Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.9</h2> <h2>Security</h2> <p>This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.</p> <ul> <li><strong>Medium — URI scheme spoofing through percent-encoded schemes</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg">GHSA-w74x-v6f9-j3xg</a>, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.</li> <li><strong>Medium — Host confusion during domain-host canonicalization</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr">GHSA-wjr9-j795-jxcr</a>, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.</li> <li><strong>Low — Incorrect relative-reference normalization</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h">GHSA-xhq7-xmqj-769h</a>, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.</li> <li><strong>Low — Scheme injection in suffix references</strong> (<a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp">GHSA-333x-w4r6-6crp</a>, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.</li> </ul> <p>Upgrade with:</p> <pre lang="sh"><code>npm install fast-uri@3.1.9 </code></pre> <p>Thanks to <a href="https://github.com/zekth"><code>@zekth</code></a> for reporting the scheme, host, and relative-reference issues, and to <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> for finding the suffix-reference issue and reviewing the remediations.</p> <h2>What's Changed</h2> <ul> <li>ci: enable trusted publishing releases (v3.x) by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/fastify/fast-uri/pull/229">fastify/fast-uri#229</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9">https://github.com/fastify/fast-uri/compare/v3.1.8...v3.1.9</a></p> <h2>v3.1.8</h2> <h2>⚠️ Security Warning</h2> <p>This security release fixes the following medium-severity security advisory:</p> <ul> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj">GHSA-hrr3-gc8f-f4qj</a> — inconsistent host case normalization via percent-encoded octets</li> </ul> <p>Users of the v3.x release line should upgrade to v3.1.8.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8">https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/0def70338a0fa2f12a10c83ae8eafc2139ae9a07"><code>0def703</code></a> Bumped v3.1.9</li> <li><a href="https://github.com/fastify/fast-uri/commit/a1d0da2f5c703244027c1b204c1aebd0516da338"><code>a1d0da2</code></a> test: generate only relative path references</li> <li><a href="https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd"><code>9eb8759</code></a> fix: preserve relative paths in suffix and relative resolution</li> <li><a href="https://github.com/fastify/fast-uri/commit/54c30f75891b74e5a4393b44be9ea7ba43dd1e4b"><code>54c30f7</code></a> docs: note suffix-reference authority ambiguity</li> <li><a href="https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e"><code>39e6493</code></a> fix: escape a first-segment colon in suffix references</li> <li><a href="https://github.com/fastify/fast-uri/commit/745183c1d9d98d113bed8a57bb1c9ceaf0147b7a"><code>745183c</code></a> test: cover first-segment colon in suffix references</li> <li><a href="https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c"><code>ddfc6a5</code></a> fix(SEC-03): reject non reg-name characters in domain hosts</li> <li><a href="https://github.com/fastify/fast-uri/commit/d86a8d29f45187819dac2d4fe171c35e3e488264"><code>d86a8d2</code></a> fix: keep a colon-first segment behind "./" in relative normalization</li> <li><a href="https://github.com/fastify/fast-uri/commit/eb483b5da2580bdecb8af644bbfee878d5424850"><code>eb483b5</code></a> test: cover colon-first relative references in normalization</li> <li><a href="https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424"><code>b110a35</code></a> fix(SEC-02): preserve meaning of relative references during normalization</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.9">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for fast-uri since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/maplibre/maputnik/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Maputnik
A free and open visual editor for the MapLibre GL styles targeted at developers and map designers.
Usage
- 🔗 Design your maps online at https://www.maplibre.org/maputnik/ (all in local storage)
- 🔗 Use the Maputnik CLI for local style development
- In a Docker, run this command and browse to http://localhost:8888, Ctrl+C to stop the server.
docker run -it --rm -p 8888:8000 ghcr.io/maplibre/maputnik:main
To see the CLI options (for example file watching or style serving) run:
docker run -it --rm -p 8888:8000 ghcr.io/maplibre/maputnik:main --help
You might need to mount a volume (-v) to be able to use these options.
Documentation
The documentation can be found in the Wiki. You are welcome to collaborate!
- 🔗 Study the Maputnik Wiki
- 📹 Design a map from Scratch https://youtu.be/XoDh0gEnBQo
Develop
Maputnik is written in typescript and is using React and MapLibre GL JS.
We ensure building and developing Maputnik works with the current active LTS Node.js version and above.
Check out our Internationalization guide for UI text related changes.
Getting Involved
Join the #maplibre or #maputnik slack channel at OSMUS: get an invite at https://slack.openstreetmap.us/ Read the the below guide in order to get familiar with how we do things around here.
Install the deps, start the dev server and open the web browser on http://localhost:8888/.
# install dependencies
npm install
# start dev server
npm run start
If you want Maputnik to be accessible externally use the --host option:
# start externally accessible dev server
npm run start -- --host 0.0.0.0
The build process will watch for changes to the filesystem, rebuild and autoreload the editor.
npm run build
Lint the JavaScript code.
# run linter
npm run lint
npm run lint-css
npm run sort-styles
Tests
End-to-end tests
For E2E testing we use Playwright. The tests live in the e2e directory and drive the app through the MaputnikDriver page object.
The first time you run the tests, install the browser:
npx playwright install chromium
Playwright automatically starts the dev server (npm run start) for you, so you can just run:
npm run test
Some useful options:
# see the tests run in a headed browser
npm run test -- --headed
# run a single spec / filter by title
npm run test -- e2e/map.spec.ts
npm run test -- -g "zoom level"
# open the interactive UI mode
npx playwright test --ui
Running the E2E tests also produces a code-coverage report in coverage/ (collected via istanbul instrumentation of the dev server).
Unit & component tests
Unit tests and component tests run with Vitest; component tests (*.browser.test.tsx) use Vitest's browser mode with the Playwright provider.
npm run test-unit
Release process
- Review
CHANGELOG.md- Double-check that all changes included in the release are appropriately documented.
- To-be-released changes should be under the "main" header.
- Commit any final changes to the changelog.
- Run Create bump version PR by manual workflow dispatch and set the version number in the input. This will create a PR that changes the changelog and
package.jsonfile to review and merge. - Once merged, an automatic process will kick in and creates a GitHub release and uploads release assets.
Sponsors
Thanks to the supporters of the Kickstarter campaign. This project would not be possible without these commercial and individual sponsors. You can see this file's history for previous sponsors of the original Maputnik repo. Read more about the MapLibre Sponsorship Program at https://maplibre.org/sponsors/.
License
Maputnik is licensed under MIT and is Copyright (c) Lukas Martinelli and Maplibre contributors. As contributor please take extra care of not violating any Mapbox trademarks. Do not get inspired by other map studios and make your own decisions for a good style editor.
