feat(basemaps): add EOX Sentinel-2 cloudless satellite imagery

[giswqs]

Summary

Adds the EOX Sentinel-2 cloudless satellite imagery basemap (and EOX Terrain Light) to the Basemaps plugin, as requested in #866.

These are free, non-commercial EOX Maps layers. Rather than wiring them into GeoLibre directly, they were added upstream in the maplibre-gl-basemap-control plugin (opengeos/maplibre-gl-basemap-control#22, released as v0.9.0), which the Basemaps plugin consumes. This PR simply bumps the dependency to ^0.9.0 in the two workspaces that declare it.

The new basemaps appear automatically in the Basemaps gallery under the EOX provider, and the required EOX / Copernicus attribution is added to the map's attribution control when a layer is loaded.

Changes

• maplibre-gl-basemap-control ^0.8.0 → ^0.9.0 in apps/geolibre-desktop/package.json and packages/plugins/package.json, plus the lockfile update.

Verification

• npm run build passes; pre-commit clean.
• Verified in the running web app (with the published 0.9.0 package): searching "EOX" in the Basemaps gallery shows both layers; selecting EOX Sentinel-2 cloudless 2025 and EOX Terrain Light fetches tiles successfully (HTTP 200) and updates the attribution control. Confirmed in both light and dark themes.

Upstream: opengeos/maplibre-gl-basemap-control#22 (v0.9.0)

Fixes #866

[netlify]

✅ Deploy Preview for geolibre-app ready!

Name	Link
🔨 Latest commit	4e1c947
🔍 Latest deploy log	https://app.netlify.com/projects/geolibre-app/deploys/6a3d4402319cd90008fc6dac
😎 Deploy Preview	https://deploy-preview-869--geolibre-app.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Warning

Review limit reached

@giswqs, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 33 minutes and 13 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4443a58e-f46f-4d13-ac42-c1084c00307e

📥 Commits

Reviewing files that changed from the base of the PR and between f83cbdc and 4e1c947.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• apps/geolibre-desktop/package.json
• packages/plugins/package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/issue-866-eox-basemaps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚡ Cloudflare Pages preview

Item	Value
Preview	https://52c87487.geolibre-preview.pages.dev
Demo app	https://52c87487.geolibre-preview.pages.dev/demo/
Commit	a3ffe83

[github-actions]

Code review

This PR is a focused dependency bump (7 additions / 7 deletions) that upgrades maplibre-gl-basemap-control from ^0.8.0 to ^0.9.0 in two workspaces and regenerates the lockfile. The review concentrated on the new tile host and its interaction with the Tauri CSP, the Service Worker offline cache, and the upstream package's non-commercial license terms.

---

Bugs

None found.

---

Security

None found. The lockfile integrity hash (sha512-C5XRc+...) is a correctly-formed 88-character base64 SHA-512. The upstream CORS headers are permissive (per the upstream PR description), so no new proxy surface is introduced.

---

Performance

None found. EOX Sentinel-2 tiles are JPEG at maxzoom 16 — no performance concern beyond the existing satellite tile cost.

---

Quality

Non-commercial use restriction not surfaced in UI (low confidence, low priority)
The EOX Sentinel-2 cloudless layer is restricted to non-commercial use (stated in the upstream catalog description as "(non-commercial use)"). The map attribution control will show the EOX/Copernicus attribution string, but there is no tooltip or UI notice that explicitly warns users of the licensing limitation when they select the layer. Most other providers (MapTiler, Mapbox) gate access via an API key which acts as implicit acceptance of their ToS; EOX tiles load without any credential. Worth a note in the release description or a tooltip on the basemap card, but not a blocker.

---

CLAUDE.md

New tile host not tracked per CLAUDE.md convention (medium confidence)
CLAUDE.md states: "Tauri CSP allowlists tile/style hosts (OpenFreeMap, CARTO) — new external map/tile hosts must be added there."

Two observations (also left as an inline comment on apps/geolibre-desktop/package.json:61):

• Tauri CSP (src-tauri/tauri.conf.json): the current policy uses broad https: wildcards for connect-src and img-src, so tiles.maps.eox.at is already permitted with no change needed. The CLAUDE.md description appears to describe an older, more restrictive policy state rather than the current one.

• Service Worker tile cache (vite.config.ts:705): this is where OpenFreeMap and CARTO are actually named explicitly today. The allowlist regex openfreemap\.org|cartocdn\.com was not updated to include tiles.maps.eox.at, so EOX basemaps will be network-only — they will not function offline and will not be pre-warmed by the Download Offline Area feature. The comment at that line reads "Other remote tiles/services stay network-only by design", which suggests this is a deliberate choice, but it is not mentioned in the PR description. If offline EOX support is ever wanted, vite.config.ts:705 is the place to add tiles.maps.eox.at.

---

Summary: The change is mechanically correct — the lockfile is consistent, the version ranges are updated in both declaring workspaces, and the build passes. The two items above (non-commercial label visibility and offline-cache gap) are worth a deliberate decision rather than a fix-now blocker.