fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps with disable-upload - #23619
fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps with disable-upload#23619msonnb wants to merge 1 commit into
disable-upload#23619Conversation
size-limit report 📦
|
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
|
||
| logger.info( | ||
| 'Stamped debug IDs onto the emitted source maps. Upload them with `sentry-cli sourcemaps upload --debug-id-reference` to symbolicate stack traces.', | ||
| ); |
There was a problem hiding this comment.
Success logged when nothing stamped
Low Severity
After the worker pool finishes, the info log always claims debug IDs were stamped, even when every per-file stamp no-ops (missing debug ID marker, missing map, read/write failures). Those failures only emit debug/error logs, so the success message can mask a completely ineffective run.
Reviewed by Cursor Bugbot for commit abddaf3. Configure here.
abddaf3 to
f844728
Compare
msonnb
changed the title
disable-uploaddisable-upload
…disable-upload` `sourcemaps.disable: 'disable-upload'` is documented for manually uploading source maps at a later point in time, but the debug ID only ended up in the bundle, never in the emitted source map - stamping happens on temporary copies inside the upload routine that the flag switches off. A later `sentry-cli sourcemaps upload` therefore produced an artifact bundle where every entry has `debugId: null` and nothing symbolicates. The emitted source maps now get the bundle's debug ID written into them when the upload is disabled. Bundles stay byte-identical so hashes computed during the build (e.g. for subresource integrity) remain valid. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Semgrep found 1 Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the Fix: Upgrade this library to at least version 0.25.0 at sentry-javascript/yarn.lock:14987. Reference(s): GHSA-67mh-4wv8-2f99 Semgrep found 2 Risk: Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component. sharp bundles a vulnerable version of the native libvips library, inheriting four memory-safety flaws: an integer overflow leading to a heap-based buffer overflow in the VIPS loader ( Fix: Upgrade this library to at least version 0.35.0 at sentry-javascript/yarn.lock:24908. Reference(s): GHSA-f88m-g3jw-g9cj Semgrep found 1 Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows Fix: Upgrade this library to at least version 6.4.3 at sentry-javascript/yarn.lock:27415. Reference(s): GHSA-fx2h-pf6j-xcff, CVE-2026-53571 Semgrep found 1 Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: There are no safe versions of this library available for upgrade. Library included at sentry-javascript/yarn.lock:2594. Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133 |
f844728 to
1486446
Compare
|
bugbot run |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1486446. Configure here.
| } | ||
|
|
||
| const stampedCount = results.filter(result => result === 'stamped' || result === 'alreadyStamped').length; | ||
|
|
There was a problem hiding this comment.
Repeated filters over stamp results
Low Severity
logStampingOutcome walks the same results array twice with separate .filter calls to count inline maps and stamped maps. The project review guidelines ask to avoid multiple loops over the same array and prefer a single classic for loop instead.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit 1486446. Configure here.
1 participant
Note: intentionally against v10 for now. Will forward-port once #23398 lands and bug in cli v4 is fixed.
What
This fixes a bug where sourcemaps never got the debug ID injected when
sourcemaps.disablewas set todisable-upload. The emitted source maps now carry the bundle's debug ID whenever the upload is disabled.Why
sourcemaps.disable: 'disable-upload'says that "the plugin will not upload sourcemaps to Sentry, but will inject debug IDs into the build artifacts. This is useful if you want to manually upload sourcemaps to Sentry at a later point in time." The debug ID only ever reached the bundle, the emitted.js.mapnever got one, so the manual upload the option exists for produced an artifact bundle where every entry haddebugId: nulland nothing symbolicates.Debug ID stamping was part of the upload routine.
prepareBundleForDebugIdUpload()writes both the//# debugId=comment and the map'sdebug_idinto copies in a temp folder, uploades those, then deletes them.disable-uploadgated out the entireupload()call, so it skipped the stamping along with the upload.Fixes getsentry/sentry-javascript-bundler-plugins#949
Fixes getsentry/sentry-javascript-bundler-plugins#603