chore(deps): Bump maplibre-gl from 6.3.0 to 6.4.1

[dependabot]

Bumps maplibre-gl from 6.3.0 to 6.4.1.

Release notes

Sourced from maplibre-gl's releases.

v6.4.1

🐞 Bug fixes

• Fix DOM.sanitize leaving dangerous attributes behind when multiple consecutive attributes are present. Iterating the live NamedNodeMap from elem.attributes while calling removeAttribute skipped the attribute directly after a removed one, so a second dangerous attribute (for example an ontoggle on a <details open> element) could survive sanitisation and later execute (#8189) (by @​0xKirisame)
• Give custom layers the live globe transition in CustomRenderMethodInput.defaultProjectionData.projectionTransition, which was hardcoded to 1 for the whole globe/mercator transition, so a custom layer jumped straight to the fully bent globe while every other layer eased (#8169) (by @​mondsichtung)

v6.4.0

✨ Features and improvements

• Avoid a per-query Array.sort() in cross-tile symbol matching (TileLayerIndex.findMatches), claiming the lowest-index unclaimed candidate in a single pass instead; reduces main-thread symbol-placement cost on dense/coincident symbol layers (#7797) (by @​pholmstr)
• Use texelFetch for exact DEM and color-relief elevation stop lookups instead of normalized texture coordinate arithmetic (#7640) (by @​johncarmack1984)
• Make default draggable markers keyboard-focusable and movable with the arrow keys (1 px per press, 10 px with Shift); custom marker elements stay application-owned (#8020) (by @​smmariquit)

🐞 Bug fixes

• Fix a permanent frame rate degradation after switching styles: every sprite reload marked its images as updated forever, making every in-view tile re-check and re-upload them on every frame. Also stop leaking the images of a replaced sprite, which were never removed from the image manager (#8052) (by @​HarelM)
• Prevent a rejected missing style image resolver from blocking successfully resolved images in the same batch (#8146) (by @​birkskyum)
• Explicitly request no browser color management when decoding raster-DEM tiles so their RGB-encoded elevation values are not changed (what would otherwise happen with gfx.color_management.mode = 1 in Firefox) (#8125) (by @​tnikkel)
• Let an abort reach an image or raster tile load that is still awaiting its transformRequest, so ImageSource.updateImage no longer loses the image it was just handed and an aborted tile is no longer fetched (#8071) (by @​mondsichtung)
• Fix raster tiles fading in again when they are reloaded, briefly flashing the map background, most visibly when switching projection (#8106) (by @​mondsichtung)
• Fix globe panning inverting and stalling near and across the poles by rotating the globe with a versor, keeping the drag direction consistent at every latitude. Panning also eases off as the cursor approaches the edge of the globe and continues past it, instead of stopping. The bearing is preserved while panning, as before (#5296) (by @​jcolot)
• Fix fill-extrusion-rounded-corner-distance producing spikes: corner arcs now land on the integer tile grid, and corners created by tile clipping are left sharp (#8153) (by @​HarelM)
• Fix a gesture which was held still before being released still flinging the map (#1303) (by @​zdila)

Changelog

Sourced from maplibre-gl's changelog.

6.4.1

🐞 Bug fixes

• Fix DOM.sanitize leaving dangerous attributes behind when multiple consecutive attributes are present. Iterating the live NamedNodeMap from elem.attributes while calling removeAttribute skipped the attribute directly after a removed one, so a second dangerous attribute (for example an ontoggle on a <details open> element) could survive sanitisation and later execute (#8189) (by @​0xKirisame)
• Give custom layers the live globe transition in CustomRenderMethodInput.defaultProjectionData.projectionTransition, which was hardcoded to 1 for the whole globe/mercator transition, so a custom layer jumped straight to the fully bent globe while every other layer eased (#8169) (by @​mondsichtung)

6.4.0

✨ Features and improvements

• Avoid a per-query Array.sort() in cross-tile symbol matching (TileLayerIndex.findMatches), claiming the lowest-index unclaimed candidate in a single pass instead; reduces main-thread symbol-placement cost on dense/coincident symbol layers (#7797) (by @​pholmstr)
• Use texelFetch for exact DEM and color-relief elevation stop lookups instead of normalized texture coordinate arithmetic (#7640) (by @​johncarmack1984)
• Make default draggable markers keyboard-focusable and movable with the arrow keys (1 px per press, 10 px with Shift); custom marker elements stay application-owned (#8020) (by @​smmariquit)

🐞 Bug fixes

• Fix a permanent frame rate degradation after switching styles: every sprite reload marked its images as updated forever, making every in-view tile re-check and re-upload them on every frame. Also stop leaking the images of a replaced sprite, which were never removed from the image manager (#8052) (by @​HarelM)
• Prevent a rejected missing style image resolver from blocking successfully resolved images in the same batch (#8146) (by @​birkskyum)
• Explicitly request no browser color management when decoding raster-DEM tiles so their RGB-encoded elevation values are not changed (what would otherwise happen with gfx.color_management.mode = 1 in Firefox) (#8125) (by @​tnikkel)
• Let an abort reach an image or raster tile load that is still awaiting its transformRequest, so ImageSource.updateImage no longer loses the image it was just handed and an aborted tile is no longer fetched (#8071) (by @​mondsichtung)
• Fix raster tiles fading in again when they are reloaded, briefly flashing the map background, most visibly when switching projection (#8106) (by @​mondsichtung)
• Fix globe panning inverting and stalling near and across the poles by rotating the globe with a versor, keeping the drag direction consistent at every latitude. Panning also eases off as the cursor approaches the edge of the globe and continues past it, instead of stopping. The bearing is preserved while panning, as before (#5296) (by @​jcolot)
• Fix fill-extrusion-rounded-corner-distance producing spikes: corner arcs now land on the integer tile grid, and corners created by tile clipping are left sharp (#8153) (by @​HarelM)
• Fix a gesture which was held still before being released still flinging the map (#1303) (by @​zdila)

Commits

• 37e08c1 Bump js version to 6.4.1 (#8190)
• 1da69f3 fix: snapshot attributes in DOM.removeAttributes to avoid skipping them (#8189)
• ac8580b chore(deps): bump zensical/zensical from 0.0.53 to 0.0.54 (#8183)
• a7636f3 chore(deps): bump the codeql-action group with 3 updates (#8181)
• 18a2192 chore(deps-dev): bump rolldown from 1.2.3 to 1.2.4 (#8180)
• 740b106 chore(deps-dev): bump globals from 17.9.0 to 17.11.0 (#8178)
• f6ac7bb chore(deps-dev): bump devtools-protocol from 0.0.1676914 to 0.0.1679354 (#8176)
• ef90e66 fix: pass real globe transition progress to custom layers (#8169)
• 4529c6e Bump js version to 6.4.0 (#8171)
• 73773c1 fix: rounded corner spikes (#8155)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 50 chunks)	3477.5 KB	3512.7 KB
Main entry chunk (gzip)	143.9 KB	350 KB
Entry file	index-C_qesjcI.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	15.67KB	5.75KB
app-shell (runtime-config.js)	20.68KB	7.36KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	499.42KB	114.32KB
core (index.js)	7.48KB	2.96KB
create-plugin (index.js)	10.12KB	3.28KB
data-objectstack (index.js)	198.39KB	55.29KB
fields (index.js)	243.70KB	61.52KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	1.22KB	0.64KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	6.57KB	2.76KB
i18n (index.js)	3.65KB	1.47KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	26.89KB	9.04KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	34.34KB	9.17KB
i18n (useSafeTranslation.js)	5.60KB	2.33KB
layout (index.js)	38.84KB	10.94KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	4.39KB	1.66KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	13.52KB	4.88KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.24KB	2.16KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.39KB	3.10KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	15.16KB	3.68KB
plugin-calendar (index.js)	49.00KB	13.91KB
plugin-charts (index.js)	71.39KB	19.92KB
plugin-chatbot (index.js)	194.53KB	46.34KB
plugin-dashboard (index.js)	131.43KB	34.44KB
plugin-designer (index.js)	213.21KB	43.63KB
plugin-detail (index.js)	251.25KB	65.00KB
plugin-editor (index.js)	2.23KB	1.05KB
plugin-form (index.js)	131.01KB	32.32KB
plugin-gantt (index.js)	167.16KB	40.99KB
plugin-grid (index.js)	208.18KB	56.62KB
plugin-kanban (index.js)	55.44KB	15.73KB
plugin-list (index.js)	112.73KB	27.69KB
plugin-map (index.js)	20.49KB	6.83KB
plugin-markdown (index.js)	13.88KB	4.80KB
plugin-report (index.js)	43.42KB	11.92KB
plugin-timeline (index.js)	30.10KB	8.74KB
plugin-tree (index.js)	9.33KB	3.25KB
plugin-view (index.js)	84.54KB	20.84KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	81.07KB	26.86KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.63KB	2.18KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	6.58KB	2.74KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	5.55KB	2.45KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	20.57KB	5.88KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	13.64KB	4.59KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	1.00KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.93KB	1.49KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.74KB	2.25KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	4.73KB	2.28KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	14.27KB	5.47KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.11KB	3.32KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped