[rgbkrk]

Anaconda Desktop's notebook preview bundled vulnerable MapLibre and installed an older components dependency in the host application. @runtimed/notebook-preview@0.3.0-beta.2 is now published on npm's beta channel with MapLibre 6.4.1, the first fixed version for CVE-2026-85061. A fresh registry install was verified.

The release preserves the existing iframe pages and postMessage interface. MapLibre 6 requires a namespace import in the React wrapper and an explicit bundled worker; this includes both and configures the repository's other map entry points. The preview publishes self-contained dist/ assets, with React/components moved to build dependencies so consumers do not reinstall MapLibre 5. No components package release is needed.

CI is pinned to pnpm 10.30.0 because latest now selects pnpm 12, which ignores the existing package.json configuration. CI also explicitly builds and type-checks the notebook preview.

Validation:

• Full local type checks, lint and formatting passed.
• 204 tests passed, 3 skipped, including two attribution sanitizer regression tests.
• Main app, iframe outputs and notebook-preview production builds passed.
• Browser demo rendered basemap, marker, polygon, Markdown, JSON, HTML and SVG outputs.
• Packed assets contain MapLibre 6.4.1 and its worker; a fresh npm registry install contains only the preview package, with no runtime dependencies.

The bundled React wrapper still declares a MapLibre 5 peer range, so the repository install emits a peer warning. MapLibre 6 requires WebGL2. Anaconda Desktop integration and Socket rescan remain downstream validation.

Desktop currently pins 0.3.0-beta.0; update that pin to 0.3.0-beta.2 and regenerate its lockfile. The npm latest tag is unchanged.

Advisory: GHSA-jrc7-96c5-q579