Skip to content

⬆️ Bump the npm_and_yarn group across 2 directories with 3 updates - #216

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-35a08643e1
Closed

⬆️ Bump the npm_and_yarn group across 2 directories with 3 updates#216
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-35a08643e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 2 updates in the / directory: maplibre-gl and undici.
Bumps the npm_and_yarn group with 2 updates in the /docusaurus directory: undici and image-size.

Updates maplibre-gl from 5.24.0 to 6.11.2

Release notes

Sourced from maplibre-gl's releases.

v6.11.2

✨ Features and improvements

  • Improve rendering performance by uploading each tile's projection data once per frame instead of before every draw call (#8545) (by @​birkskyum)
  • Support multiple glyph variants in requests, caches, and atlases (#8488) (by @​NEKOYASAN)

🐞 Bug fixes

  • Fix Map#once(type, layerId, listener) unsubscribing on the first event that misses the layer instead of the first event that hits it (#8499) (by @​cherenkov)
  • Remove hillshade gradient toward the poles (#8551) (by @​birkskyum)
  • Fix camera settings being undone during camera movement with terrain or transformCameraUpdate (#8550) (by @​birkskyum)
  • Fix zooming and panning with the pointer above the horizon moving the map in the opposite direction (#8544) (by @​birkskyum)
  • Fix the camera jumping when a drag over terrain ends at a pitch above 84° (#8541) (by @​birkskyum)
  • Ease the center elevation over terrain during easeTo and flyTo instead of holding it and jumping when the animation ends (#8543) (by @​johncarmack1984)
  • Fix fitBounds and cameraForBounds throwing on the globe projection when the padding exceeds the viewport, instead of warning and returning undefined as on mercator (#8538) (by @​drakeo338)
  • Keep raster tiles sharp at a fractional devicePixelRatio, where the canvas covered a different number of device pixels than its backing store held and the compositor rescaled it (#1590) (by @​zdila)

v6.11.1

🐞 Bug fixes

  • Fix missing promoteId when merging queued updateData diffs in geojson source (#8500) (by @​cherenkov)
  • Sanitize attribution with an allow list of tags and attributes rather than a list of known-dangerous ones (#8532) (by @​HarelM)
  • Fix the camera jumping or bobbing around gestures over terrain, and ignoring terrain that loads after easeTo/flyTo (#8471) (by @​johncarmack1984)
  • Stop sending a vector tile to the worker when it was dropped while its request was being transformed or while the worker was still starting up, which left the parsed tile in the worker for the lifetime of the map (#8516) (by @​cherenkov)

v6.11.0

✨ Features and improvements

  • Fire a contextmenu map event on long press for touch devices (#373) (by @​kirthi-b)
  • Transition paint, light and sky properties that read global-state from the value they had when the state changes, where they snapped to the new value while holding idle for the transition duration (#8395) (by @​avosa)
  • Speed up cross-tile symbol matching for sources with promoteId by keying symbols on their feature id as well as their label (#8470, continues #7665) (by @​bradymadden97 and @​johncarmack1984)
  • Add Map#calculateAnchoredCameraOptions to calculate camera options that place a geographic anchor at a screen position without moving the map (#8288) (by @​xavierjs)
  • Skip the loaded-tile scan for constant symbol-height-offset layers when computing tile coverage (#8424) (by @​clement-igonet)
  • Type and document that an addProtocol handler may return an ImageBitmap or HTMLImageElement for an image resource, so decoded pixels are not encoded and decoded again (#8515) (by @​MannXo)

🐞 Bug fixes

  • Fade the globe atmosphere in with the camera's altitude, so the sky keeps the horizon until the atmosphere takes over from space (#8464) (by @​birkskyum)
  • Report worker script failures through the map error event (#8018) (by @​xavierjs)
  • Fix slow panning and zooming in Firefox on macOS since 6.8.0 (#8468) (by @​timsluis and @​birkskyum)
  • Keep source-specific tile LOD settings from changing internal terrain render-to-texture tile selection (#8048) (by @​DoFabien)
  • Fix map.setSky() silently keeping the old sky and firing no error event when the value included a -transition key (#8375) (by @​Yasser-Ameur)
  • Fix markers and popups misplaced after a projection change or by terrain that loads after the map settled. (#8433) (by @​patte)
  • Insert sanitized attribution HTML as DOM nodes instead of re-parsing a serialized string (#8528) (by @​cherenkov)

v6.10.0

✨ Features and improvements

... (truncated)

Changelog

Sourced from maplibre-gl's changelog.

6.11.2

✨ Features and improvements

  • Improve rendering performance by uploading each tile's projection data once per frame instead of before every draw call (#8545) (by @​birkskyum)
  • Support multiple glyph variants in requests, caches, and atlases (#8488) (by @​NEKOYASAN)

🐞 Bug fixes

  • Fix Map#once(type, layerId, listener) unsubscribing on the first event that misses the layer instead of the first event that hits it (#8499) (by @​cherenkov)
  • Remove hillshade gradient toward the poles (#8551) (by @​birkskyum)
  • Fix camera settings being undone during camera movement with terrain or transformCameraUpdate (#8550) (by @​birkskyum)
  • Fix zooming and panning with the pointer above the horizon moving the map in the opposite direction (#8544) (by @​birkskyum)
  • Fix the camera jumping when a drag over terrain ends at a pitch above 84° (#8541) (by @​birkskyum)
  • Ease the center elevation over terrain during easeTo and flyTo instead of holding it and jumping when the animation ends (#8543) (by @​johncarmack1984)
  • Fix fitBounds and cameraForBounds throwing on the globe projection when the padding exceeds the viewport, instead of warning and returning undefined as on mercator (#8538) (by @​drakeo338)
  • Keep raster tiles sharp at a fractional devicePixelRatio, where the canvas covered a different number of device pixels than its backing store held and the compositor rescaled it (#1590) (by @​zdila)

6.11.1

🐞 Bug fixes

  • Fix missing promoteId when merging queued updateData diffs in geojson source (#8500) (by @​cherenkov)
  • Sanitize attribution with an allow list of tags and attributes rather than a list of known-dangerous ones (#8532) (by @​HarelM)
  • Fix the camera jumping or bobbing around gestures over terrain, and ignoring terrain that loads after easeTo/flyTo (#8471) (by @​johncarmack1984)
  • Stop sending a vector tile to the worker when it was dropped while its request was being transformed or while the worker was still starting up, which left the parsed tile in the worker for the lifetime of the map (#8516) (by @​cherenkov)

6.11.0

✨ Features and improvements

  • Fire a contextmenu map event on long press for touch devices (#373) (by @​kirthi-b)
  • Transition paint, light and sky properties that read global-state from the value they had when the state changes, where they snapped to the new value while holding idle for the transition duration (#8395) (by @​avosa)
  • Speed up cross-tile symbol matching for sources with promoteId by keying symbols on their feature id as well as their label (#8470, continues #7665) (by @​bradymadden97 and @​johncarmack1984)
  • Add Map#calculateAnchoredCameraOptions to calculate camera options that place a geographic anchor at a screen position without moving the map (#8288) (by @​xavierjs)
  • Skip the loaded-tile scan for constant symbol-height-offset layers when computing tile coverage (#8424) (by @​clement-igonet)
  • Type and document that an addProtocol handler may return an ImageBitmap or HTMLImageElement for an image resource, so decoded pixels are not encoded and decoded again (#8515) (by @​MannXo)

🐞 Bug fixes

  • Fade the globe atmosphere in with the camera's altitude, so the sky keeps the horizon until the atmosphere takes over from space (#8464) (by @​birkskyum)
  • Report worker script failures through the map error event (#8018) (by @​xavierjs)
  • Fix slow panning and zooming in Firefox on macOS since 6.8.0 (#8468) (by @​timsluis and @​birkskyum)
  • Keep source-specific tile LOD settings from changing internal terrain render-to-texture tile selection (#8048) (by @​DoFabien)
  • Fix map.setSky() silently keeping the old sky and firing no error event when the value included a -transition key (#8375) (by @​Yasser-Ameur)
  • Fix markers and popups misplaced after a projection change or by terrain that loads after the map settled. (#8433) (by @​patte)
  • Insert sanitized attribution HTML as DOM nodes instead of re-parsing a serialized string (#8528) (by @​cherenkov)

6.10.0

... (truncated)

Commits
  • acb7b72 Bump js version to 6.11.2 (#8555)
  • d28f844 fix: Map#once with layerId unsubscribes only after a real hit (#8499)
  • 99d0160 Support multiple glyph variants (#8488)
  • 98268d3 Fix globe cameraForBoxAndBearing throwing when padding exceeds the viewport (...
  • f560a83 Size the canvas to whole device pixels (#8513)
  • 7a897d0 Remove hillshade gradient toward the poles (#8551)
  • 0dff33a Fix camera settings being undone during camera movement (#8550)
  • c2031bf GM2.8 Upload projection data once per tile instead of once per draw (#8545)
  • 728a44c Fix zoom and drag above the horizon moving the map the wrong way (#8544)
  • 3dfdce0 refactor: one method builds the mercator animation's end transform (#8546)
  • Additional commits viewable in compare view

Updates undici from 6.28.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

Updates undici from 7.29.0 to 7.30.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

  • GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

  • GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

  • GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

Updates image-size from 2.0.2 to 2.0.4

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
⬆️ Bump the npm_and_yarn group across 2 directories with 3 updates
ccfd7ea 
Bumps the npm_and_yarn group with 2 updates in the / directory: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /docusaurus directory: [undici](https://github.com/nodejs/undici) and [image-size](https://github.com/image-size/image-size).


Updates `maplibre-gl` from 5.24.0 to 6.11.2
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](maplibre/maplibre-gl-js@v5.24.0...v6.11.2)

Updates `undici` from 6.28.0 to 6.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.28.0...v6.29.0)

Updates `undici` from 7.29.0 to 7.30.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.28.0...v6.29.0)

Updates `image-size` from 2.0.2 to 2.0.4
- [Release notes](https://github.com/image-size/image-size/releases)
- [Commits](https://github.com/image-size/image-size/commits)

---
updated-dependencies:
- dependency-name: maplibre-gl
  dependency-version: 6.11.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.30.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: image-size
  dependency-version: 2.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from Nick2bad4u as a code owner October 2, 2026 14:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 2, 2026
@github-actions

github-actions Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Greetings, thanks for opening a pull request, I'll look when I can.

@socket-security

socket-security Bot commented Oct 2, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedmaplibre-gl@​5.24.0 ⏵ 6.11.297 -1100 +7510099 +170

View full report

@codecov

codecov Bot commented Oct 2, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.09%. Comparing base (e09a1f8) to head (ccfd7ea).
⚠️ Report is 3 commits behind head on main.

Flag Coverage Δ
electron-app 63.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@@           Coverage Diff           @@
##             main     #216   +/-   ##
=======================================
  Coverage   63.09%   63.09%           
=======================================
  Files           8        8           
  Lines        1084     1084           
  Branches      208      208           
=======================================
  Hits          684      684           
  Misses        299      299           
  Partials      101      101

Impacted file tree graph

Components Coverage Δ
⚡ Core Electron Process ∅ <ø> (∅)
Renderer & UI ∅ <ø> (∅)
Utilities 63.70% <ø> (ø)
FIT Parsing ∅ <ø> (∅)
Window State Management ∅ <ø> (∅)

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ebc066e...ccfd7ea. Read the comment docs.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@dependabot @github

dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 8, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-35a08643e1 branch October 8, 2026 03:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Nick2bad4u Nick2bad4u Awaiting requested review from Nick2bad4u Nick2bad4u is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants