Vite 8 returns 403 Forbidden for cross-origin classic script requests to /src/*.ts

Problem

Loading a Vite-served TS/ESM module URL (e.g. /src/plugin.ts) as a classic (non-module) <script src=...> from a different origin returns 403 Forbidden in Vite 8, though it worked in Vite 7.3.x. Commonly hit when a third-party library (e.g. TinyMCE external_plugins) loads a bundler-served file directly as a script rather than as an ES module import.

Solution

Vite 8 enforces CORS/same-origin checks more strictly for module-like requests. Fix: configure the consuming library to request the script with crossorigin set, e.g. for TinyMCE: `tinymce.init({ crossorigin: () => 'anonymous' })`. This is a client-request header fix, not a vite.config workaround. Confirmed by the reporter to resolve the 403.