[BUG]: Vulnerability MapLibre GL JS -> plotly.js -> plotly.py

According to GHSA-jrc7-96c5-q579 there is a Vulnerability in the MapLibre GL JS that is being used within the plotly.js library.

From my understanding plotly.py is also using plotly.js in the background.

According to to MapLibre this is only being patched for >=6.4.1

"Please upgrade to maplibre-gl version 6.4.1 (or latest)."

Plotly.js is still using version v5.

Any recommendations how to handle this?

Thanks for the report! plotly.js is being updated in plotly/plotly.js#8035. Once that lands and gets released, we'll update plotly.py to match.

@camdecoster

Hello @camdecoster, just wanted to let you know that plotly.js seems to have a released fix nos :)

v7 1.0 includes the updated version of plotly.js with this fix. We just missed closing this issue. Thanks for the reminder!

Navigation Menu