mirror of
https://github.com/opengeos/GeoLibre.git
synced 2026-11-04 10:43:36 +00:00
Qiusheng Wu
1c3bec9869
* fix(map): load Mapbox GL from its CDN instead of bundling it
Mapbox GL JS v2+ is proprietary, but the web, desktop and store builds
and the Python wheel have shipped it as a chunk since v3.1.0. Load the
script and stylesheet from Mapbox's CDN when a Mapbox pane mounts, pinned
by version and SRI hash to the installed package. The build now fails if
mapbox-gl reaches a chunk.
Also ship the gdal3.js LGPL license and a source link with every build,
and link third-party licenses from the About dialog.
* fix(deps): upgrade node-forge to 1.4.2 for new advisories
Five high node-forge advisories published on 2026-10-30 fail the audit
gate on every PR. All are patched in 1.4.1, which also clears the only
allowlist entry, so drop it.
* Address review feedback
- Inline the Mapbox stylesheet through fetch. A <link> was blocked by
style-src in both CSPs, so every Mapbox pane failed outside vite preview.
- Refuse the CDN load in GEOLIBRE_NO_EXTERNAL_CDN builds and document it.
- Make the test's fake remove() idempotent, as a real element's is.
- Use new Map() for the empty audit allowlist.
* Fix stylesheet URL assertion in the Mapbox loader test
SVG data URIs contain url(#clip) references of their own, so strip whole
data URIs before asserting that no other url() remains.
* fix(map): stop MapLibre's class registry breaking Mapbox tiles
MapLibre 6 permanently sets _classRegistryKey on the global Set and Error.
Mapbox's serializer reads the same property, fails looking the key up in
its own registry, and no tile loads ("reading 'omit'"). Rename MapLibre's
private copy at build time, including in the dev dependency optimizer.
Also theme Mapbox's native and shared map controls in dark mode, and
retry only the failed half of the CDN load.
* fix(map): keep Mapbox control hover readable in dark mode
mapbox-gl paints #eee behind any hovered button in a control, so the
layer control's unclassed toggle lost its light icon against the
background. Use the theme's accent color in dark mode.
* Address review feedback
- Keep Mapbox's active geolocate icon colored in dark mode, as on MapLibre.
- Reload a script that ran without defining mapboxgl, since it still fires
load.
- Cover a stylesheet-only retry, and reset the loader between tests.
- Wait for the style in the retry test instead of relying on microtask
order.
- Fail the registry contract test if the plugin stops matching MapLibre.
* Address review feedback
- Reject any Mapbox GL module at load time, so its stylesheet is caught as
well as its script.
- Keep the MapLibre registry rename the same length, so source maps stay
correct.
- Leave the inverted attribution button out of the dark hover color, which
the invert would turn light behind its icon.
* Address review feedback
- Describe the dark hover rule's specificity correctly in its comment.