Skip to content

[Blazor] Remove sourcemap link comments from production bundles for blazor.web.js and blazor.webassembly.js #62558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
Jul 9, 2025
Merged

[Blazor] Remove sourcemap link comments from production bundles for blazor.web.js and blazor.webassembly.js #62558

merged 4 commits into from
Jul 9, 2025

Conversation

Copilot
Copy link
Contributor

@Copilot Copilot AI commented Jul 3, 2025 •
edited
Loading

This change modifies the Rollup configuration to generate sourcemap files without including sourcemap link comments in production bundles for blazor.web.js and blazor.webassembly.js.

Changes Made

  • Modified src/Components/Web.JS/rollup.config.mjs to use sourcemap: 'hidden' for production builds of blazor.web.js and blazor.webassembly.js
  • This generates .map files but omits the //# sourceMappingURL= comments from the bundle
  • Preserves existing behavior for other bundles:
    • blazor.server.js still gets sourcemap link comments (sourcemap: true)
    • blazor.webview.js still gets inline sourcemaps (sourcemap: 'inline')
    • All development builds continue to include sourcemap link comments

Behavior

Before:

// Production blazor.web.js would end with:
console.log('Blazor initialized');
//# sourceMappingURL=blazor.web.js.map

After:

// Production blazor.web.js now ends with:
console.log('Blazor initialized');
// No sourcemap link comment

The sourcemap files (blazor.web.js.map, blazor.webassembly.js.map) are still generated and contain full debugging information. Developers can manually load these sourcemaps in browser dev tools when needed.

Benefits

  • Reduces production bundle size by eliminating sourcemap URL comments
  • Maintains debugging capability through manually loadable sourcemap files
  • Aligns with security best practices by not exposing sourcemap URLs in production
  • Consistent with the related .NET runtime issue approach

Fixes #62295.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

  • googlechromelabs.github.io
    • Triggering command: node install.mjs (dns block)
  • https://storage.googleapis.com/chrome-for-testing-public/134.0.6998.35/linux64/chrome-headless-shell-linux64.zip
    • Triggering command: node install.mjs (http block)

If you need me to access, download, or install something from one of these locations, you can either:

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

@Copilot @javiercn
Fix sourcemap link comments in production bundles for blazor.web.js a…
9dcc7e5 
…nd blazor.webassembly.js

Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>
@Copilot Copilot AI changed the title [WIP] [Blazor] Do not emit sourcemap link comment on production bundles for blazor.web.js and blazor.webassembly.js [Blazor] Remove sourcemap link comments from production bundles for blazor.web.js and blazor.webassembly.js Jul 3, 2025
@Copilot Copilot AI requested a review from javiercn July 3, 2025 15:46
Copilot finished work on behalf of javiercn July 3, 2025 15:46
javiercn
javiercn reviewed Jul 3, 2025
View reviewed changes
src/Components/Web.JS/package.json Outdated
@@ -23,7 +23,7 @@
"@babel/core": "^7.23.6",
"@babel/preset-env": "^7.23.6",
"@babel/preset-typescript": "^7.23.3",
"@microsoft/dotnet-js-interop": "*",
"@microsoft/dotnet-js-interop": "^10.0.0-dev",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not change this

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reverted the unintended change to the @microsoft/dotnet-js-interop dependency. The package.json now maintains the original "*" version. The main fix for the sourcemap issue remains in rollup.config.mjs only.

@Copilot @javiercn
Revert unintended package.json dependency change
bf26c4a 
Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>
@Copilot Copilot AI requested a review from javiercn July 3, 2025 16:00
Copilot finished work on behalf of javiercn July 3, 2025 16:00
@javiercn javiercn marked this pull request as ready for review July 3, 2025 17:52
@javiercn javiercn requested a review from a team as a code owner July 3, 2025 17:52
lewing
lewing approved these changes Jul 8, 2025
View reviewed changes
Copy link
Member

@lewing lewing left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is the remaining package-lock change intended?

javiercn
javiercn reviewed Jul 8, 2025
View reviewed changes
package-lock.json Outdated
@@ -18343,7 +18343,7 @@
"@babel/core": "^7.23.6",
"@babel/preset-env": "^7.23.6",
"@babel/preset-typescript": "^7.23.3",
"@microsoft/dotnet-js-interop": "*",
"@microsoft/dotnet-js-interop": "^10.0.0-dev",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot

Undo this change too.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reverted the package-lock.json changes in commit 6d9e1e4.

javiercn
javiercn reviewed Jul 8, 2025
View reviewed changes
Copy link
Member

@javiercn javiercn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot get back to work!

@Copilot @javiercn
Revert unintended package-lock.json changes
6d9e1e4 
Co-authored-by: javiercn <6995051+javiercn@users.noreply.github.com>
@Copilot Copilot SWE Agent
Copy link
Contributor Author

Copilot AI commented Jul 8, 2025

is the remaining package-lock change intended?

No, the package-lock.json change was unintended. I've reverted it in commit 6d9e1e4.

@Copilot Copilot AI requested a review from javiercn July 8, 2025 23:09
Copilot finished work on behalf of javiercn July 8, 2025 23:09
@Copilot Copilot SWE Agent
Copy link
Contributor Author

Copilot AI commented Jul 8, 2025

@copilot get back to work!

All feedback has been addressed! The sourcemap fix is implemented in rollup.config.mjs (commit 9dcc7e5), and the unintended changes to package.json and package-lock.json have been reverted (commits bf26c4a and 6d9e1e4).

Copilot finished work on behalf of javiercn July 8, 2025 23:15
@javiercn javiercn merged commit 238af05 into main Jul 9, 2025
29 checks passed
@javiercn javiercn deleted the copilot/fix-62295 branch July 9, 2025 16:05
@dotnet-policy-service dotnet-policy-service bot added this to the 10.0-preview7 milestone Jul 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lewing lewing lewing approved these changes

@javiercn javiercn Awaiting requested review from javiercn

Assignees

@javiercn javiercn

Copilot code review Copilot

Labels
Attention: Shared Code Modified
Projects
None yet
Milestone
10.0-preview7
Development

Successfully merging this pull request may close these issues.

[Blazor] Do not emit sourcemap link comment on production bundles for blazor.web.js and blazor.webassembly.js
3 participants
@Copilot @lewing @javiercn