#3451 [workbox-build] Deprecated subdependencies: source-map@0.8.0-beta.0 and sourcemap-codec@1.4.8

[Anonymous]

Originally created by: SpaceTimee

Environment

• workbox-build version: 7.4.0
• Node.js version: v24.x
• Package manager: pnpm v10.22.0

Problem

When running pnpm install or pnpm update, the following deprecation warnings are shown:
WARN 2 deprecated subdependencies found: source-map@0.8.0-beta.0, sourcemap-codec@1.4.8

Dependency tree

vite-plugin-pwa 1.2.0
└── workbox-build 7.4.0
    ├── source-map 0.8.0-beta.0        ← deprecated
    └── @rollup/plugin-replace 2.4.2
        └── magic-string 0.25.9
            └── sourcemap-codec 1.4.8  ← deprecated

Expected behavior

workbox-build should update its dependencies to use non-deprecated packages:

• source-map@0.8.0-beta.0 → Replace with stable source-map or alternative
• sourcemap-codec → Replace with @jridgewell/sourcemap-codec (the recommended successor)

Related issues

• [#3019]
• [#3228]

Additional context

These warnings appear in every project using vite-plugin-pwa or any Workbox-based PWA tooling. While they don't affect functionality, they can cause confusion for developers maintaining production applications.

[Anonymous]

Originally posted by: DavidOsipov

This is reproducible across projects that pull Workbox via vite-plugin-pwa.

Short diagnosis

• Deprecations come from:
• workbox-build@7.4.0 → source-map@0.8.0-beta.0 (deprecated)
• workbox-build@7.4.0 → @rollup/plugin-replace@2.4.2 → magic-string@0.25.9 → sourcemap-codec@1.4.8 (deprecated)

Context & why it happened

• Workbox bumped to source-map@0.8.0-beta.0 (see [#2716]) to avoid a Node “fetch” detection crash (see mozilla/source-map#349). That explains the beta usage.
• magic-string@0.25.x still depends on sourcemap-codec; newer magic-string (0.30.x) uses @jridgewell/sourcemap-codec.

Proposed steps

1. Fix sourcemap-codec: Bump @rollup/plugin-replace → ^6.x in workbox-build so magic-string upgrades to 0.30.x and pulls @jridgewell/sourcemap-codec (non-deprecated). This is a small, testable change and should remove the sourcemap-codec warning.
2. Address source-map beta: Either wait for a stable 0.8.x release from source-map, or evaluate replacing the dependency with a maintained alternative (e.g., source-map-js or @jridgewell/source-map) with Node-environment tests (to avoid reintroducing the fetch-detection issue).

[Anonymous]

Originally posted by: pawagit

In addition to sourcemap-codec and source-map, also glob@11.1.0 is now deprecated:
npm warn deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version.

It would be great if glob also could be bumped

[Anonymous]

Originally posted by: aidanhibbard

We also can't setup vite-pwa for our project because workbox-build tries to pull in rollup@^2, but if you're using Nitro V3 you need rollup@^4.

It looks like this is already resolved in the V7 branch, and from my understanding would also resolve the deprecated sub-deps mentioned here, since the newer @rollup/plugin-replace@^6 no longer pulls in magic-string@0.25.x / sourcemap-codec@1.4.8.

Is there a timeline for V7.5.0? 7.4 was released in November of last year, if we have to keep slow-dripping releases like this then we'll be right back to this point shortly.

Could we get a nightly or non-official release even that just gets people rolling forward?