@angular/build: source-map comment scanner corrupts valid JS containing a regex literal

Offen
  • Stimmt etwas nicht?
#34,590 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@alan-agius4 arbeitet bereits daran.

Seit 29.10.2026.

  • #34591 von @alan-agius4 — offen
  • #34632 von @clydin — offen

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
76/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
angular, typescript
Bereich
build-system, devtools

Rechercherichtung

The issue identifies removeSourceMappingURL in @angular/build/src/utils/source-map.js and provides a standalone reproduction. Start by running the reproduction against the affected package version, then inspect the scanner and the related fix in PR #33545. Done means source-map removal preserves the given valid JavaScript and the reproduction assertion passes.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

area: @angular/build
Command

serve

Is this a regression?
  • Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was

@angular/build 22.0.9 passes the isolated source-map removal test. @angular/cli remains at 22.2.4; Angular framework packages remain at 22.2.3.

Description

With @angular/build 22.2.4, ng serve fails when optimization and script
source maps are enabled. Vite reports invalid JavaScript during import
analysis. However, ng build succeeds, and the built application worked
when served separately using a local static server.

The failure was traced to removeSourceMappingURL in @angular/build.
The development-server memory plugin calls this function before handing
generated JavaScript to Vite when a source map is present.

The scanner appears to interpret a double quote inside a valid
regular-expression literal as the beginning of a string. It then loses
track of the actual string boundaries and removes a sourceMappingURL-like
sequence that is string content, not a JavaScript comment.

This can be reproduced directly using the published build package,
without application code, authentication libraries, or Vite itself.

Expected:
Source-map comment removal preserves valid JavaScript, including
regular-expression literals and strings containing sourceMappingURL text.

Actual:
Valid JavaScript is truncated into invalid JavaScript. Vite subsequently
reports the parsing error.

The desired behavior is to keep both optimization and script source maps
enabled.

Minimal Reproduction

With @angular/[email protected] installed, save the following as repro.cjs
and run:

node repro.cjs

This intentionally calls the internal utility to isolate the defect.
It is a standalone scanner reproduction, not a complete Angular app.

const assert = require('node:assert/strict');
const path = require('node:path');
const vm = require('node:vm');

const packageRoot = path.dirname(
  require.resolve('@angular/build/package.json')
);

const { removeSourceMappingURL } = require(
  path.join(packageRoot, 'src', 'utils', 'source-map.js')
);

const input =
  'const pattern = /"/; const text = "//# sourceMappingURL=not-a-comment";';

new vm.Script(input); // The input is valid JavaScript.

const output = removeSourceMappingURL(input);
console.log(output);

assert.equal(
  output,
  input,
  'Input without an actual source-map comment should remain unchanged'
);

Expected:
The assertion passes and the input is preserved unchanged.

Actual:
The assertion fails. The output is:

const pattern = /"/; const text = "

The output is invalid JavaScript. The sourceMappingURL text was inside
a quoted string, not an actual comment.

Exception or Error
[vite] Internal server error: Failed to parse source for import analysis
because the content contains invalid JS syntax. If you are using JSX,
make sure to name the file with the .jsx or .tsx extension.
Plugin: vite:import-analysis

The standalone reproduction fails its equality assertion.
Parsing the truncated output also produces:
SyntaxError: Invalid or unexpected token
Your Environment
Original failing environment:
@angular/build: 22.2.4
@angular/cli: 22.2.4
@angular/core: 22.2.3
@angular/compiler: 22.2.3
@angular/compiler-cli: 22.2.3
TypeScript: 6.0.3
Vite: 8.3.0
Node.js: 24.20.0
OS: Windows

Current version-pin configuration:
@angular/build: 22.0.9
@angular/cli: 22.2.4 — unchanged
Angular core/compiler/compiler-cli: 22.2.3 — unchanged
Vite resolved by @angular/build: 7.3.6
Anything else relevant?
Temporary workaround applied

Pinned @angular/build to exactly 22.0.9 instead of 22.2.4:

"@angular/build": "22.0.9"

This is the workaround currently used, not a fix to the scanner.

  • @angular/cli remains at 22.2.4 — it was not downgraded.
  • Angular core/compiler/compiler-cli remain at 22.2.3.
  • Optimization and script source maps remain enabled.

The pinned build package uses Vite 7.3.6 instead of 8.3.0.
However, the minimal reproduction demonstrates the corruption directly
in @angular/build's source-map scanner without invoking Vite.

Related issue and fix

The earlier issue concerned source-map text inside template literals.
Its fix introduced the replacement scanner. This report concerns
regular-expression literal handling in that scanner.

Vorherrschende Sprache
TypeScript
Sterne
27k
Forks
11.8k
Ø Merge
1 T. 52 Min.
Gemergte PRs (30 T.)
268

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus angular/angular-cli

Alle Issues in angular/angular-cli

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.