Summary

External scripts recreated by the external-script plugin lose HTML attributes such as data-message, crossorigin, and referrerpolicy. Assigning newScript[attribute.name] creates unrelated JavaScript properties for names that do not match DOM properties, so widgets lose configuration and browser request settings.

Copy attributes with setAttribute(). The browser regression executes a local script and reads document.currentScript.dataset, crossOrigin, and referrerPolicy from the actual replacement element.

Example: <script src="/widget.js" data-message="hello" crossorigin="anonymous" referrerpolicy="no-referrer"></script> now retains all three settings when executed by the plugin.

Related issue, if any:

Reproduced on develop at d823dbe51c1b2dea4c2091e2b952ded0d1e16616; no matching open fix found.

What kind of change does this PR introduce?

• Bugfix

For any code change,

• Related documentation has been updated, if needed (no new configuration)
• Related tests have been added or updated

Does this PR introduce a breaking change?

• No

Validation

• Before the fix, the script ran without page errors but received undefined, null, and an empty string instead of the configured attribute values.
• npm run test:e2e:chromium -- test/e2e/plugins.test.js --workers=1 --reporter=line: 9 tests passed, including the regression.
• npm run test:jest -- --runInBand: 128 tests and 46 snapshots passed.
• npm run build, npm run lint, npm run typecheck, and git diff --check: passed.
• Independent read-only review: no required changes.

Browser coverage: Chromium via Playwright; Firefox, WebKit, and unrelated E2E suites were not run locally.

Developed with assistance from OpenAI Codex; regression and fix validated locally.