# Maps run on your own site, not a CDN

`{% map %}` used to pull MapLibre GL JS from a public CDN at runtime. It now bundles a
runtime served from your own site and publishes the map worker as a same-origin asset, so
nothing executable in a map comes from a third party. A map keeps working when a CDN is
blocked or slow, and it needs no CDN allowance in a Content-Security-Policy.

The runtime is read out of your own `node_modules`, so **a site upgrading from an earlier
release has to install `mantine-map` 0.4.0** — add it to `package.json` *and* run your package
manager, since it is the installed tree that decides and a listed-but-uninstalled package is not
a copy Aardvark can build against. Until that copy is there, the build warns,
drops the interactive map and falls back to the accessible list of locations the tag always
renders for readers without JavaScript — the build still succeeds, which is what makes a
vanished map easy to overlook. Pin the version exactly: a copy that is not 0.4.0 is dropped the
same way, since that is the version the map surface is built against. Sites scaffolded by 0.3.3
already carry the pin. On 0.3.3 the install is required; a later release ships the runtime inside
Aardvark itself and drops the step.

Three knobs are gone with the CDN they pointed at: `map.maplibreVersion`, `map.maplibreJs`
and `map.maplibreCss` no longer do anything, and are ignored without a warning — delete
them rather than waiting to be told. If you set a Content-Security-Policy, a map now needs
`worker-src 'self'` and `img-src 'self' data: blob:`; the basemap's own style, tile, glyph
and sprite origins still belong under `connect-src`/`img-src`, since those carry map data
rather than code.

The runtime is only shipped by sites that use it: a page tree with no `{% map %}` emits
neither the MapLibre bundle nor the worker.

Released in 0.3.3. See [Map](/components/extras/map/).