The web worker
MapLibre does its tile parsing in a Web Worker. In v6 that worker is a real module file, dist/maplibre-gl-worker.mjs, and it imports a sibling file, dist/maplibre-gl-shared.mjs, using a relative path.
Loading from a CDN. The worker URL is derived automatically from import.meta.url, so no setup is required. But because the worker resolves its sibling relatively, the whole dist/ directory has to stay reachable — point at the full file path:
import * as maplibregl from 'https://unpkg.com/maplibre-gl@6.1.0/dist/maplibre-gl.mjs';
CDNs that re-bundle and rewrite module paths break this: the main module loads, but the worker request 404s and the map hangs without an error. This is why the live editor in this workshop pins the plain unpkg dist/maplibre-gl.mjs URL.
Content Security Policy. When MapLibre is loaded cross-origin from a CDN, the worker is constructed from a same-origin blob URL, so your CSP needs:
worker-src 'self' blob: ;
img-src data: blob: 'self' ;
If you self-host the worker (any bundler setup, including our template), the worker URL is same-origin and blob: is not required.