Source Maps Production

1import { lineOf } from '../util.mjs';
2
3export const metadata = {
4  id: 'source-maps-production',
5  title: 'Source maps enabled in production',
6  severity: 'low',
7  billingDimension: 'edge-requests',
8  trafficIndependent: true,
9  description:
10    'productionBrowserSourceMaps: true ships .map files in the production bundle, increasing transfer size 30-100% per visitor. Useful for error reporting via Sentry; not useful for users.',
11  fix:
12    'Keep source maps generation but exclude them from the public bundle. Upload to your error tracker via build-time CI step; do not serve them with the deployment.',
13  citations: [
14    'https://nextjs.org/docs/messages/improper-devtool',
15  ],
16  excludeGlobs: [],
17  includeGlobs: ['next.config.{js,mjs,ts}', 'svelte.config.{js,mjs,ts}'],
18};
19
20export function scan({ files }) {
21  const out = [];
22  for (const { path, content } of files) {
23    if (!/^next\.config\.(js|mjs|ts)$/.test(path.split('/').pop() ?? '')) continue;
24    const m = /productionBrowserSourceMaps\s*:\s*true/.exec(content);
25    if (m) {
26      out.push({
27        pattern: metadata.id,
28        file: path,
29        line: lineOf(content, m.index),
30        evidence: 'productionBrowserSourceMaps: true',
31        trafficIndependent: metadata.trafficIndependent,
32      });
33    }
34  }
35  return out;
36}