@angular/build: source-map comment scanner corrupts valid JS containing a regex literal

The issue identifies removeSourceMappingURL in @angular/build/src/utils/source-map.js and provides a standalone reproduction. Start by running the reproduction against the affected package version, then inspect the scanner and the related fix in PR #33545. Done means source-map removal preserves the given valid JavaScript and the reproduction assertion passes.

Command

serve

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

@angular/build 22.0.9 passes the isolated source-map removal test. @angular/cli remains at 22.2.4; Angular framework packages remain at 22.2.3.

Description

With @angular/build 22.2.4, ng serve fails when optimization and script
source maps are enabled. Vite reports invalid JavaScript during import
analysis. However, ng build succeeds, and the built application worked
when served separately using a local static server.

The failure was traced to removeSourceMappingURL in @angular/build.
The development-server memory plugin calls this function before handing
generated JavaScript to Vite when a source map is present.

The scanner appears to interpret a double quote inside a valid
regular-expression literal as the beginning of a string. It then loses
track of the actual string boundaries and removes a sourceMappingURL-like
sequence that is string content, not a JavaScript comment.

This can be reproduced directly using the published build package,
without application code, authentication libraries, or Vite itself.

Expected:
Source-map comment removal preserves valid JavaScript, including
regular-expression literals and strings containing sourceMappingURL text.

Actual:
Valid JavaScript is truncated into invalid JavaScript. Vite subsequently
reports the parsing error.

The desired behavior is to keep both optimization and script source maps
enabled.

Minimal Reproduction

With @angular/[email protected] installed, save the following as repro.cjs
and run:

node repro.cjs

This intentionally calls the internal utility to isolate the defect.
It is a standalone scanner reproduction, not a complete Angular app.

const assert = require('node:assert/strict');
const path = require('node:path');
const vm = require('node:vm');

const packageRoot = path.dirname(
  require.resolve('@angular/build/package.json')
);

const { removeSourceMappingURL } = require(
  path.join(packageRoot, 'src', 'utils', 'source-map.js')
);

const input =
  'const pattern = /"/; const text = "//# sourceMappingURL=not-a-comment";';

new vm.Script(input); // The input is valid JavaScript.

const output = removeSourceMappingURL(input);
console.log(output);

assert.equal(
  output,
  input,
  'Input without an actual source-map comment should remain unchanged'
);

Expected:
The assertion passes and the input is preserved unchanged.

Actual:
The assertion fails. The output is:

const pattern = /"/; const text = "

The output is invalid JavaScript. The sourceMappingURL text was inside
a quoted string, not an actual comment.

Exception or Error

[vite] Internal server error: Failed to parse source for import analysis
because the content contains invalid JS syntax. If you are using JSX,
make sure to name the file with the .jsx or .tsx extension.
Plugin: vite:import-analysis

The standalone reproduction fails its equality assertion.
Parsing the truncated output also produces:
SyntaxError: Invalid or unexpected token

Your Environment

Original failing environment:
@angular/build: 22.2.4
@angular/cli: 22.2.4
@angular/core: 22.2.3
@angular/compiler: 22.2.3
@angular/compiler-cli: 22.2.3
TypeScript: 6.0.3
Vite: 8.3.0
Node.js: 24.20.0
OS: Windows

Current version-pin configuration:
@angular/build: 22.0.9
@angular/cli: 22.2.4 — unchanged
Angular core/compiler/compiler-cli: 22.2.3 — unchanged
Vite resolved by @angular/build: 7.3.6

Anything else relevant?

Temporary workaround applied

Pinned @angular/build to exactly 22.0.9 instead of 22.2.4:

"@angular/build": "22.0.9"

This is the workaround currently used, not a fix to the scanner.

• @angular/cli remains at 22.2.4 — it was not downgraded.
• Angular core/compiler/compiler-cli remain at 22.2.3.
• Optimization and script source maps remain enabled.

The pinned build package uses Vite 7.3.6 instead of 8.3.0.
However, the minimal reproduction demonstrates the corruption directly
in @angular/build's source-map scanner without invoking Vite.

Related issue and fix

• Issue #33544 — Source-map comment removal corrupts JavaScript inside template literals
• PR #33545 — Prevent stripping nested sourceMappingURL comments

The earlier issue concerned source-map text inside template literals.
Its fix introduced the replacement scanner. This report concerns
regular-expression literal handling in that scanner.