Upgrade bundled plotly.js to 4.x

[falkoschindler]

Motivation

The upgrade removes trace types and changes defaults, so it is a breaking change for NiceGUI users and belongs in 4.0.

We currently bundle plotly.js 3.1.1 in nicegui/elements/plotly. Two reasons to move to 4.x:

• plotly.py 7.0.0 (released 2026-08-25) ships plotly.js 4.0.0 and generates figure JSON for it. Our plotly extra pins plotly>=5.13,<7.0, so users are stuck on plotly.py 6.x until we upgrade the bundle.
• Dependabot alert 410 (maplibre-gl XSS, GHSA-jrc7-96c5-q579) is compiled into the prebuilt plotly.min.js we import, so it can only be fixed by a plotly.js release that bundles maplibre-gl >= 6.4.1. Upstream is tracking this in [BUG]: critical CVE in maplibre-gl, please update to version 6 plotly/plotly.js#8031 with Dependabot PR Bump maplibre-gl from 5.24.0 to 6.4.1 in the npm_and_yarn group across 1 directory plotly/plotly.js#8030 on main, i.e. the 4.x line. An npm override on our side would only hide the alert without changing the shipped code.

Implementation

• Bump plotly.js in nicegui/elements/plotly/package.json to the first 4.x release that includes maplibre-gl >= 6.4.1, rebuild dist/, regenerate DEPENDENCIES.md.
• Relax the plotly extra to allow plotly.py 7.x.
• Check the documentation demos, especially the map demos, against the changed defaults.
• Mention the breaking changes in the release notes, including the new "Share chart" modebar button (plotly.js and plotly.py 7 both enable it by default; users who don't want it pass config={'showSendToCloud': False}).

Breaking changes for users (from the plotly.js 4.0.0 release notes)

• scattermapbox, choroplethmapbox, densitymapbox traces, the mapbox subplot and mapboxAccessToken are removed; use the *map equivalents.
• Color parsing switched from TinyColor to culori: rgb() with 0-1 fractions and hsv() strings are no longer accepted, invalid CSS color strings are rejected, rgb() now accepts an alpha channel.
• layout.geo.fitbounds defaults to 'locations'; scattermap and densitymap auto-fit center and zoom unless layout.map.fitbounds is set to false.
• MathJax v2 is no longer supported (v3 and v4 are).
• splom.axis.matches defaults to true; overlaying axes default to tickmode: 'sync'.
• hoveranywhere / clickanywhere events return actual data values for xvals / yvals (strings for date and category axes).

Progress

• Wait for a plotly.js 4.x release that includes maplibre-gl >= 6.4.1
• Bump plotly.js, rebuild dist, regenerate DEPENDENCIES.md
• Relax the plotly extra to <8.0
• Verify documentation demos
• Release notes

[evnchn]

Thoughts for agents to handle:

Is it possible to bundle our own plotly.js so that the security gap is closed sooner?

Is the security gap even that big?

[evnchn]

Posted by Claude Code on evnchn's behalf.

Edited 2026-09-10: corrected after a Codex review found errors in the first version. Three claims were wrong: MapLibre has already refused a backport, hardcoded map styles are not automatically safe, and a MapLibre 6 build is not strictly impossible. See Changelog at the end.

TL;DR:

Dropping the map traces is the only route I got working. It's real but not narrow: every map trace is exposed by default.

A correction to the issue body comes first: upgrading to plotly.js 4.x does not close this alert today. plotly.js@4.0.0 and 4.1.0 both depend on maplibre-gl@^5.24.0, which is still inside the vulnerable range (<= 6.4.0). MapLibre has said it will not backport the fix to v5. Upstream's Dependabot bump (plotly/plotly.js#8030) was closed unmerged, and the plotly maintainer said they would write their own upgrade PR instead.

• How big is the gap? Any app that renders a *map trace. plotly's default map style (basic) is fetched from Carto's servers, and the attribution text comes back from that remote source. So by default the app trusts a third party's attribution string. Apps that never use a map trace are not exposed.
• Can we bundle our own? An npm override does nothing. A source build against maplibre-gl 6 compiles only after build changes, and even then the map never finishes loading. The route that works is a source build without the six map traces: the vulnerable code drops out and the bundle shrinks by 30%. But existing map figures then render as empty axes with no error.

Suggestion: don't drop map support over this. Wait for plotly's own MapLibre 6 upgrade, since a v5 backport is off the table. Meanwhile, warn in the ui.plotly docs.

Q2 — How big is the security gap? (reachability)

• The advisory (GHSA-jrc7-96c5-q579) is CVSS 10.0. Its impact clause: "Applications rendering untrusted/third-party style attribution strings or user-supplied custom attributions are impacted."

• The sink is MapLibre's AttributionControl, which writes every source's attribution into innerHTML. plotly creates one for every map subplot: new maplibregl.Map({..., attributionControl: false}).addControl(new AttributionControl({compact: true})) (from the shipped dist/plotly.min.js).

• Attribution can arrive over the network, not just from the figure. In maplibre-gl@4.7.1, src/source/load_tilejson.ts fetches options.url and keeps the remote attribution field:

  if (options.url) {
      const response = await getJSON<TileJSON>(requestManager.transformRequest(options.url, ResourceType.Source), abortController);
  ...
  const result = pick(extend(tileJSON, options), ['tiles', 'minzoom', 'maxzoom', 'attribution', 'bounds', 'scheme', 'tileSize', 'encoding']);

• plotly's default map style is remote. layout.map.style defaults to 'basic', which src/plots/map/constants.js maps to https://basemaps.cartocdn.com/gl/voyager-gl-style/style.json. The other carto-* presets are remote as well.

• ui.plotly adds no attribution surface of its own. It passes the data / layout / config dict straight through (nicegui/elements/plotly/plotly.py).

So:

• exposed: any app that renders scattermap / densitymap / choroplethmap. The attribution comes from whichever style and tile servers get contacted: Carto by default, and possibly end-user input. A hardcoded style URL, or a style object whose sources point at a remote TileJSON, still depends on that server staying honest.
• not exposed: no map trace (the code is in the bundle but never runs), or only local/inline sources whose attribution the app controls.

One detail that differs from the advisory text. maplibre-gl@4.7.1, the version we ship, has no DOM.sanitize() on the attribution path at all. That holds in the source, not only the minified dist. The only sanitize hits in its src/ are sanitizedRegExpFromScriptCodes, which handles right-to-left text detection and is unrelated. src/ui/control/attribution_control.ts pushes each source.attribution unmodified (line 150) and assigns the joined string to innerHTML (line 176). In the shipped dist:

const i=t.join(" | ");i!==this._attribHTML&&(this._attribHTML=i,t.length?(this._innerContainer.innerHTML=i, ...

So for us this is not a sanitizer bypass. The attribution path has no sanitizer to bypass.

The deprecated *mapbox traces have the same problem. They run on a separate library (@plotly/mapbox-gl@1.13.4), which also writes attribution straight into innerHTML. That library isn't covered by this alert, but the exposure is the same.

Q1 — Can we bundle our own plotly.js? (four routes, all built locally)

All builds use plotly.js@3.7.0, the newest 3.x release. Every 3.x release, including the 3.1.1 we ship, pins the same maplibre-gl@^4.7.1.

route	result
1. npm overrides on maplibre-gl	no effect: we import the prebuilt dist
2. switch to a prebuilt partial bundle without MapLibre	works, but loses 37 of 49 trace types
3. source build + maplibre-gl@6.x	compiles after build changes, but the map never finishes loading
4. source build without the six map traces	works: MapLibre and Mapbox JS gone, 43 of 49 traces kept

1. Overrides. src/index.mjs is import Plotly from "plotly.js/dist/plotly.min.js", so rollup never resolves maplibre-gl from node_modules. What ships is the MapLibre copy already compiled into that file.

2. Prebuilt partials. AttributionControl / _attribHTML appear in both MapLibre and its parent fork Mapbox GL, so they don't identify the library on their own. The fork-specific string literals do: "maplibregl-attrib-empty" versus "mapboxgl-attrib-empty". The quotes matter, because they exclude the inlined CSS, which every bundle carries.

dist/ bundle	traces	MapLibre JS	Mapbox JS
plotly.min.js (what we ship)	49	yes	yes
plotly-strict.min.js	45	yes	yes
plotly-mapbox.min.js	4	no	yes
plotly-cartesian.min.js	12	no	no
plotly-finance.min.js	10	no	no
plotly-gl3d.min.js	8	no	no
plotly-gl2d.min.js	4	no	no
plotly-basic.min.js / plotly-geo.min.js	3	no	no

7 of 9 bundles carry no MapLibre JS. But the only one that keeps almost every trace still includes it, and the widest MapLibre-free bundle keeps just 12 trace types.

3. Source build against maplibre-gl@6.9.0. Three attempts:

build config	build	runtime (scattermap, plotly's built-in white-bg style: no sources, only glyphs load remotely)
plain overrides	fails: map.js:3:25: Could not resolve "maplibre-gl", because v6 exports ESM only	—
alias maplibre-gl to v6 + global conditions: ['import'] (Codex's reproduction)	compiles	crashes on import: TypeError: SKt is not a function inside a color-parsing helper. The global condition moves every package to its ESM entry, not just MapLibre
alias only maplibre-gl (and its CSS) to v6's dist/maplibre-gl.mjs	compiles	imports; creates the map, canvas and attribution control; the style reports _loaded with 5 layers and tiles loaded, but map.loaded() stays false and Plotly.newPlot never resolves (13 s+, no console error)

A 4.7.1 build of the same page renders the same style fine, so this is a real plotly/MapLibre 6 mismatch and not a problem with the test harness. It fits the plotly maintainer's "a simple upgrade won't work here". Keeping maps on v6 is possible in principle, but it needs actual porting work in plotly, not a build tweak on our side.

4. Source build with the six map traces removed. The entry is plotly.js/lib/index.js minus the require lines for scattermap, choroplethmap, densitymap and the three deprecated *mapbox variants:

bundle	size	attribution-control symbols (MapLibre + Mapbox)
shipped dist/plotly.min.js	4.6 MB	present
source build, all 49 traces	4.9 MB	present
source build, 43 traces	3.2 MB	none (_attribHTML 0, AttributionControl 0)

Only MapLibre's CSS text is left, because src/registry.js requires maplibre-gl/dist/maplibre-gl.css unconditionally. This is measured by grep, not a data-flow proof. The 1.7 MB size drop fits the libraries being removed.

I rendered the 43-trace bundle in Chromium (Playwright, loaded as an ES module):

trace	result
bar	renders (2 bar paths)
scatter3d	renders (WebGL canvas, so the glsl shader path built correctly)
scattermap	no error. plotly turns it into type: 'scatter' with visible: false: empty cartesian axes, no map

An app that uses a map trace fails silently, not loudly. That is the real cost of route 4.

Two more caveats on route 4:

• It removes the exposure, not the alert. Dependabot reads package-lock.json, and maplibre-gl stays a hard dependency of plotly.js. Clearing the alert needs an override too, and that only works together with route 4, because the full bundle needs maplibre-gl. overrides: {"maplibre-gl": "npm:empty-npm-package@1.0.0"} fails with Could not resolve "maplibre-gl/dist/maplibre-gl.css" from src/registry.js:235, so any stub has to provide that file.
• We would own a build config. Plotly's supported route is npm run custom-bundle -- --traces ... from a git clone (tasks/ is not in the npm package, per CUSTOM_BUNDLE.md). Rebuilding it from the npm package with esbuild works, but that config could break on any plotly release.

Refuted along the way

• "plotly.js 4.x fixes it": refuted. npm view plotly.js@4.1.0 dependencies.maplibre-gl gives ^5.24.0. The newest maplibre-gl 5.x is 5.24.0 (2026-04-23). The fix is only in 6.4.1 (2026-08-18) and later.
• "MapLibre may backport to v5": refuted. A MapLibre maintainer on maplibre/maplibre-gl-js#8384, 2026-09-08: "We are not planning to backport this fix, you can patch package if you have to, or sanitize the attribution yourself." (The first version of this comment called that answer the blocker. It had already been given.)
• "A style the app author hardcodes is safe": refuted. A style URL or a remote TileJSON source fetches its attribution at runtime (see the Q2 fold), and plotly's default style is remote.
• "plotly.js 3.x can't be built against maplibre-gl 6": refuted as stated. It compiles with a scoped alias, but it doesn't render (route 3).
• "Every prebuilt bundle contains MapLibre": refuted. The CSS class maplibregl-ctrl-attrib matches all nine bundles because MapLibre's CSS is inlined everywhere.
• "AttributionControl / _attribHTML mean MapLibre": refuted. Mapbox GL has both, and plotly-mapbox.min.js matched on Mapbox alone. If you check a bundle for a dependency, grep for a string the fork renamed (here, the vendor prefix), never an identifier both libraries kept.
• "Rollup can build plotly from source as-is": partly. It emits a bundle, but with bare import "fs" / "path" / "stream" / "buffer" / "assert" / "os" / "util" / "constants", so it won't run in a browser. plotly's own esbuild plugin set (next fold) avoids that.

Repro (rebuild the 43-trace bundle)

npm i plotly.js@3.7.0 esbuild esbuild-plugin-glsl esbuild-plugin-inline-css \
      esbuild-plugin-environment stream-browserify buffer assert
grep -vE "require\('\./(scattermapbox|choroplethmapbox|densitymapbox|scattermap|choroplethmap|densitymap)'\)," \
  node_modules/plotly.js/lib/index.js > node_modules/plotly.js/lib/index-nomap.js

// eb.cjs: plotly's own esbuild-config.js, switched to ESM output
const esbuild = require('esbuild');
const { environmentPlugin } = require('esbuild-plugin-environment');
const { glsl } = require('esbuild-plugin-glsl');
const InlineCSSPlugin = require('esbuild-plugin-inline-css');
esbuild.build({
  entryPoints: ['node_modules/plotly.js/lib/index-nomap.js'], outfile: 'dist/nomap.js',
  format: 'esm', bundle: true, minify: true,
  plugins: [InlineCSSPlugin(), glsl({ minify: true }), environmentPlugin({ NODE_DEBUG: false })],
  alias: { stream: 'stream-browserify' },
  define: { global: 'window', 'define.amd': 'false' },
  target: 'es2016',
});

node eb.cjs
grep -c '_attribHTML' dist/nomap.js         # 0
grep -c 'AttributionControl' dist/nomap.js  # 0

For the route 3 variant, add 'maplibre-gl': '<v6>/dist/maplibre-gl.mjs' and 'maplibre-gl/dist/maplibre-gl.css': '<v6>/dist/maplibre-gl.css' to alias and use the full lib/index.js entry.

This repro proves route 4 builds, has no MapLibre/Mapbox attribution code, and renders bar and scatter3d. It does not prove all 43 remaining trace types work, and it hasn't been run against NiceGUI's own test suite.

Options:

1. Wait for plotly's MapLibre 6 upgrade (suggested). A v5 backport won't happen, so plotly's own porting PR is the real path. Justify our 4.x upgrade by plotly.py 7 alone.
2. Ship route 4 now as a 4.0 breaking change: no map traces, and document the silent empty-axes failure.
3. Warn in the ui.plotly docs: map traces render attribution HTML from whatever style and tile servers they contact, including the default Carto style, so only point them at trusted servers and never at user-supplied URLs. This costs almost nothing and holds until upstream ships.

Options 1 and 3 combine well.

Changelog

• 2026-09-10, first version. Posted after a GLM-5.2 review of an earlier draft.
• 2026-09-10, correction. A Codex review of the posted text (confidence 4/10) raised four points. I re-checked each one, and all four held up:
  • MapLibre had already refused a v5 backport the day before, so "the real blocker is MapLibre's answer" was wrong. Suggestion and option 1 rewritten.
  • "A hardcoded style is not exposed" gave false assurance: remote styles and TileJSON bring their own attribution, and plotly's default style is remote. Q2 rewritten.
  • "A source build against maplibre-gl 6 fails to compile" was overstated. It compiles with an alias, but I then found it doesn't render. Route 3 rewritten with three measured attempts.
  • The AttributionControl / _attribHTML counts had been attributed to MapLibre alone, but they also match Mapbox GL. The partial-bundle table now splits the two libraries: 7 of 9 bundles lack MapLibre JS, not 6.
  • Credit to Codex for all four catches.
  • A second GLM-5.2 pass on this corrected text raised four more points. I checked each against the files: the repro grep is correct (it removes exactly the six map require lines), and the "no sanitizer" claim now cites the 4.7.1 source rather than only the dist. I also clarified that the white-bg test style has no sources, and that the empty-package override only works alongside route 4.