fix(sourcemaps): Prevent Debug ID collisions#3356
Conversation
Generate Debug IDs from both the generated JS bytes and the sourcemap bytes when a sourcemap is available. This keeps distinct JS files from sharing a Debug ID when their maps are byte-identical, while preserving existing IDs already present in JS or sourcemaps. Add a regression test for identical empty maps with distinct JS inputs. Update the sourcemaps inject snapshots because the injected Debug IDs and embedded source map payloads now change for every affected case. Fixes #3350 Fixes [CLI-341](https://linear.app/getsentry/issue/CLI-341/sentry-cli-mapping-identical-empty-source-maps-to-same-debug-id)
a3465c5 to
3f96f9f
Compare
|
@JPeer264 this change is needed to fix #3350, but it also will change all the debug IDs (i.e. the same sourcemap/minified file pair in the previous version will have a different debug ID after this update is released). I am assuming that this is okay, but are you aware of any situation where this could break the product? |
Bump pinned GitHub-hosted runner labels to the newest GA images from actions/runner-images. Also switch the OpenSSL bottle tag to tahoe so the x86_64 macOS 26 jobs can fetch bottles correctly. Ref #3356
Bump pinned GitHub-hosted runner labels to the newest GA images from actions/runner-images. Use the x86_64 Homebrew command under Rosetta to fetch the Tahoe OpenSSL bottle for the macOS 26 jobs. Ref #3356
Bump pinned GitHub-hosted runner labels to the newest GA images from actions/runner-images. Use the x86_64 Homebrew command under Rosetta to fetch the Tahoe OpenSSL bottle for the macOS 26 jobs. Ref #3356
Bump pinned GitHub-hosted runner labels to the newest GA images from actions/runner-images. This updates Windows jobs to windows-2025 and macOS jobs to macos-26 while keeping Ubuntu on 24.04, which is still the newest GA Ubuntu label. Ref #3356
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6fc203f. Configure here.
| inject::debug_id_from_js_and_sourcemap_bytes_hashed( | ||
| source_file.contents.as_slice(), | ||
| sourcemap_file.contents.as_slice(), | ||
| ); |
There was a problem hiding this comment.
Shared map Debug IDs nondeterministic
Medium Severity
When multiple JS files explicitly reference the same external sourcemap without a Debug ID, the new hash includes the first processed JS file’s bytes. Because sourcemap_references is iterated as a HashMap, that “first” file can change across runs, so the written Debug ID is no longer stable for the same inputs.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 6fc203f. Configure here.
There was a problem hiding this comment.
This is probably not a very common occurrence in the real world. We are therefore choosing not to address this unless we receive a bug report
3 participants
Generate Debug IDs from both the generated JS bytes and the sourcemap bytes when a sourcemap is available. This keeps distinct JS files from sharing a Debug ID when their maps are byte-identical, while preserving existing IDs already present in JS or sourcemaps.
Add a regression test for identical empty maps with distinct JS inputs. Update the sourcemaps inject snapshots because the injected Debug IDs and embedded source map payloads now change for every affected case.
Fixes #3350
Fixes CLI-341