Let's wait on approvals from folks who might have more context around the sourcemap-register.js in actions 🙇

It looks like this is the relevant issue upstream: evanw/node-source-map-support#320. The issue itself seems pretty harmless, I doubt this would introduce a vulnerability given it only relates to the source maps.

It looks like the original intent of the package was to implement source map support when Node/V8 didn't support it, but the Chrome DevTools did. I don't think that is the case any longer, as it looks like support for source maps is built-in to Node now via the --enable-source-maps CLI option: https://nodejs.org/docs/v22.14.0/api/cli.html#--enable-source-maps.

I think that source maps could be helpful, as it might make the error messages more helpful by referencing the original source file name instead of the compiled file name. That said, I don't think removing this file should cause any significant impact as the worst case scenario is the error messages are perhaps slightly worse, but given how simple this library is it's not a big deal I think.

It's may also be worth reconsidering our usage of @vercel/ncc, as it seems to be less maintained these days. There are more modern bundlers/builders such as tsdown we could consider.