False "points to a source file outside its package" warning for sourcemaps with a URL sourceRoot #23518

Describe the bug

When a dependency ships a sourcemap whose sourceRoot is a URL, the Vite dev server (SSR transform) warns once per module that the source file lies outside the package.

injectSourcesContent calls computeSourceRoute, which does realpath(path.resolve(dirname(file), map.sourceRoot)). For a URL that always fails, so the root is treated as missing and the map's relative sources are resolved with path.resolve(sourcePath) — i.e. against process.cwd() — landing outside node_modules/<pkg> and tripping the package-boundary check.

Packages like domutils@3 and entities@4 publish "sourceRoot": "https://raw.githubusercontent.com/<repo>/<sha>/src/" on purpose, so devtools can fetch the original sources from the tag they were built from. webpack:// roots hit the same code path. New majors of those packages fixed it by shipping src/ instead (fb55/domutils#2196, fb55/entities#2084), but the old majors are still installed transitively across the ecosystem (e.g. through htmlparser2@10 / linkedom).

Related: #9501 (vite serve vs build source resolution), though this is specifically the URL sourceRoot case.

I intend to submit a PR for this.

Reproduction

https://github.com/murugu-21/vite-url-source-root-repro-

Steps to reproduce

git clone https://github.com/murugu-21/vite-url-source-root-repro
cd vite-url-source-root-repro-
npm install
npm run repro

System Info

System:
    OS: macOS 26.6.2
    CPU: (12) arm64 Apple M4 Pro
    Memory: 166.31 MB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 24.20.0 - /Users/murugappan/.local/state/fnm_multishells/84801_1789716563153/bin/node
    Yarn: 1.22.22 - /Users/murugappan/.local/state/fnm_multishells/84801_1789716563153/bin/yarn
    npm: 11.19.0 - /Users/murugappan/.local/state/fnm_multishells/84801_1789716563153/bin/npm
    pnpm: 11.25.0 - /Users/murugappan/.local/state/fnm_multishells/84801_1789716563153/bin/pnpm
    bun: 1.4.2 - /Users/murugappan/.bun/bin/bun
  Browsers:
    Chrome: 153.0.8010.48
    Safari: 27.0
  npmPackages:
    vite: ^8.2.2 => 8.3.0

Used Package Manager

npm

Logs

Sourcemap for ".../node_modules/domutils/lib/esm/index.js" points to a source file outside its package: ".../index.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/stringify.js" points to a source file outside its package: ".../stringify.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/traversal.js" points to a source file outside its package: ".../traversal.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/manipulation.js" points to a source file outside its package: ".../manipulation.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/querying.js" points to a source file outside its package: ".../querying.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/legacy.js" points to a source file outside its package: ".../legacy.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/helpers.js" points to a source file outside its package: ".../helpers.ts"
Sourcemap for ".../node_modules/domutils/lib/esm/feeds.js" points to a source file outside its package: ".../feeds.ts"

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.