Adding webpack-sources as dependency breaks the tests (some of the tests use older version(s) of node than webpack-sources requires as minimum). On the other hand, if the user is using module federation, their webpack version is at least 5 and webpack-sources come with it. So, adding webpack-sources as a dependency is not a must. For the same reason, I did not put the require statement at the top of the file (it might be missing for users using an older version of webpack)
Though this logic is generally sound, it (specifically the "their webpack version is at least 5 and webpack-sources come with it" part) doesn't account for cases in which webpack is being consumed from a single bundle. In those cases, the code from webpack-sources exists in the user's dev environment, but the actual webpack-sourcespackage doesn't. (This is true, for example, in nextjs, which pre-compiles many of its dependencies, including webpack, into minified bundles.) This can lead to errors when trying to use module federation alongside our nextjs SDK.
To fix this, webpack-sources has been added as a first-class runtime dependency. Because that guarantees that it will be present and require-able, its import has been moved out of a mid-file try-catch to instead be a legit import at the top of the file in which it's used.
In https://github.com/getsentry/sentry-webpack-plugin/pull/307, a dependency on
webpack-sourceswas added to the code, but not topackage.json. From that PR description:Though this logic is generally sound, it (specifically the "their webpack version is at least 5 and webpack-sources come with it" part) doesn't account for cases in which webpack is being consumed from a single bundle. In those cases, the code from
webpack-sourcesexists in the user's dev environment, but the actualwebpack-sourcespackage doesn't. (This is true, for example, in nextjs, which pre-compiles many of its dependencies, including webpack, into minified bundles.) This can lead to errors when trying to use module federation alongside our nextjs SDK.To fix this,
webpack-sourceshas been added as a first-class runtime dependency. Because that guarantees that it will be present andrequire-able, its import has been moved out of a mid-filetry-catchto instead be a legit import at the top of the file in which it's used.