From a4c6d7867a397c312ffc0af1ea62ef1e76a014ca Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Mon, 26 Oct 2026 11:23:38 +0100
Subject: [PATCH] test: expect the plugin sandbox assets among the CORS-enabled
 static paths

---
 lib/__tests__/next-config-cors.test.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/__tests__/next-config-cors.test.ts b/lib/__tests__/next-config-cors.test.ts
index 3f986d29a..475ff2629 100644
--- a/lib/__tests__/next-config-cors.test.ts
+++ b/lib/__tests__/next-config-cors.test.ts
@@ -35,6 +35,8 @@ describe('Next static asset CORS', () => {
       rule.headers.some((header) => header.key.toLowerCase() === 'access-control-allow-origin')
     );
 
-    expect(corsRules?.map((rule) => rule.source)).toEqual(['/_next/static/:path*']);
+    // The plugin sandbox's prebuilt, content-hashed script and stylesheet
+    // (scripts/build-plugin-sandbox.mjs) are public static files too.
+    expect(corsRules?.map((rule) => rule.source)).toEqual(['/_next/static/:path*', '/plugin-sandbox-assets/:path*']);
   });
 });