Skip to content

feat(rsbuild): Enable source map in production #2896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zatteo wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat(rsbuild): Enable source map in production #2896

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion config/rsbuild-config-cozy-app/getRsbuildConfig.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,9 @@ function getRsbuildConfig({
auto: resource => resource.endsWith('.styl')
},
// We enable old API polyfill to keep compatibility with old browsers
polyfill: 'usage'
polyfill: 'usage',
// We enable source map to simplify production debugging
sourceMap: true
Comment on lines +76 to +78
Copy link

@codescene-delta-analysis codescene-delta-analysis bot Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❌ Getting worse: Large Method
getRsbuildConfig increases from 199 to 200 lines of code, threshold = 70

Suppress

Comment on lines +76 to +78
Copy link

@coderabbitai coderabbitai bot Dec 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Do not serve source maps to end users; generate and upload to Sentry separately.

Rsbuild documentation explicitly warns: "Do not deploy source maps (.map files) to the public web server or CDN when using values such as source-map or hidden-source-map in production builds. Public source maps will expose your source code and may bring security risks."

Generating source maps may expose them to the public, potentially causing your source code to be leaked, even for open-source projects, as it reveals internal implementation patterns, debug logic, and commented code.

Recommended approach:

  1. Generate hidden source maps that aren't referenced in production bundles (e.g., sourceMap: { js: 'source-map' } with hidden-source-map format)
  2. Upload source maps to Sentry during CI/CD using @sentry/webpack-plugin (which provides source map and release management support for Sentry), registered via Rsbuild's tools.rspack configuration
  3. Delete source maps after upload to prevent exposure

},
performance: {
chunkSplit: {
Expand Down
Loading