Thanks! Good luck with Pyodide, definitely let us know if you need anything else!

@di Hi, it seems that packages that have been cached before this PR don't have this header yet. Is there a regular period when PyPI flushes the cache?

For example, pyperformance (https://pypi.org/simple/pyperformance) has CORS headers:

$ curl -v https://pypi.org/simple/pyperformance/ 2>&1 | grep access-control
< access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
< access-control-allow-methods: GET
< access-control-allow-origin: *
< access-control-expose-headers: X-PyPI-Last-Serial
< access-control-max-age: 86400

while, snowballstemmer (https://pypi.org/simple/snowballstemmer/) doesn't:

$ curl -v https://pypi.org/simple/snowballstemmer/ 2>&1 | grep access-control
[no headers]

I manually purged the cache for this one and the headers are now present:

$ curl -v https://pypi.org/simple/snowballstemmer/ 2>&1 | grep access-control
< access-control-allow-headers: Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since
< access-control-allow-methods: GET
< access-control-allow-origin: *
< access-control-expose-headers: X-PyPI-Last-Serial
< access-control-max-age: 86400

I'm not sure why our CDN was serving a stale page here, but this is likely related to #12214.

If you have other examples, I can purge them as well.

Thanks! I didn't realize that there was an existing issue about this.