In #307, a dependency on `webpack-sources` was added to the code, but not to `package.json`. From that PR description:

> Adding webpack-sources as dependency breaks the tests (some of the tests use older version(s) of node than webpack-sources requires as minimum). On the other hand, if the user is using module federation, their webpack version is at least 5 and webpack-sources come with it. So, adding webpack-sources as a dependency is not a must. For the same reason, I did not put the require statement at the top of the file (it might be missing for users using an older version of webpack)

Though this logic is generally sound, it (specifically the "their webpack version is at least 5 and webpack-sources come with it" part) doesn't account for cases in which webpack is being consumed from a single bundle. In those cases, the _code_ from `webpack-sources` exists in the user's dev environment, but the actual `webpack-sources` _package_ doesn't. (This is true, for example, in nextjs, which pre-compiles many of its dependencies, including webpack[1], into minified bundles.) This can lead to errors when trying to use module federation alongside our nextjs SDK.

To fix this, `webpack-sources` has been added as a first-class runtime dependency. Because that guarantees that it will be present and `require`-able, its import has been moved out of a mid-file `try-catch` to instead be a legit import at the top of the file in which it's used.

[1] https://github.com/vercel/next.js/blob/c2f48ea86d448c8be1982b46f184b1d2f2d6cd50/packages/next/compiled/webpack/bundle5.js