to 1.2.5 (#8221)
  • ff9ec8e chore(deps): bump the codeql-action group with 3 updates (#8224)
  • 84bb758 chore(deps-dev): bump devtools-protocol from 0.0.1681094 to 0.0.1683682 (#8223)
  • c00194d chore(deps-dev): bump vite from 8.2.1 to 8.2.2 (#8220)
  • 335df7e chore(deps-dev): bump the vitest group with 3 updates (#8219)
  • 3a2dc76 chore(deps-dev): bump cssnano from 8.0.6 to 8.0.7 (#8222)
  • 87ac8ea chore(deps): bump zensical/zensical from 0.0.55 to 0.0.56 (#8218)
  • d0f1d66 bug: ReferenceError: assignment to undeclared variable image (#8216)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=maplibre-gl&package-manager=npm_and_yarn&previous-version=6.5.0&new-version=6.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 10 +++++----- package.json | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 92e5e2bd..ccb4a962 100644 --- a/package-lock.json +++ b/package-lock.json @@ -42,7 +42,7 @@ "lodash.get": "^4.4.2", "lodash.isequal": "^4.5.0", "lodash.throttle": "^4.1.1", - "maplibre-gl": "^6.5.0", + "maplibre-gl": "^6.6.0", "maputnik-design": "github:maputnik/design#172b06c", "ol": "^10.10.0", "ol-mapbox-style": "^13.4.2", @@ -8492,9 +8492,9 @@ "license": "BSD-2-Clause" }, "node_modules/maplibre-gl": { - "version": "6.5.0", - "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.5.0.tgz", - "integrity": "sha512-kVStPz9Rw/ATjWV5tQ3iCR0tY+viz16Nh3E14iZNlBj0HloMAzFaDNtFYqPGkZSFRnv56txMh3ImjR0g6oClTw==", + "version": "6.6.0", + "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.6.0.tgz", + "integrity": "sha512-EQql6eZYPhbHvJpqY4AwoiuLkUfXFRBHk67S8mDtzNo1F/jAo7xAxunIzO7gJ1vwTcPMgrK9b64dqKHvnkTlDQ==", "license": "BSD-3-Clause", "dependencies": { "@mapbox/point-geometry": "^1.1.0", @@ -8502,7 +8502,7 @@ "@mapbox/unitbezier": "^1.0.0", "@mapbox/vector-tile": "^3.0.0", "@maplibre/geojson-vt": "^6.1.1", - "@maplibre/maplibre-gl-style-spec": "^26.2.1", + "@maplibre/maplibre-gl-style-spec": "^26.3.0", "@maplibre/mlt": "^1.2.0", "@maplibre/vt-pbf": "^4.3.2", "@types/geojson": "^7946.0.16", diff --git a/package.json b/package.json index 2ea72f98..46f433f5 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,7 @@ "lodash.get": "^4.4.2", "lodash.isequal": "^4.5.0", "lodash.throttle": "^4.1.1", - "maplibre-gl": "^6.5.0", + "maplibre-gl": "^6.6.0", "maputnik-design": "github:maputnik/design#172b06c", "ol": "^10.10.0", "ol-mapbox-style": "^13.4.2", From d57df9c2d8ca11cc8b26f89881c77d0efac08070 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:54:01 +0000 Subject: [PATCH 16/20] chore(deps-dev): Bump typescript-eslint from 8.67.0 to 8.68.0 (#2110) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.67.0 to 8.68.0.
Release notes

Sourced from typescript-eslint's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

  • eslint-plugin: [strict-void-return] add fix suggestions (#12086)
  • utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

  • eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
  • eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
  • eslint-plugin: [unified-signatures] report identical signatures (#12678)
  • eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
  • eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
  • eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
  • website: playground crashes on extends configs (#12608)
  • website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript-eslint&package-manager=npm_and_yarn&previous-version=8.67.0&new-version=8.68.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 124 +++++++++++++++++++++++----------------------- package.json | 2 +- 2 files changed, 63 insertions(+), 63 deletions(-) diff --git a/package-lock.json b/package-lock.json index ccb4a962..5e887c89 100644 --- a/package-lock.json +++ b/package-lock.json @@ -107,7 +107,7 @@ "stylelint-config-recommended-scss": "^17.0.1", "stylelint-scss": "^7.2.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.67.0", + "typescript-eslint": "^8.68.0", "uuid": "^14.0.2", "vite": "^8.2.2", "vite-plugin-istanbul": "^9.0.1", @@ -3091,17 +3091,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.67.0.tgz", - "integrity": "sha512-Un7Heoyj65NREbKAyIrFxeM143NZpExWmy1Nep4DLeQOeLlTeumPjoNKnBrU5D5moWXbPJgRa5Uwcdu0faVNGQ==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.68.0.tgz", + "integrity": "sha512-WASHDpCm6qO5jj9g1a+8NiW5+GCkAyLReR56/4VruYmNgfUmqpxOfZ2Yfb8xGfJPWv5Qi6LSD8sXdces3vbp/Q==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.67.0", - "@typescript-eslint/type-utils": "8.67.0", - "@typescript-eslint/utils": "8.67.0", - "@typescript-eslint/visitor-keys": "8.67.0", + "@typescript-eslint/scope-manager": "8.68.0", + "@typescript-eslint/type-utils": "8.68.0", + "@typescript-eslint/utils": "8.68.0", + "@typescript-eslint/visitor-keys": "8.68.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -3114,7 +3114,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.67.0", + "@typescript-eslint/parser": "^8.68.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -3130,16 +3130,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.67.0.tgz", - "integrity": "sha512-fUBfTuuEulWqX6V8+O3PtScV01tzYYRUDTAirHFKoRAt7nOzoGiPt0M/bB47wWNy0coOOcgEwAMUtBpykMxl6w==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.68.0.tgz", + "integrity": "sha512-fHq2VC1kpyYfvEcbiMjOpySY4WS7voEp89yAThrHRX5sm9j2lzYppCb2umFMEed4fWcyeLjHxrz0mpjNBaBxMQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.67.0", - "@typescript-eslint/types": "8.67.0", - "@typescript-eslint/typescript-estree": "8.67.0", - "@typescript-eslint/visitor-keys": "8.67.0", + "@typescript-eslint/scope-manager": "8.68.0", + "@typescript-eslint/types": "8.68.0", + "@typescript-eslint/typescript-estree": "8.68.0", + "@typescript-eslint/visitor-keys": "8.68.0", "debug": "^4.4.3" }, "engines": { @@ -3155,14 +3155,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.67.0.tgz", - "integrity": "sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.68.0.tgz", + "integrity": "sha512-5GQtWZCXFcFYux955pvoS02WLc49pXNlvIxocKjS0clvwo3in1RdlzVKyiqQH9vE5AKWFLTaUgeQkOrTS+0Qxw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.67.0", - "@typescript-eslint/types": "^8.67.0", + "@typescript-eslint/tsconfig-utils": "^8.68.0", + "@typescript-eslint/types": "^8.68.0", "debug": "^4.4.3" }, "engines": { @@ -3177,14 +3177,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.67.0.tgz", - "integrity": "sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.68.0.tgz", + "integrity": "sha512-T5eXpcaJNg8bhjHJ8Rjp68Vq/QBteYtTKY8TZqVNPaUbuz0f6jI9t6aDkylwvalpAB9XTTFeFOjrjXAZ3YvmVA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.67.0", - "@typescript-eslint/visitor-keys": "8.67.0" + "@typescript-eslint/types": "8.68.0", + "@typescript-eslint/visitor-keys": "8.68.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -3195,9 +3195,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.67.0.tgz", - "integrity": "sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.68.0.tgz", + "integrity": "sha512-F7zrGQfiJHojPwi8vhxZQC1tWtJzvL74cK/nqri2lk8YUXvYaYwl263xOJ69jDWPUk1hmcdoayFwk9lX09npVw==", "dev": true, "license": "MIT", "engines": { @@ -3212,15 +3212,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.67.0.tgz", - "integrity": "sha512-aVWDXbRmdXO9siTfX4ditQI1T9+zVcNazT48EJCD0v40/9RIFoUgZ05CmGEq9H2gixRpjUn/iplwvlcvutJW/Q==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.68.0.tgz", + "integrity": "sha512-X77zqoY1EjeWGs/0JNxeaMfp5C5lIz4Tw8y66F1Ne8Faq6g424sBNYM6xBAqElfGZPLpWS+CZAp0DXyKDzWiHg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.67.0", - "@typescript-eslint/typescript-estree": "8.67.0", - "@typescript-eslint/utils": "8.67.0", + "@typescript-eslint/types": "8.68.0", + "@typescript-eslint/typescript-estree": "8.68.0", + "@typescript-eslint/utils": "8.68.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -3237,9 +3237,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.67.0.tgz", - "integrity": "sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.68.0.tgz", + "integrity": "sha512-9RnpsGJjrAllCMefGVVsImJM24YurhC0Q1h4UbvivtvOqXmR/vEJge2OoE++z9m6hyg8T1Q8t5SNT6tHSbrxcg==", "dev": true, "license": "MIT", "engines": { @@ -3251,16 +3251,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.67.0.tgz", - "integrity": "sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.68.0.tgz", + "integrity": "sha512-OKKsD0tYmoNiU5PW2zehO1yO56jYOm1ShYlxon/Z0SJNidAkdVg86eg9ruRuoXf8xfnuWZGbwDsStkoXbZtIIA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.67.0", - "@typescript-eslint/tsconfig-utils": "8.67.0", - "@typescript-eslint/types": "8.67.0", - "@typescript-eslint/visitor-keys": "8.67.0", + "@typescript-eslint/project-service": "8.68.0", + "@typescript-eslint/tsconfig-utils": "8.68.0", + "@typescript-eslint/types": "8.68.0", + "@typescript-eslint/visitor-keys": "8.68.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -3318,16 +3318,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.67.0.tgz", - "integrity": "sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.68.0.tgz", + "integrity": "sha512-PB5gJMMOg0Q5P1tsgWtEAqQacJXq0qEqRHDX/YJ4FaTMLfZPpHB3gjl2EJuiZyPABxmj4ZQYiY9m1bdAJ5y7tQ==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.67.0", - "@typescript-eslint/types": "8.67.0", - "@typescript-eslint/typescript-estree": "8.67.0" + "@typescript-eslint/scope-manager": "8.68.0", + "@typescript-eslint/types": "8.68.0", + "@typescript-eslint/typescript-estree": "8.68.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -3342,13 +3342,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.67.0.tgz", - "integrity": "sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.68.0.tgz", + "integrity": "sha512-YR65gGdGvTUAWLldC3xLOvOzamdGzB4A5/N8rehEaHs3Zvoe39BhgY+u0SPch1OvrVTfLcc55wsSgK2NcnTS/A==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.67.0", + "@typescript-eslint/types": "8.68.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -12584,16 +12584,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.67.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.67.0.tgz", - "integrity": "sha512-S2udFs8tCKEKffuJ4TB1idGUZiXdCPGi3IPBGWXarbLQ5UPXORV8QEVzJ4gCRduURMb5EkpNCdjbk0eDIuI8Yg==", + "version": "8.68.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.68.0.tgz", + "integrity": "sha512-MHy0Y0ynqeEbx/S45+i/bBssdy3X6KNBfmJAP35GrgtNxu2TQ5K5xsFDhAnmsq1jvpdoZOPG1LGtJo0HWqYCrQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.67.0", - "@typescript-eslint/parser": "8.67.0", - "@typescript-eslint/typescript-estree": "8.67.0", - "@typescript-eslint/utils": "8.67.0" + "@typescript-eslint/eslint-plugin": "8.68.0", + "@typescript-eslint/parser": "8.68.0", + "@typescript-eslint/typescript-estree": "8.68.0", + "@typescript-eslint/utils": "8.68.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" diff --git a/package.json b/package.json index 46f433f5..0ea8ff7c 100644 --- a/package.json +++ b/package.json @@ -142,7 +142,7 @@ "stylelint-config-recommended-scss": "^17.0.1", "stylelint-scss": "^7.2.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.67.0", + "typescript-eslint": "^8.68.0", "uuid": "^14.0.2", "vite": "^8.2.2", "vite-plugin-istanbul": "^9.0.1", From 6c270c291480c27265934cbb16325a7a7f2c5ae8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:54:08 +0000 Subject: [PATCH 17/20] chore(deps-dev): Bump i18next-cli from 1.71.0 to 1.71.2 (#2111) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [i18next-cli](https://github.com/i18next/i18next-cli) from 1.71.0 to 1.71.2.
Changelog

Sourced from i18next-cli's changelog.

1.71.2

  • fix: extract no longer scales quadratically with the number of keys: selector-API / returnObjects keys are matched via an O(key depth) Set lookup instead of one regex per object key, and the per-key leaf check uses a precomputed ancestor-prefix Set instead of scanning all keys. A 4-minute run on a ~11,500-key monorepo drops to seconds; written output is byte-identical (#286).

1.71.1

  • feat: .reduce()/.reduceRight() over an as const array now bind the element callback parameter (the second one, (acc, el) => …) like .map()/.forEach() already did, so ERRORS.reduce((acc, n) => { acc[n] = t(`errors.${n}.title`) }, {}) extracts every element without the (typeof ERRORS)[number] cast workaround (#285).
Commits
  • dacfb22 1.71.2
  • bfa79b1 fix: make extract scale linearly with key count (#286)
  • a4970f8 1.71.1
  • e3c5676 feat: bind the element callback param of .reduce()/.reduceRight() over as-con...
  • e8abf5b chore: update dependencies and bump CI actions to v7
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next-cli&package-manager=npm_and_yarn&previous-version=1.71.0&new-version=1.71.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 168 +++++++++++++++++++++++----------------------- package.json | 2 +- 2 files changed, 85 insertions(+), 85 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5e887c89..9634f61c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -96,7 +96,7 @@ "eslint-plugin-react": "^7.37.5", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.4", - "i18next-cli": "^1.71.0", + "i18next-cli": "^1.71.2", "istanbul": "^0.4.5", "istanbul-lib-coverage": "^3.2.2", "nyc": "^18.0.0", @@ -1011,15 +1011,15 @@ } }, "node_modules/@inquirer/checkbox": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/@inquirer/checkbox/-/checkbox-5.2.1.tgz", - "integrity": "sha512-b6xmA/VlTe0ZgDQHDui+Nav470u7u49nRd8/iuhOcQPO9Ch7lGuogydhi2VOmNlZ+zXcM8IcPuNSwQcdJaF/kw==", + "version": "5.2.2", + "resolved": "https://registry.npmjs.org/@inquirer/checkbox/-/checkbox-5.2.2.tgz", + "integrity": "sha512-Y5/bAScMy5Y+9isCx0SKbyJebMCaXXX5em0kxkj115eZNscgV9srOHrgyfS0e5xAVymIfOh9piYBKDILktsMMg==", "dev": true, "license": "MIT", "dependencies": { "@inquirer/ansi": "^2.0.7", - "@inquirer/core": "^11.2.1", - "@inquirer/figures": "^2.0.7", + "@inquirer/core": "^12.0.0", + "@inquirer/figures": "^2.0.8", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1035,13 +1035,13 @@ } }, "node_modules/@inquirer/confirm": { - "version": "6.1.1", - "resolved": "https://registry.npmjs.org/@inquirer/confirm/-/confirm-6.1.1.tgz", - "integrity": "sha512-eb8DBZcz/2qHWQda4rk2JiQk5h9QV/cVHi1yjt0f69WFZMRFn0sJTye3EAP8icut8UDMjQPsaH5KbcOogefrFQ==", + "version": "6.2.0", + "resolved": "https://registry.npmjs.org/@inquirer/confirm/-/confirm-6.2.0.tgz", + "integrity": "sha512-SKXarWrYhtpqOEctf9XGCGy29QjsvJAM0Aq9ZR9z4Ns94OmpqudOly+aSEfNqUf9SwsQaUgY9+Z8hyzG0xX8fw==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", + "@inquirer/core": "^12.0.0", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1057,14 +1057,14 @@ } }, "node_modules/@inquirer/core": { - "version": "11.2.1", - "resolved": "https://registry.npmjs.org/@inquirer/core/-/core-11.2.1.tgz", - "integrity": "sha512-Qd6GJT1yVyrZZCfN8W2qKF5ApmqryXRhRKCuip8h01x2w/esJQ2XIYc6f9abMIHgKQdBfFTSOdbHRLAhuM09UA==", + "version": "12.0.0", + "resolved": "https://registry.npmjs.org/@inquirer/core/-/core-12.0.0.tgz", + "integrity": "sha512-+nnvFEXIB08CZNVXpvW3B+zHW96QXvGUjNKJ8NJIPqAZi5Kd4WhYt2S3C234ReepG1qw2HOlEUbjYVHBowXObA==", "dev": true, "license": "MIT", "dependencies": { "@inquirer/ansi": "^2.0.7", - "@inquirer/figures": "^2.0.7", + "@inquirer/figures": "^2.0.8", "@inquirer/type": "^4.0.7", "cli-width": "^4.1.0", "fast-wrap-ansi": "^0.2.0", @@ -1097,14 +1097,14 @@ } }, "node_modules/@inquirer/editor": { - "version": "5.2.2", - "resolved": "https://registry.npmjs.org/@inquirer/editor/-/editor-5.2.2.tgz", - "integrity": "sha512-ZRVd/oD+sYsUd5zVm0NflqEzlqfYCyHNsqkHl2oWXEUHs12tCbcSFi+wVFEvD8+LGRaMUsVrE7qeo6lSG/S1Vg==", + "version": "5.3.0", + "resolved": "https://registry.npmjs.org/@inquirer/editor/-/editor-5.3.0.tgz", + "integrity": "sha512-nnsP/IdJ8s83q7ZuObmgn12QM+uLCkab9E0Oordojbn62WUg1c+v9Ou/F/057pgh0ppX0W+Hj5bO/Dp5hsxQtA==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", - "@inquirer/external-editor": "^3.0.3", + "@inquirer/core": "^12.0.0", + "@inquirer/external-editor": "^3.0.4", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1120,13 +1120,13 @@ } }, "node_modules/@inquirer/expand": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/@inquirer/expand/-/expand-5.1.1.tgz", - "integrity": "sha512-YmQpenjbFSHAK3sOd44puHh3V1KXXr+JiNpUztoSQ4drLh2rTVzTap/YtlAVu/5xavifIlBfNEzJ/neZJ1a/1g==", + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/@inquirer/expand/-/expand-5.1.2.tgz", + "integrity": "sha512-OWIH1IyyWqEKIyqC9Xy+Bnga7NkGMovFdo4atYZMUOTRqf6rO2WCv9E/1MyzvOErDBCxs+9UFliRUDc50xs/jw==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", + "@inquirer/core": "^12.0.0", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1142,9 +1142,9 @@ } }, "node_modules/@inquirer/external-editor": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-3.0.3.tgz", - "integrity": "sha512-6thf5I8q7lZwzGLAxPaaGEREEkZ3nyePPDQ1oyobblxmEE8mqTLguScP7pDjUTAibiyb4hfXl+qjUEJ+di/aNA==", + "version": "3.0.4", + "resolved": "https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-3.0.4.tgz", + "integrity": "sha512-tZbbaK2ovq6vlrRBNQvjrypmrED/p5x2ncIHQ79cD55tei3dD96v5glMMA+6tiq7K104i/25DVYKWVPJuV6ptA==", "dev": true, "license": "MIT", "dependencies": { @@ -1164,9 +1164,9 @@ } }, "node_modules/@inquirer/figures": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-2.0.7.tgz", - "integrity": "sha512-aJ8TBPOGB6f/2qziPfElISTCEd5XOYTFckA2SGjhNmiKzfK/u4ot3v0DUzGVdUnKjN10EqnnEPck36BkyfLnJw==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/@inquirer/figures/-/figures-2.0.8.tgz", + "integrity": "sha512-tApbon79GM9ry56ja/Ud3SY2CL4TQsao9fIwDQbgTeNY55025GdMzQ2+UdegV/lx51VNGUB59M0v0nMpybYY4Q==", "dev": true, "license": "MIT", "engines": { @@ -1174,13 +1174,13 @@ } }, "node_modules/@inquirer/input": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/@inquirer/input/-/input-5.1.2.tgz", - "integrity": "sha512-9K/DDBSQpOyZSkt6sOVP9Vo0TR7atX2kuILsUu0x3wVcVbe97lJwIJKMLdMw25tDYuXl/qp6erT0Xs1rfmcfZg==", + "version": "5.1.3", + "resolved": "https://registry.npmjs.org/@inquirer/input/-/input-5.1.3.tgz", + "integrity": "sha512-F/BZHtyEzP+HO+IGVd4AjBRgvX/ywm42bx8S0+dENk2YclzE9tJ3X/15THwtT6ehApmKvdYDMsVTuyyDod0gOQ==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", + "@inquirer/core": "^12.0.0", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1196,13 +1196,13 @@ } }, "node_modules/@inquirer/number": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/@inquirer/number/-/number-4.1.1.tgz", - "integrity": "sha512-XF4IXAbPnGPgw0wsbC/i2tPcyfdZgDpUlhsqU0SfT4IRIGWha6Xm9VRgN5yYxJq+jnyXlfXI/nQ3ulfk0iEICA==", + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/@inquirer/number/-/number-4.2.0.tgz", + "integrity": "sha512-ew+fSDijsQ/WhD4TV3XLb+if400cDuzTzHfGR8sTNBXkK9CYDWoGE8fhaO8GbT312pNv1AJEOsDxy/z/HVettA==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", + "@inquirer/core": "^12.0.0", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1218,14 +1218,14 @@ } }, "node_modules/@inquirer/password": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/@inquirer/password/-/password-5.1.1.tgz", - "integrity": "sha512-3XBfF7DAsp5qeDsvN5Rd1HmbNokVvEQoUM0QLrRcybC9nX96w3Pbmu7qUsb3IT3J3jBvs2+mTXaKHOUsgHMLzg==", + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/@inquirer/password/-/password-5.1.2.tgz", + "integrity": "sha512-nSdufycW8xynEVssFkNQEYIzTySilog0UlfOVRwh3pXzPSk4frXUT2jZWjHnKae6RU9PaoF9wfy1pGwewQuqGw==", "dev": true, "license": "MIT", "dependencies": { "@inquirer/ansi": "^2.0.7", - "@inquirer/core": "^11.2.1", + "@inquirer/core": "^12.0.0", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1241,22 +1241,22 @@ } }, "node_modules/@inquirer/prompts": { - "version": "8.5.2", - "resolved": "https://registry.npmjs.org/@inquirer/prompts/-/prompts-8.5.2.tgz", - "integrity": "sha512-IYR/3C/paEVVQYQvdDlFZVjRCJVYHHON0XXMH91KO9GSxs0TdKYWlUdvfQl2EfAHDxUaN3IBffkE/BDTh5nJ6g==", + "version": "8.6.0", + "resolved": "https://registry.npmjs.org/@inquirer/prompts/-/prompts-8.6.0.tgz", + "integrity": "sha512-WgBVDRy3IQ4v9XMCpQ1YDGpso2PcMUxYJzZdH4Nt4t0eoXhEPmOCh5iZbXbR4GTbdUB9VPWBbJB12rkjbaGDCw==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/checkbox": "^5.2.1", - "@inquirer/confirm": "^6.1.1", - "@inquirer/editor": "^5.2.2", - "@inquirer/expand": "^5.1.1", - "@inquirer/input": "^5.1.2", - "@inquirer/number": "^4.1.1", - "@inquirer/password": "^5.1.1", - "@inquirer/rawlist": "^5.3.1", - "@inquirer/search": "^4.2.1", - "@inquirer/select": "^5.2.1" + "@inquirer/checkbox": "^5.2.2", + "@inquirer/confirm": "^6.2.0", + "@inquirer/editor": "^5.3.0", + "@inquirer/expand": "^5.1.2", + "@inquirer/input": "^5.1.3", + "@inquirer/number": "^4.2.0", + "@inquirer/password": "^5.1.2", + "@inquirer/rawlist": "^5.3.2", + "@inquirer/search": "^4.3.0", + "@inquirer/select": "^5.2.2" }, "engines": { "node": ">=23.5.0 || ^22.13.0 || ^20.17.0" @@ -1271,13 +1271,13 @@ } }, "node_modules/@inquirer/rawlist": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/@inquirer/rawlist/-/rawlist-5.3.1.tgz", - "integrity": "sha512-QqdTqQddL3qPX/PPrjobpsO25NZ4dWXgTLenrR445L2ptLEYE6Z+PD5c5CNDJNx4ugRgELAIpSIJxZaO2jJ2Og==", + "version": "5.3.2", + "resolved": "https://registry.npmjs.org/@inquirer/rawlist/-/rawlist-5.3.2.tgz", + "integrity": "sha512-oPSKrYK1X1bMkjXDzIKHUkJp195LFSfgbnVtXnjSKGFjrCbS6I+wyvfAZTwKE9BSt3HwWgfD7JfsXALBgCogzQ==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", + "@inquirer/core": "^12.0.0", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1293,14 +1293,14 @@ } }, "node_modules/@inquirer/search": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/@inquirer/search/-/search-4.2.1.tgz", - "integrity": "sha512-xJj8QWKRSrfKoBIITLZK61dD3zwo0Rz11fgDImku30/Oe81zMdIdGgrLY2h6RkJ+KZ/GhNYIRMKnH/62qBTA5g==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/@inquirer/search/-/search-4.3.0.tgz", + "integrity": "sha512-HFxXE5w727ctSUcAwrDquftJGjMgu36OeV5SHEXMlr2j/ahzmRX9xSEeVolV8tzYnTf45cg6vGkdMMRdm3RPhQ==", "dev": true, "license": "MIT", "dependencies": { - "@inquirer/core": "^11.2.1", - "@inquirer/figures": "^2.0.7", + "@inquirer/core": "^12.0.0", + "@inquirer/figures": "^2.0.8", "@inquirer/type": "^4.0.7" }, "engines": { @@ -1316,15 +1316,15 @@ } }, "node_modules/@inquirer/select": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/@inquirer/select/-/select-5.2.1.tgz", - "integrity": "sha512-FlDndEUww8m7BfukO2nJa25vhD+H5jxxCv4oGioKqzyWz3nPHhhw4LKdYRSlXuAx7DsdWia7iyaBPKKS95Evfw==", + "version": "5.2.2", + "resolved": "https://registry.npmjs.org/@inquirer/select/-/select-5.2.2.tgz", + "integrity": "sha512-RkI8dRHWt+bh04oLixvF1kFzKC7e5rqJoHKkzcqSHATebBXFC6GmrT8ddbVkgSzLV0HnHs2cPFuBINr8otij8Q==", "dev": true, "license": "MIT", "dependencies": { "@inquirer/ansi": "^2.0.7", - "@inquirer/core": "^11.2.1", - "@inquirer/figures": "^2.0.7", + "@inquirer/core": "^12.0.0", + "@inquirer/figures": "^2.0.8", "@inquirer/type": "^4.0.7" }, "engines": { @@ -6739,28 +6739,28 @@ } }, "node_modules/i18next-cli": { - "version": "1.71.0", - "resolved": "https://registry.npmjs.org/i18next-cli/-/i18next-cli-1.71.0.tgz", - "integrity": "sha512-brMJzTTrYjr3DzI0ZrjqZxHvQf2Ty2RRvoGCsKii1IwjIt8ojM2E2wql2oLuGGa3KkDxW3bOgbwP/hULA5EBLQ==", + "version": "1.71.2", + "resolved": "https://registry.npmjs.org/i18next-cli/-/i18next-cli-1.71.2.tgz", + "integrity": "sha512-yohuW82U5OSFxaJYRzHKVIEuee90CuXMFLJ5QPvduqo2QL7pKPXq9ViV+Em4dv83mkySJ+RcX3IE3rA6cxjhbQ==", "dev": true, "license": "MIT", "dependencies": { "@croct/json5-parser": "^0.2.2", - "@swc/core": "^1.16.0", + "@swc/core": "^1.16.1", "chokidar": "^5.0.0", "commander": "^15.0.0", "execa": "^10.0.1", "glob": "^13.0.6", - "i18next": "^26.3.6", + "i18next": "^26.4.0", "i18next-resources-for-ts": "^2.1.0", - "inquirer": "^14.0.2", + "inquirer": "^14.1.0", "jiti": "^2.7.0", "jsonc-parser": "^3.3.1", - "magic-string": "^1.2.0", + "magic-string": "^1.2.2", "minimatch": "^10.2.6", "ora": "^9.4.1", "react": "^19.2.8", - "react-i18next": "^17.0.11", + "react-i18next": "^17.0.12", "yaml": "^2.9.0" }, "bin": { @@ -6980,15 +6980,15 @@ "license": "MIT" }, "node_modules/inquirer": { - "version": "14.0.2", - "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-14.0.2.tgz", - "integrity": "sha512-VsSx1JneSNp3ld1veMTLe+UDcUD8Tw2/jjOthhkX3/IX2q+xHhVELifeb/hsb1fBw31pabEPNUf/xUOyb+KZjA==", + "version": "14.1.0", + "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-14.1.0.tgz", + "integrity": "sha512-UY08KP08ugc/m0XOBX+tNRl5GK5PrjesiRYM7RDMVczWC0m640GF768Dmosvm1j5OptM3Or6QXvowaJqdWzR0w==", "dev": true, "license": "MIT", "dependencies": { "@inquirer/ansi": "^2.0.7", - "@inquirer/core": "^11.2.1", - "@inquirer/prompts": "^8.5.2", + "@inquirer/core": "^12.0.0", + "@inquirer/prompts": "^8.6.0", "@inquirer/type": "^4.0.7", "mute-stream": "^3.0.0", "run-async": "^4.0.6" @@ -8448,9 +8448,9 @@ } }, "node_modules/magic-string": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.2.1.tgz", - "integrity": "sha512-vCfXkt3lIJha02CjPT1igeysyHVfCsEpIeD20O+X9aJ2hML3/kKx8E9Iv1FB+aMSAlDOEAtpRWzuooQCrYwdUg==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.2.2.tgz", + "integrity": "sha512-veT/+7iXrXzT39XnEN4lOxtNl72dMgJ8Lp+5Bd6YcMSWpb0n0MjBM8Uuooi6jgJr8dhUW2swQgBmoZVMni5SVg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 0ea8ff7c..d2ad25df 100644 --- a/package.json +++ b/package.json @@ -131,7 +131,7 @@ "eslint-plugin-react": "^7.37.5", "eslint-plugin-react-hooks": "^7.1.1", "eslint-plugin-react-refresh": "^0.5.4", - "i18next-cli": "^1.71.0", + "i18next-cli": "^1.71.2", "istanbul": "^0.4.5", "istanbul-lib-coverage": "^3.2.2", "nyc": "^18.0.0", From a4146f63947c4cf157e7658acd142f088396af0c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:54:43 +0000 Subject: [PATCH 18/20] chore(deps): Bump ol-mapbox-style from 13.4.2 to 13.4.3 (#2114) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [ol-mapbox-style](https://github.com/openlayers/ol-mapbox-style) from 13.4.2 to 13.4.3.
Release notes

Sourced from ol-mapbox-style's releases.

v13.4.3

Summary

  • Fixed icon-rotate along lines

What's Changed

Full Changelog: https://github.com/openlayers/ol-mapbox-style/compare/v13.4.2...v13.4.3

Changelog

Sourced from ol-mapbox-style's changelog.

13.4.3

  • Fixed icon-rotate along lines

13.4.1

  • Invalidate function/filter cache on remove/addMapboxLayer

13.4.0

  • New hillshading options
  • Support for the line-offset paint property

13.3.0

  • Better match MapLibre's hillshade rendering
  • Improved support for latest Mapbox style spec additions: data-driven visibility, data-driventext-font array entries, config to retrieve defaults from style's schema root properties, hsl, hsla and to-hsla expressions
  • Darkened outlines depending on fill-extrusion-height for fill-extrusion layers
  • More robustness against failures due to unsupported features

13.2.1

  • Prevent redundant font loading requests
  • Ignore source on background layer
  • Encourage the use of ol/layer/Group with apply()

13.2.0

  • Add support for raster-hue-rotate, raster-saturation, raster-opacity
  • Fix hillshade colors

13.1.1

  • Add support for running ol-mapbox-style in web workers

13.1.0

  • Respect the layerName property of the source format, instead of using mvt:layer
  • updateMapboxLayer now also works with raster layers

13.0.1

  • Clear text width measurement cache when new fonts are loaded

13.0.0

Backwards incompatible changes

  • The MVT format parser now assigns the tile's source-layers to the mvt:layer property of each feature. Previously the layer property was used, which was not ideal because it is frequently used in OpenStreetMap based tiles. This change may require application code changes where OpenLayers feature info (Map.getFeaturesAtPixel(), Map.forEachFeatureAtPixel(), Layer.getFeatures()) or style function customizations are used.

... (truncated)

Commits
  • 5fc995e Changes for 13.4.3
  • a3c9e12 Merge pull request #1506 from openlayers/dependabot/npm_and_yarn/multi-e855e3...
  • a8d3f64 Merge pull request #1504 from openlayers/dependabot/npm_and_yarn/js-yaml-4.3.1
  • 1443800 Merge pull request #1502 from openlayers/dependabot/npm_and_yarn/fast-uri-3.1.5
  • 238e971 Merge pull request #1501 from openlayers/dependabot/npm_and_yarn/socket.io-pa...
  • 9a7f4b6 Merge pull request #1498 from openlayers/dependabot/npm_and_yarn/sinon-22.1.0
  • 23e1458 Merge pull request #1497 from openlayers/dependabot/npm_and_yarn/webpack-5.109.0
  • f930545 Merge pull request #1496 from openlayers/dependabot/npm_and_yarn/proj4-2.20.9
  • 143b7a4 Merge pull request #1495 from openlayers/dependabot/npm_and_yarn/globals-17.8.0
  • 562b69f Merge pull request #1507 from openlayers/style-spec-update
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ol-mapbox-style&package-manager=npm_and_yarn&previous-version=13.4.2&new-version=13.4.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 29 +++++------------------------ package.json | 2 +- 2 files changed, 6 insertions(+), 25 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9634f61c..2d68f354 100644 --- a/package-lock.json +++ b/package-lock.json @@ -45,7 +45,7 @@ "maplibre-gl": "^6.6.0", "maputnik-design": "github:maputnik/design#172b06c", "ol": "^10.10.0", - "ol-mapbox-style": "^13.4.2", + "ol-mapbox-style": "^13.4.3", "pmtiles": "^4.5.0", "prop-types": "^15.8.1", "react": "^19.2.8", @@ -9784,12 +9784,12 @@ } }, "node_modules/ol-mapbox-style": { - "version": "13.4.2", - "resolved": "https://registry.npmjs.org/ol-mapbox-style/-/ol-mapbox-style-13.4.2.tgz", - "integrity": "sha512-UJNNr8rEfLGullGHfdfxwpoisLAteHJ+WdSmT4VewDn5BgTkTJX1zGGQ997NYGTJxJpbW44Q9rKo8BJOKIB2Lg==", + "version": "13.4.3", + "resolved": "https://registry.npmjs.org/ol-mapbox-style/-/ol-mapbox-style-13.4.3.tgz", + "integrity": "sha512-fqoYg2AncNlLwtR2cj86WqsKOtYEyNsJg+jqC6TkrBEc8Mi9elOkdyU7X60ZDv4AohhwuH29UKkegIYZLM6qOQ==", "license": "BSD-2-Clause", "dependencies": { - "@maplibre/maplibre-gl-style-spec": "^24.4.1", + "@maplibre/maplibre-gl-style-spec": "^26.4.0", "mapbox-to-css-font": "^3.2.0" }, "funding": { @@ -9799,25 +9799,6 @@ "ol": "*" } }, - "node_modules/ol-mapbox-style/node_modules/@maplibre/maplibre-gl-style-spec": { - "version": "24.10.0", - "resolved": "https://registry.npmjs.org/@maplibre/maplibre-gl-style-spec/-/maplibre-gl-style-spec-24.10.0.tgz", - "integrity": "sha512-lichxSiagMEBBrqHF0trtMQH9RKh+9jUlIJl0qW0QHvt2H/tbvUWdE+ZzI2Jd0/pT7j/iavLonlPu7EQ/ixTOw==", - "license": "ISC", - "dependencies": { - "@mapbox/jsonlint-lines-primitives": "~2.0.2", - "@mapbox/unitbezier": "^1.0.0", - "json-stringify-pretty-compact": "^4.0.0", - "minimist": "^1.2.8", - "quickselect": "^3.0.0", - "tinyqueue": "^3.0.0" - }, - "bin": { - "gl-style-format": "dist/gl-style-format.mjs", - "gl-style-migrate": "dist/gl-style-migrate.mjs", - "gl-style-validate": "dist/gl-style-validate.mjs" - } - }, "node_modules/once": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", diff --git a/package.json b/package.json index d2ad25df..dbb1dbd7 100644 --- a/package.json +++ b/package.json @@ -63,7 +63,7 @@ "maplibre-gl": "^6.6.0", "maputnik-design": "github:maputnik/design#172b06c", "ol": "^10.10.0", - "ol-mapbox-style": "^13.4.2", + "ol-mapbox-style": "^13.4.3", "pmtiles": "^4.5.0", "prop-types": "^15.8.1", "react": "^19.2.8", From 936b801000dc9068d035402522f07e950935331a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 17:42:34 +0300 Subject: [PATCH 19/20] chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.8 (#2105) Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8.
Release notes

Sourced from github/codeql-action/init's releases.

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits
  • db488dd Merge pull request #4102 from github/update-v4.37.8-9ee088e13
  • 1845f5b Update changelog for v4.37.8
  • 9ee088e Merge pull request #4080 from github/henrymercer/studious-giggle
  • 1aef003 Address review feedback on overlay disk flags
  • 508b83b Merge main into overlay minimum disk feature branch
  • d97b342 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error
  • 47fa622 Make EACCES a ConfigurationError
  • 45693cc Refactor ENOSPC check into isDiskConfigurationError function
  • c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
  • c56f48e Log unexpected conditions during caching CLI output
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action/init&package-manager=github_actions&previous-version=4.37.7&new-version=4.37.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 85e72418..42b52e87 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -42,7 +42,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. From 5e2d322c5abc96a1281eca0cd948b3f61912522a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 17:43:03 +0300 Subject: [PATCH 20/20] chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.8 (#2104) Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.37.7 to 4.37.8.
Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

... (truncated)

Commits
  • db488dd Merge pull request #4102 from github/update-v4.37.8-9ee088e13
  • 1845f5b Update changelog for v4.37.8
  • 9ee088e Merge pull request #4080 from github/henrymercer/studious-giggle
  • 1aef003 Address review feedback on overlay disk flags
  • 508b83b Merge main into overlay minimum disk feature branch
  • d97b342 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error
  • 47fa622 Make EACCES a ConfigurationError
  • 45693cc Refactor ENOSPC check into isDiskConfigurationError function
  • c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
  • c56f48e Log unexpected conditions during caching CLI output
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action/analyze&package-manager=github_actions&previous-version=4.37.7&new-version=4.37.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 42b52e87..07e98314 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -67,4 +67,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8