fix(sourcemap): skip URL source roots when injecting sources content

[murugu-21]

What

Fixes #23518.

injectSourcesContent misreads source maps whose sourceRoot is a URL.

computeSourceRoute tries realpath(path.resolve(dirname(file), map.sourceRoot)), which fails for a URL, so the root is treated as missing. The relative sources are then resolved with path.resolve(sourcePath) — against process.cwd() — and for a file inside node_modules that lands outside its package, producing:

Sourcemap for ".../node_modules/domutils/lib/esm/index.js" points to a source file outside its package: ".../index.ts"

Packages like domutils@3 and entities@4 publish maps with "sourceRoot": "https://raw.githubusercontent.com/…/src/" deliberately, so devtools can fetch the original sources from the tag they were built from. webpack:// roots take the same path. There is nothing local to read, and the package-boundary check is meaningless for a remote root.

This skips sources-content injection for maps with an external sourceRoot. The map is passed through unchanged, so other consumers keep resolving sources against the remote root.

Reproduction

https://github.com/murugu-21/vite-url-source-root-repro- — pure vite (createServer + ssrLoadModule with ssr.noExternal), no test runner:

git clone https://github.com/murugu-21/vite-url-source-root-repro-.git
cd vite-url-source-root-repro-
npm install
npm run repro

Tests

Two cases added to packages/vite/src/node/server/__tests__/sourcemap.spec.ts:

• a map with a remote sourceRoot is left untouched and does not warn;
• a map whose source genuinely resolves outside the package still warns.

pnpm vitest run packages/vite/src/node/server/__tests__/sourcemap.spec.ts passes (11 passed, 2 Windows-only skipped). The first case fails without the change.

[murugu-21]

@btea this is my first pr in Vite and I don't have merge access, can u help me request the right maintainer to review and merge this pr? Thanks!

[btea]

Don't worry, we still need to wait for the review from others.

[sapphi-red]

LGTM. I've also added the handling for sources field