fix(sourcemap): skip URL source roots when injecting sources content

[murugappan-medme-1]

What

injectSourcesContent misreads source maps whose sourceRoot is a URL.

computeSourceRoute tries realpath(path.resolve(dirname(file), map.sourceRoot)), which fails for a URL, so the root is treated as missing. The relative sources are then resolved with path.resolve(sourcePath) — against process.cwd() — and for a file inside node_modules that lands outside its package, producing:

Sourcemap for ".../node_modules/domutils/lib/esm/index.js" points to a source file outside its package: ".../index.ts"

Packages like domutils@3 and entities@4 publish maps with "sourceRoot": "https://raw.githubusercontent.com/…/src/" deliberately, so devtools can fetch the original sources from the tag they were built from. webpack:// roots take the same path. There is nothing local to read, and the package-boundary check is meaningless for a remote root.

This skips sources-content injection for maps with an external sourceRoot. The map is passed through unchanged, so other consumers keep resolving sources against the remote root.

Reproduction

Load any package that still ships a URL sourceRoot through Vite or Vitest — for example domutils@3.2.2, which old majors of htmlparser2/linkedom still depend on — and the warning above appears even though nothing is wrong with the package. fb55/domutils#2196 and fb55/entities#2084 are the package-side reports; their new majors ship src/ instead, but the old majors are still installed transitively across the ecosystem.

Tests

Two cases added to packages/vite/src/node/server/__tests__/sourcemap.spec.ts:

• a map with a remote sourceRoot is left untouched and does not warn;
• a map whose source genuinely resolves outside the package still warns.

pnpm vitest run packages/vite/src/node/server/__tests__/sourcemap.spec.ts passes (11 passed, 2 Windows-only skipped). The first case fails without the change.