◐ Shell
reader mode source ↗
Skip to content

feat(@angular/build): emit debug ids for stable subresource integrity hashes#33110

Open
IchordeDionysos wants to merge 1 commit into
angular:mainfrom
simpleclub-extended:feat/sub-resource-integrity-with-debug-id
Open

feat(@angular/build): emit debug ids for stable subresource integrity hashes#33110
IchordeDionysos wants to merge 1 commit into
angular:mainfrom
simpleclub-extended:feat/sub-resource-integrity-with-debug-id

Conversation

@IchordeDionysos

@IchordeDionysos IchordeDionysos commented Apr 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Enable generating sub-resource integrity hashes when using error tracking tools relying on Debug IDs linking generated code files with source maps.

Closes #33108

PR Checklist

Please check to confirm your PR fulfills the following requirements:

PR Type

What kind of change does this PR introduce?

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • CI related changes
  • Documentation content changes
  • Other... Please describe:

What is the current behavior?

When Angular generates source maps, they only include a link to the source map URL and no Debug ID:

console.log(1);
//# sourceMappingURL=foo.js.map

The source map file also does not contain a debug ID:

{ "version": 3, "debugId": "old", "mappings": "" }

Issue Number: #33108

What is the new behavior?

When Angular generates source maps, in addition to the source map URL, generated files will also include a Debug ID above the sourceMappingURL:

console.log(1);
//# debugId=11111111-2222-5333-9444-555555555555
//# sourceMappingURL=foo.js.map

In addition the source map file will include the matching Debug ID:

{ "version": 3, "debugId": "old", "mappings": "", "debugId": "11111111-2222-5333-9444-555555555555" }

Does this PR introduce a breaking change?

  • Yes
  • No

Other information

I'm happy to hear if there are concerns with this particular approach and which alternative solutions might be a better solution.

This allows error tracking to more reliably map generated code files to their corresponding stack traces.
Error tracking tools have historically solved this by running post-processing scripts that generate and inject Debug IDs after the framework build script and before deployment.

However, this approach will break any integrity hash that Angular generated for SRI as the file content will have changed.

--

This PR is part of a two fold effort to enable SRI for our specific integration of Angular.

The first PR, implementing support for dynamically loaded files can be found here, and should be merged first: #33109

@IchordeDionysos IchordeDionysos mentioned this pull request Apr 30, 2026
Merged
13 tasks
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Apr 30, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hide comment

Code Review

This pull request implements ECMA-426 Debug ID injection into JavaScript files and source maps using a new deterministic UUIDv5 utility. The injection is integrated into the post-bundle build process and includes validation tests. Review feedback suggests hardening the regex for comment detection to prevent false positives and optimizing the source map JSON update to maintain formatting and performance.

@IchordeDionysos IchordeDionysos mentioned this pull request Apr 30, 2026
Closed
1 task
@clydin

clydin commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Sorry for the delay. Just the comment about the regular expressions and this should be good to merge.
We may need to look at performance aspects in the prereleases for 22.1 but that can happen after this lands.

Also please squash the commits.

@IchordeDionysos
feat(@angular/build): emit debug ids for stable subresource integrity… …
11b40dc 
… hashes

Enable generating sub-resource integrity hashes when using error tracking tools relying on Debug IDs linking generated code files with source maps.

Closes angular#33108
fix: persist formatting of source map JSON

fix: improve source map comment detection and test fix
@IchordeDionysos IchordeDionysos force-pushed the feat/sub-resource-integrity-with-debug-id branch from 29e12e5 to 11b40dc Compare June 13, 2026 15:06
@IchordeDionysos

IchordeDionysos commented Jun 13, 2026

Copy link
Copy Markdown
Contributor Author

@clydin no worries you were probably more focused on the 22 release with it's amazing features 😍
Sorry it took a bit longer, was a bit out of the topic due to it being a while ago.

Adjusted the Regex and did one minor incorrect test assumption.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@clydin clydin

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area: @angular/build detected: feature PR contains a feature commit

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Emit ECMA-426 source map debug IDs for stable subresource integrity

2 participants

@IchordeDionysos @clydin