Fix UMD Build .cjs Extension Blocked Due to Incorrect MIME Type

[eriestrisnadi]

Overview

Some browsers enforce strict Content Security Policy (CSP) or Cross-Origin Read Blocking (CORB) rules that check the MIME type of scripts. If the MIME type returned in the response headers doesn’t match the expected type for execution, the browser will block the script.

Example: JSDelivr

For instance, if you use the following snippet:

<script src="https://cdn.jsdelivr.net/npm/superstruct"></script>

JSDelivr will serve the script with a MIME type of application/node, which causes the browser to block it:

Example: Unpkg

For instance, if you use the following snippet:

<script src="https://unpkg.com/superstruct"></script>

Unpkg will serve the script with a MIME type of text/plain, which will also result in the script being blocked:

Suggested Fix

To resolve this issue, we recommend using the .js extension instead of .cjs. Changing the extension to .js when bundling will ensure proper execution of the script.

This change will help avoid MIME type mismatches and prevent browsers from blocking the script.