Tab preview modal likely rendered blank between the #44 and #68 core CSP fixes

[carochacs]

Summary

src/tab-preview.js CDN-loads alphaTab (render-only, no synth) to show a GP5 tab preview modal:

const _TAB_PREVIEW_CDN = 'https://cdn.jsdelivr.net/npm/@coderline/alphatab@' + ...;
...
s.src = _TAB_PREVIEW_CDN + '/alphaTab.min.js';
...
_tabPreviewApi = new alphaTab.AlphaTabApi(mount, { ... });

alphaTab spawns its rendering worker from a blob: URL internally. Core's baseline CSP, added in get-flashbacks/feedBackgot-feedBack#44 (the retune-modal XSS fix, which also bundled the security-audit CSP work), set script-src/style-src/img-src/font-src/media-src/connect-src but never worker-src. Per CSP fallback rules, a worker without an explicit worker-src falls back to script-src's policy — which allows 'self'/'unsafe-inline'/https: but not blob: — so the browser silently blocked alphaTab's worker.

This exact bug was reported and fixed for the tabview and staffview plugins in get-flashbacks/feedBackgot-feedBack#68 ("can't see the Sax arrangement in staffview/tabview" — reproduced as a general regression, not arrangement-specific), which added worker-src 'self' blob:; to core's CSP.

tab-preview.js uses the identical CDN-loaded alphaTab bundle and the identical blob-worker mechanism, so it was almost certainly hitting the same blank-render failure for the whole window got-feedBack#44 was live (before got-feedBack#68 merged) — just not reported here.

Status

No action needed in this repo — got-feedBack#68's CSP fix is server-wide (get-flashbacks/feedBack's server.py), so the tab preview modal is already fixed as a side effect once that PR is merged. Opening this only so the blank-preview window is on record, in case anyone hit it and didn't connect it to the CSP change.

Repro window

Between get-flashbacks/feedBackgot-feedBack#44 merging and get-flashbacks/feedBackgot-feedBack#68 merging.

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}