It does appear that auto-minify was the culprit. I don’t know how/when it got enabled. I didn’t do it knowingly, having been bitten by similar problems with other systems in the past. My suspicion is that Cloudflare recently (I think) added a button to activate a set of basic settings to improve the way that browsers interacted with web sites. I reviewed the suggested changes and enabled those that looked sensible and safe. I’ve gone back to look at the options again and don’t see any reference to auto-minify, but perhaps it got enabled as part of the ‘basic settings’?
The Cloudflare cache also explains why this problem suddenly appeared hours after I’d applied Discourse updates. I have Cloudflare browser TTL caching set to 4 hours. I didn’t purge the Cloudflare cache after updating, so for a few hours afterwards people were still getting the old ‘good’ files that they’d been getting for weeks since the last Discourse update. Then after 4 hours, Cloudflare started updating it’s own cache, saw new Discourse files and minified them before add them to its cache. Then as browsers requested updates for their own caches they got the corrupted files. As browsers updated their own caches at different times each user saw things go awry at different times.
Lessons learned:
- Purge the Cloudflare cache after applying a Discourse update. Seems obvious now, but I’d not thought about it before!
- Don’t enable auto-minify. I must have done it but I don’t know how/when. I already knew it wasn’t a good idea having broken a Wordpress site with it some time ago, but this has re-inforced the message.
Many thanks to @JammyDodger and @david for helping me to solve this 