For now, we vendor these three packages implecitly when generating the source-map bundle:
https://searchfox.org/mozilla-central/rev/f118dae98073bc17efb8604a32abfcb7b4e05880/devtools/client/debugger/packages/devtools-source-map/package.json#22,24
(whatwg-url is a dependency of source-map)

Let's vendor them like other libraries in devtools/client/shared/vendor/ so that we can more easily review what we ship and modify their code locally.

The MD5 file is being updated via:
$ wget https://github.com/pvorb/node-md5/archive/refs/tags/v2.3.0.tar.gz
$ tar zxvf v2.3.0.tar.gz
$ cd node-md5-2.3.0/
=> here edit webpack.config.js to set libraryTarget: "umd"
$ yarn webpack
$ cp dist/md5.min.js ../md5.js
$ cd ..
$ rm -rf v2.3.0.tar.gz node-md5-2.3.0

Vendor it in m-c, so that it can be used as a regular module
and not bundled via WebPack.

For now, it was vendored by a manual run to webpack from the debugger folder (node bin/bundle.js).
Ship a more explicit bundle of it, next to all other already existing vendored files.

$ git clone git@github.com:mozilla/source-map.git
$ cd source-map/
$ git checkout 0.8.0-beta.0
$ rm -rf .git/
/!\ lib/read-wasm.js has been edited and need to be preserved/rebased /!
$ hg/git add source-map.js LICENCE lib/

Also, hopefully temporarily vendor whatwg-url:
$ git clone git@github.com:jsdom/whatwg-url.git
$ cd whatwg-url/
$ npm install
$ npm run build
$ npm run build-live-viewer
$ cp live-viewer/whatwg-url.js ..
$ hg/git add whatwg-url.js

and also temporarily replace source-map/lib/url.js with source-map/lib/url-browser.js
And edit this file to do:
module.exports = require("devtools/client/shared/vendor/whatwg-url").URL;

Hopefully, we can remove whatwg-url dependency and remove all this.

https://hg.mozilla.org/mozilla-central/rev/0fc51ca89ae9
https://hg.mozilla.org/mozilla-central/rev/0fcfab088b79