Leaflet library in composer.json should be updated simultaneously to all modules using Leaflet to avoid version conflicts.

Map background

The background is raster tiles rendered by Leaflet, configured by two module settings:

• layerProviderTileUrl — the tile URL. Built into a layer by membersMap.baseLayer.create(), shared by the members map and the "My location" map.
• layerProviderTileFilter — a CSS filter applied to the tiles so the markers on top of them stay readable. It is set as the --members-map-tile-filter custom property on the map container, and _map.scss applies it to .members-map-tiles .leaflet-tile. A blank setting means no filter, so init() must not collapse an empty stored value onto the default.

Vector styles (MapLibre GL, e.g. OpenFreeMap Positron) were tried and dropped. They render a much lighter, more modern map without a filter, but MapLibre GL's default build creates its web worker from a blob: URL, which HumHub's Content-Security-Policy blocks — it sets no worker-src, so script-src applies as a fallback and its * never matches blob::

Creating a worker from 'blob:…' violates the following Content Security Policy directive:
"script-src …". … The scheme 'blob:' must be added explicitly. The action has been blocked.

The map then stays blank, with no vector tile ever requested. MapLibre's csp build (maplibre-gl-csp.js plus maplibre-gl-csp-worker.js and maplibregl.setWorkerUrl()) fixes that in isolation, but the map was still blank in the real application for reasons that were never diagnosed. Anyone picking this up again should start from the browser console on the map page.