By Alexandro · Updated 2026-11-06
A deprecation warning is a maintenance signal
source-map-resolve resolves a generated file's source-map URL, reads the map and resolves its source files. It does not replace a consumer that maps generated line/column coordinates back to original positions. The upstream repository marks the package deprecated.
Start by locating the dependency:
npm explain source-map-resolve
npm ls source-map-resolve --all
For a transitive dependency, update the bundler, debugger or loader that owns it. If that parent removed the need for this library, prefer removing the chain. If your own code only reads an already available map, you may not need a file resolver at all. A mapping-consumer package alone does not reproduce file discovery or callback/error behavior.
Replace only when the resolver API is still needed
For a direct consumer whose calls have been characterized:
npm install --save-exact source-map-resolve@npm:@stackline/[email protected]
Existing CommonJS imports keep the name source-map-resolve. Alternatively import the scoped package directly. Do not force an override throughout an untested tree. Check synchronous and callback paths, inline and external maps, malformed map errors, URL decoding and Windows paths used by the parent.
Execute a focused integration test
The pinned example uses @stackline/source-map-resolve 1.0.5. Its injected reader makes unexpected disk access fail and keeps the test self-contained:
import assert from 'node:assert/strict';
import resolver from '@stackline/source-map-resolve';
const map = {version:3,file:'app.js',sources:['input.ts'],names:[],mappings:'AAAA',sourcesContent:['const answer = 42;']};
const code = 'var answer=42;\n//# sourceMappingURL=data:application/json;base64,'+Buffer.from(JSON.stringify(map)).toString('base64');
const result = resolver.resolveSync(code, '/workspace/app.js', () => {throw new Error('Unexpected file access');});
assert.deepEqual(result.map,map);
assert.deepEqual(result.sourcesContent,['const answer = 42;']);
assert.equal(resolver.resolveSync('var x=1;', '/workspace/plain.js', () => ''),null);
const external = resolver.resolveSync('x();\n//# sourceMappingURL=app.js.map','/workspace/app.js',p=>{
assert.equal(p,'/workspace/app.js.map');return JSON.stringify(map);
});
assert.deepEqual(external.map,map);
console.log('source-map: inline map, external map, embedded source and missing map passed');
Expected: embedded source content is retained; external map access uses the expected path; missing maps return null. This does not exercise every Windows drive, network URL or asynchronous error path. Add fixtures from your actual source-map producer and the consumer's integration tests before changing a lockfile.
A specific downstream contribution
Microsoft React Native Tools PR #2900 was merged on 2026-10-30. The incorporated diff changes the source-map-resolve dependency from 0.5.3 to the npm alias npm:@stackline/[email protected] and updates the lockfile. Its existing imports and source-map combinator integration remain in place. The PR body originally mentioned 1.0.0; the merged diff is the authority for the final version.
Alexandro maintains the fork and authored the contribution. This is evidence of that specific accepted dependency change, not Microsoft endorsement of the full package portfolio. Upstream attribution and the MIT license remain in the source repository.