[workbox-build] Deprecated subdependencies: source-map@0.8.0-beta.0 and sourcemap-codec@1.4.8

[SpaceTimee]

Environment

• workbox-build version: 7.4.0
• Node.js version: v24.x
• Package manager: pnpm v10.22.0

Problem

When running pnpm install or pnpm update, the following deprecation warnings are shown:
WARN 2 deprecated subdependencies found: source-map@0.8.0-beta.0, sourcemap-codec@1.4.8

Dependency tree

vite-plugin-pwa 1.2.0
└── workbox-build 7.4.0
    ├── source-map 0.8.0-beta.0        ← deprecated
    └── @rollup/plugin-replace 2.4.2
        └── magic-string 0.25.9
            └── sourcemap-codec 1.4.8  ← deprecated

Expected behavior

workbox-build should update its dependencies to use non-deprecated packages:

• source-map@0.8.0-beta.0 → Replace with stable source-map or alternative
• sourcemap-codec → Replace with @jridgewell/sourcemap-codec (the recommended successor)

Related issues

• [workbox-build,workbox-webpack-plugin] source-map-url is deprecated #3019
• Deprecated dependencies end up in user projects #3228

Additional context

These warnings appear in every project using vite-plugin-pwa or any Workbox-based PWA tooling. While they don't affect functionality, they can cause confusion for developers maintaining production applications.

[DavidOsipov]

This is reproducible across projects that pull Workbox via vite-plugin-pwa.

Short diagnosis

• Deprecations come from:
  • workbox-build@7.4.0 → source-map@0.8.0-beta.0 (deprecated)
  • workbox-build@7.4.0 → @rollup/plugin-replace@2.4.2 → magic-string@0.25.9 → sourcemap-codec@1.4.8 (deprecated)

Context & why it happened

• Workbox bumped to source-map@0.8.0-beta.0 (see Update the source-map dependency #2716) to avoid a Node “fetch” detection crash (see if (typeof fetch === "function") misidentifies node environment mozilla/source-map#349). That explains the beta usage.
• magic-string@0.25.x still depends on sourcemap-codec; newer magic-string (0.30.x) uses @jridgewell/sourcemap-codec.

Proposed steps

1. Fix sourcemap-codec: Bump @rollup/plugin-replace → ^6.x in workbox-build so magic-string upgrades to 0.30.x and pulls @jridgewell/sourcemap-codec (non-deprecated). This is a small, testable change and should remove the sourcemap-codec warning.
2. Address source-map beta: Either wait for a stable 0.8.x release from source-map, or evaluate replacing the dependency with a maintained alternative (e.g., source-map-js or @jridgewell/source-map) with Node-environment tests (to avoid reintroducing the fetch-detection issue).

[pawagit]

In addition to sourcemap-codec and source-map, also glob@11.1.0 is now deprecated:
npm warn deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version.

It would be great if glob also could be bumped

[aidanhibbard]

We also can't setup vite-pwa for our project because workbox-build tries to pull in rollup@^2, but if you're using Nitro V3 you need rollup@^4.

It looks like this is already resolved in the V7 branch, and from my understanding would also resolve the deprecated sub-deps mentioned here, since the newer @rollup/plugin-replace@^6 no longer pulls in magic-string@0.25.x / sourcemap-codec@1.4.8.

Is there a timeline for V7.5.0? 7.4 was released in November of last year, if we have to keep slow-dripping releases like this then we'll be right back to this point shortly.

Could we get a nightly or non-official release even that just gets people rolling forward?