Problem
The preview-server middleware in packages/static/src/plugin/server.ts (configurePreviewServer) responds with res.end(html) without setting any Content-Type header — both for matched entry files and for the SPA fallback. Browsers generally sniff it as HTML, but the response should be explicit (and some environments/tools won't sniff).
Suggested fix
Set res.setHeader("Content-Type", "text/html; charset=utf-8") before res.end(html). The two lookup loops (candidate files, then SPA fallback over index.html/index.htm) could also be collapsed into a single candidate list while touching this code.
Found during a framework audit.
Problem
The preview-server middleware in
packages/static/src/plugin/server.ts(configurePreviewServer) responds withres.end(html)without setting anyContent-Typeheader — both for matched entry files and for the SPA fallback. Browsers generally sniff it as HTML, but the response should be explicit (and some environments/tools won't sniff).Suggested fix
Set
res.setHeader("Content-Type", "text/html; charset=utf-8")beforeres.end(html). The two lookup loops (candidate files, then SPA fallback overindex.html/index.htm) could also be collapsed into a single candidate list while touching this code.Found during a framework audit.