Removes the deck.gl JS tooltip/onclick-href/data-mutator controls and the
GeoJSON layer's label/icon JavaScript-mode generators, along with the
ENABLE_JAVASCRIPT_CONTROLS feature flag that gated them (closes#41045).
These let users write arbitrary JS, sandboxed via Node's vm module, to
customize deck.gl tooltips/click behavior/data transforms; the flag
defaulted off and saw negligible use.
Removes the now-dead sandboxedEval() runtime (utils/sandbox.ts), its
vm-browserify webpack polyfill and devDependency, and the underscore
dependency it alone pulled into the deck.gl plugin. Cleans up the
associated backend form_data-stripping mechanism, tests, fixtures, and
docs for the removed feature.
vm2 (the dependency this was originally suspected to pull in) turned out
to be unrelated: it was only a transitive dev-dependency of the
Cartodiagram plugin's geostyler dependency via typescript-json-schema,
which has since dropped it upstream (>=0.68.0). Forced that resolution
via an npm override, confirmed geostyler ships no code that touches
typescript-json-schema at runtime, and verified the Cartodiagram plugin
still builds and its full test suite passes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
