js_columns fed the now-removed JS eval controls and had no remaining
purpose: field-based tooltips already auto-include tooltip_contents
columns, and cross_filter_column is auto-included independently on the
Geojson/Polygon layers. Its only other effect was demoting matching
columns out of a feature's direct properties into extraProps, which
the crossFiltersDataMask extraProps fallback existed solely to
compensate for.
Removes the control from all 10 deck.gl layer control panels, dropping
the "Advanced" section entirely where it was the only control left
(Contour, Hex, Screengrid, Grid, Heatmap, Path, Scatter, Arc) and
keeping it on Geojson/Polygon for cross_filter_column. Also drops the
now-dead resolve_deck_gl_columns js_columns branch in the MCP chart
tool helpers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Removes the deck.gl JS tooltip/onclick-href/data-mutator controls and the
GeoJSON layer's label/icon JavaScript-mode generators, along with the
ENABLE_JAVASCRIPT_CONTROLS feature flag that gated them (closes#41045).
These let users write arbitrary JS, sandboxed via Node's vm module, to
customize deck.gl tooltips/click behavior/data transforms; the flag
defaulted off and saw negligible use.
Removes the now-dead sandboxedEval() runtime (utils/sandbox.ts), its
vm-browserify webpack polyfill and devDependency, and the underscore
dependency it alone pulled into the deck.gl plugin. Cleans up the
associated backend form_data-stripping mechanism, tests, fixtures, and
docs for the removed feature.
vm2 (the dependency this was originally suspected to pull in) turned out
to be unrelated: it was only a transitive dev-dependency of the
Cartodiagram plugin's geostyler dependency via typescript-json-schema,
which has since dropped it upstream (>=0.68.0). Forced that resolution
via an npm override, confirmed geostyler ships no code that touches
typescript-json-schema at runtime, and verified the Cartodiagram plugin
still builds and its full test suite passes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
