Sourcemap problems (bad sourcecode references) after running npm audit --fix

🐛 bug report

I’m not sure how to categorize this bug, but the result of it is that debugging source-code in developer tools (I only tried Chrome) becomes difficult or impossible, presumably due to incorrect sourcemap references. For example, If I set a break point via debugger or in developer tools, it will break and enter the debugger but on the wrong line in the source code, and then when stepping through the code it jumps around to different lines and source files, seemingly at random.

It seems to have come from doing an npm audit --fix. I normally specify next for Parcel version in my package.json but npm complains that there are a lot of security vulnerabilities and suggests I perform an npm audit --fix. So I did that. I am not sure what changes were made except that the version of Parcel in my package.json was updated from next to 2.0.0-nightly.524, and debugging in Chrome developer tools becomes difficult because the lines of code being pointed to are wrong, for example when attempting to set a break point or step through the source code. I presume this is a problem with the sourcemaps. I was able to get it working again by changing the Parcel version back to next in package.json, wiping my node_modules folder and re-npm install-ing, but then npm complains about 46 vulnerabilities again.

🎛 Configuration (.babelrc, package.json, cli command)

I dont have a .babelrc, only package.json.

in package.json,

{
  "devDependencies": {
    "@babel/core": "^7.12.10",
    "documentation": "^13.1.0",
    "eslint": "^7.17.0",
    "eslint-config-prettier": "^6.15.0",
    "parcel": "next",
    "parcel-plugin-nuke-dist": "^1.0.1",
    "prettier": "^2.2.1"
  },
}

Parcel next version comes out to 2.0.0-beta.1 for most Parcel related things in package-lock.json.

🤔 Expected Behavior

Opening developer tools using Parcel’s provided sourcemaps should allow a developer to set breakpoints in the code and pause at the correct line of the source code.

😯 Current Behavior

Breakpoints seem to be observed but happen on the wrong lines and in the wrong files.

💁 Possible Solution

Ignore npm’s complaints about vulnerabilities and do not perform the suggested npm audit --fix

👉 Yes, I did donate some money! Thanks!!

[devongovett]

I think #5638 should fix the issue with comments.

Btw, @evanw your source map visualizer is incredibly good. Thanks for making it! 😄

[ebrensi]

Thanks a lot! I just woke up to see all of this!