[nextjs] sourceMappingURL comment is not stripped from Turbopack worker chunks when deleteSourcemapsAfterUpload is enabled #25874

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases (using 11.8.0; the relevant code is unchanged on develop, see Additional Context)

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/nextjs

SDK Version

11.8.0

Framework Version

Next 16.4.2 (Turbopack production build)

Link to Sentry event

No response

Reproduction Example/SDK Setup

// next.config.ts
import { withSentryConfig } from '@sentry/nextjs/config'

export default withSentryConfig(
  {
    output: 'export',
    productionBrowserSourceMaps: true,
  },
  {
    org: '<org>',
    project: '<project>',
    authToken: process.env.SENTRY_AUTH_TOKEN,
    sourcemaps: {
      deleteSourcemapsAfterUpload: true,
    },
  },
)

The app creates a Web Worker with new Worker(new URL('./worker', import.meta.url)), so Turbopack emits a worker bootstrap chunk (static/chunks/turbopack-worker-<hash>.js).

Steps to Reproduce

1. Use the config above in a Next.js 16 app that creates a Web Worker with new Worker(new URL(..., import.meta.url)).
2. Run next build (Turbopack) with SENTRY_AUTH_TOKEN set, so that source maps are uploaded.
3. Inspect the end of .next/static/chunks/turbopack-worker-<hash>.js (or the copied file in out/).

Expected Result

All sourceMappingURL comments are removed from the client JS after the source maps are uploaded and deleted, as with every other chunk.

Actual Result

The worker bootstrap chunk still ends with a sourceMappingURL comment that points to a deleted .map file:

;!function(){try{var e=...;e._sentryDebugIds[n]="<debug-id>",e._sentryDebugIdIdentifier="sentry-dbid-<debug-id>")}catch(e){}}();
!function(){ /* Turbopack worker bootstrap */ }();

//# sourceMappingURL=<hash>.js.map
//# debugId=<debug-id>

All other chunks are stripped correctly. Without SENTRY_AUTH_TOKEN, the upload does not run and the comment is stripped, so the issue only appears in builds that actually upload source maps.

Additional Context

This seems to be caused by two steps that run in this order in handleRunAfterProductionCompile:

1. Upload: @sentry/bundler-plugins calls sentry sourcemap upload (sentry CLI 0.45.0) without --no-rewrite. For JS files that have neither a //# debugId= comment nor a debug ID in their source map, the CLI injects a debug ID in place. It prepends the _sentryDebugIds snippet and appends \n//# debugId=<id>\n after the existing sourceMappingURL comment.
   • https://github.com/getsentry/cli/blob/3567c3c937b5cc06667d5b023bda0b2d3f472c54/packages/cli/src/lib/sourcemap/debug-id.ts#L230
   • Turbopack's native debug IDs (turbopack.debugIds) are added to regular chunks, but not to the worker bootstrap chunk, so only this chunk gets injected by the CLI.
2. Strip: stripSourceMappingURLComments uses a regex anchored to the end of the file, so it no longer matches once //# debugId= follows the sourceMappingURL comment.

   • sentry-javascript/packages/nextjs/src/config/handleRunAfterProductionCompile.ts

     Lines 98 to 100 in 90c1ebb

     	if (deleteSourcemapsAfterUpload && buildTool === 'turbopack' && !sriEnabled) {
     	await stripSourceMappingURLComments(path.join(distDir, 'static'), sentryBuildOptions);
     	}

   • sentry-javascript/packages/nextjs/src/config/handleRunAfterProductionCompile.ts

     Line 140 in 90c1ebb

     const SOURCEMAPPING_URL_COMMENT_REGEX = /(?:^|\n)\/\/[#@] sourceMappingURL=[^\s'"`*]+\s*$/;

The relevant code is unchanged on develop of sentry-javascript and in sentry CLI 0.47.0 (the CLI still appends //# debugId= after existing content).

A possible fix is to make the strip regex tolerate trailing //# debugId= comments (or remove sourceMappingURL comments regardless of position in the trailing comment block).